• by Sean Hargrave , Staff Writer, May 23, 2019

Those three words have summed up the phony war adland has undergone all year. No journalist could open their inbox for some report or another on how many SMEs are not fully compliant. Typically, it boils down to a privacy policy that doesn't fully explain what they do with data and under which of the six legal justifications offered by the GDPR. 

Then there are all the customer surveys that have been popping up all week again, as the first anniversary nears. Suffice it to say that most Brits don't believe they've noticed a difference in how companies handle their data and around a fifth to a third, depending on which research you believe, don't know what the GDPR is or what it should mean to them.

However, all of this is merely a side story compared to the really big issue. Who cares about SMEs? The fact that people know about as much about the GDRP as they did the Data Protection Act it replaced is not a huge surprise.

I've blogged before about how there is only really one massive question, and it involves the duopoly's compliance. 

Many questions have been raised before, but now we have confirmation that the Irish Data Protection Commission (DPC) will investigate the tech giant over its personalisation of ads via data about a user that follows them around the internet. The fact that Google, the US giant that makes most of its EU money in the UK, is being investigated in Ireland tells you everything you need to know about the tech giant.

Yes, we're dealing with our old pal Ireland, the country at the edge of the EU that likes to pitch itself as a tax-efficient base. Readers will probably remember the EU had to get very angry with the country to force it to end a tax deal, and against its will require Apple to pay billions of Euros in back tax. You get the picture?

So Google is being investigated in Ireland, a country you can't imagine wants to rock the boat for the tech giants it harbours. If these companies could choose a potentially sympathetic EU member to be tried by, Ireland would be top of the list. 

The key question will be whether Google uses personal information. It may argue that it anonymises data, and then whether it has the correct informed, granular permissions to gather and use personally identifiable information on its properties and beyond. Further questions will be whether it has explained what the data will be used for and the legal basis for processing it.

To be honest, and I've talked with people across the industry, most people simply don't know whether the tech giant that dominates the UK digital advertising scene is compliant or not.

Most have been waiting for an investigation to be launched so they can find out, in turn, whether they have been inadvertently helping Google break the law through running campaigns using its data-targeting capabilities.

I cannot stress strongly enough that this is the decision that London's adland scene has been waiting on for an entire year and nobody knows for sure which way it will go.

The BBC predicts the investigation will take many months, possibly even a year or longer. So, if GDPR's first birthday present is a Google investigation, its second could be the verdict.