This page analyses the vendors participating in the IAB Europe Transparency and Consent Framework. These vendors engage in Real-time bidding (RTB). In RTB, advertisements are auctioned in an inherently nontransparent environment. Bid requests are broadcasted to a large number of companies. These companies create profiles of user behaviour that might concern intimate details about people lives. We believe that such profiling can be performed only with user fully informed consent. However, the consent is not informed and often not given freely.
Purposes and features in Czech language (TCFv1.1).
The storage of information, or access to information that is already stored, on your device such as advertising identifiers, device identifiers, cookies, and similar technologies.
ePrivacy mandates storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
Hence, information storage and access can be performed only with consent. Note that some countries ignore ePrivacy and allows information storage and access as legitimate interests. For example, see the report for the European commision on page 63
List all vendors violating ePrivacy
The collection and processing of information about your use of this service to subsequently personalise advertising and/or content for you in other contexts, such as on other websites or apps, over time. Typically, the content of the site or app is used to make inferences about your interests, which inform future selection of advertising and/or content.
Personalisation allows vendors to build profiles.
The collection of information, and combination with previously collected information, to select and deliver advertisements for you, and to measure the delivery and effectiveness of such advertisements. This includes using previously collected information about your interests to select ads, processing data about what advertisements were shown, how often they were shown, when and where they were shown, and whether you took any action related to the advertisement, including for example clicking an ad or making a purchase. This does not include personalisation, which is the collection and processing of information about your use of this service to subsequently personalise advertising and/or content for you in other contexts, such as websites or apps, over time.
Ad selection, delivery, reporting allows vendors to use the profile to select ads.
The collection of information, and combination with previously collected information, to select and deliver content for you, and to measure the delivery and effectiveness of such content. This includes using previously collected information about your interests to select content, processing data about what content was shown, how often or how long it was shown, when and where it was shown, and whether the you took any action related to the content, including for example clicking on content. This does not include personalisation, which is the collection and processing of information about your use of this service to subsequently personalise content and/or advertising for you in other contexts, such as websites or apps, over time.
Content selection, delivery, reporting allows vendors to use the profile to select other content.
Personalisation and Ad selection, delivery, reporting may bundle RTB auctions. ICO claims that RTB processing cannot be based on legitimate interests as it broadcast personal data to many companies.
Article 22 of GDPR gives the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. We believe that advertisements based on profiling can have significant effects, see for example Redirect and how it was used by by Berlinquette who argues that the same technique can be used for bad Additionally, researchers described outing homosexuals, price discrimination, and embarrassed users in front of friends or co-workers. Hence, profiling should be based on the data subject's explicit consent.
We consider Personalisation, Ad selection, delivery, reporting, and Content selection, delivery, reporting to be a part of profiling, hence, these three purposes should be done with user explicit consent. However, it might be that some companies do not profile for sensitive attributes.
List all vendors honoring the right not be subject to profiling with significant effects List all vendors that might be violating the right not be subject to profiling with significant effects
The number of companies tracking you with consent. Not as legitimate interests.
The collection of information about your use of the content, and combination with previously collected information, used to measure, understand, and report on your usage of the service. This does not include personalisation, the collection of information about your use of this service to subsequently personalise content and/or advertising for you in other contexts, i.e. on other service, such as websites or apps, over time.
Companies can track your usage of the service, such as mouse
movements, form data, or the context
in which an ad is shown. See the
wording of
iTCFv2
purposes.
Combining data from offline sources that were initially collected in other contexts.
Allow processing of a user's data to connect such user across multiple devices.
If you are using multiple devices, such as laptop, phone, tablet, companies can link your activities.
Some companies believe that users cannot be identified. However, the offline-world data come with identifiers such as names, an equivalent of social security numbers, e-mail addresses, phone numbers; the linked profile reveals the identity of the user. One option to link multiple devices of the same person is to match shared identifiers such as internet accounts where the user logs in (Adbrain, 2015) or e-mail addresses associated with both profiles. However, device linking might be based on pseudonyms and link devices based on heuristics of IP addresses and common attributes between the profile. Hence, the number of companies de-pseudonymizing users lays between those matching offline data (lower bound) and those matching offline data or link devices (upper bound).
List all vendors de-pseudonymising users due to offline data matching. List all vendors that do not match offline data but do link multiple devices, these vendors are possibly de-pseudonymizing users.
Allow processing of a user's precise geographic location data in support of a purpose for which that certain third party has consent.
Companies can track all your movements with absoulte precision. Without this feature, 500 meters accuracy is allowed. Yes, even without this feature, companies can still track your movements quite precisely.
Some companies perform all activities as legitimate interets.
List all vendors performing all processing as legitimate interests
However, some of this companies perform only measurements. This might be processors performing part of the analysis for controllers. Depending on the type of the measurement, it is possible that they really have legitimate interests that are not overriden by interests of data subjects.
List all vendors performing measuremets as legitimate interests
Some companies perform all purposes as legitimate interests: Information storage and access, Personalisation, Ad selection, delivery, reporting, Content selection, delivery, reporting, Measurement. This definitely breaks ICO findings.
List all vendors performing all purposes as legitimate interests