Today we got the guidance that in its opinion, there is a heap of work that must be done to make digital advertising GDPR-compliant. Real-time bidding (RTB) was named and shamed as the arch culprit for the very good reason it is arguably where we find the clearest gap between what people sign up to and what they are delivered.
When the average European goes surfing around the net, they will often visit favourite sites that they have given permission to store their data so they can make product recommendations and serve up targeted advertising.
There will be countless other sites they have chanced upon that insist a "got it" or "okay" button is clicked to allow a cookie to be placed. More importantly for the user, it's the routine removal of a barrier to enjoying content that rarely offers a "no" option and thus is just a part of everyday surfing.
The ICO never really felt that this is what GDPR was all about, did it? Where is the informed consent? Where is the granular permission? Where is the protection against the collection of information pertaining to special categories such as religion, race, sexuality, health and political views?
The problem is that we just have no idea where any of this is because nobody truly has much of a clue what personally identifiable permission a site or brand is asking for, and we have even less of a clue what they intend to do with it and whom it will be shared with.
It's possible some of this is hidden away in a privacy page somewhere on their site, but when it comes to saying yes to a cookie, none of this is made explicitly clear.
It goes even deeper when signed into a social media profile or being logged in under a Google profile. Here you have all manner of data following you around the internet -- and yet if you asked someone, if they felt they had given permission to be followed around the net.
The ICO is right in calling for the system to be reevaluated, and hopefully, made compliant with GDPR.
At the moment, even the biggest apologists for how digital advertising works will admit in private that there is just too much data flowing around for all sides of the industry to engage with digital advertising, and rest assured that the industry is compliant.
As I said to anyone who asked at the end of May, we really don't yet have a clue what the true impact of GDPR will be because we don't know whether digital advertising is actually compliant.
So far, all that's happened is that people click "okay" to carry on browsing, without really knowing what that means.