Back in May 2020, the ICO put its investigation into real time bidding (RTB) and the adtech industry on hold due to the pandemic. It stated “it is not our intention to put undue pressure on any industry at this time but our concerns about adtech remain and we aim to restart our work in the coming months, when the time is right.” 

The ICO has now decided that the time is right, and its concerns have very much remained. It has said that "the complex system of RTB can use people’s sensitive personal data to serve adverts and requires people’s explicit consent, which is not happening right now...sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, also raises questions around the security and retention of this data". 

Over the coming months, the ICO will be issuing assessment notices to specific companies following a series of audits, focusing on digital market platforms. It will also be reviewing the role of data brokers in the adtech eco-system, following on from its recent data broking investigation into offline direct marketing services and enforcement action.

All organisations operating in this space have been advised by the ICO to assess how they use personal data as a "matter of urgency" - particularly focusing on consent, legitimate interests, data protection by design and data protection impact assessments.