IAB Europe suspends consent management firms as global privacy authorities signal tougher action

Warnings and suspensions by industry itself

In a rare move, the ad industry itself is dishing out its own tough love. The Interactive Advertising Bureau in Europe in the last six months has sent letters to approximately 10 companies that provide consent management services to website publishers, warning that they were not compliant with the industry’s voluntary Transparency and Consent Framework, according to Filip Sedefov, legal director for privacy at IAB Europe. That framework — which sets standards for managing the flow of data tracking consent throughout the digital ad supply chain and was designed for compliance with the GDPR — requires consent management platforms to present notices to people in a specific manner detailed by IAB Europe.

“If there is use of dark patterns, for example, we can sanction that,” Sedefov told Digiday.

The trade body has also suspended “one or two” consent management platform companies temporarily in the last six months for failing to abide by IAB Europe’s user interface guidelines, he said. The organization’s agreements with companies registered to use its consent framework prohibit IAB Europe from revealing the names of companies that received warning letters or have been suspended. Those suspensions, “are only active for as long as the issues are not fixed,” which may be only a matter of weeks, said Sedefov.

IAB Europe has conducted manual and automated monitoring of websites and their consent management systems, detecting infractions including failure to notify people in a way that appropriately informs them about data collection or purposes for data use by third parties or ad tech vendor partners. IAB Europe told members in 2020 it would be enforcing guidelines for implementing the consent framework standards, noting that “Non-compliant [consent management platform] implementations undermine the reputation of the [Transparency and Consent Framework] and expose participating organizations to serious legal risks.”

Still, IAB Europe’s own suggested approach for user interfaces for tracking notice and choice are not as strict as what some privacy advocates and regulators might prefer. While the trade group’s design guidance suggests that people should be able to click an “accept all” button in the initial notice shown, it recommends that companies need only present options to reject tracking on a subsequent page denoted by a button labeled vaguely, “manage settings.”

Privacy watchdogs have argued many common approaches are not good enough. “Clicking through cookie consent buttons is not meaningful consent,” said Jennifer King, privacy and data policy fellow at the Stanford Institute for Human-Centered Artificial Intelligence. For instance, she argued during an April workshop held by the Federal Trade Commission to address opaque user design tactics, that when an “accept” button is highlighted in advance, “you can argue that’s a dark pattern.” The FTC is the data protection authority representing the U.S. in the G7.

Stacey Gray, senior counsel at the Future of Privacy Forum, agreed that consent notice banners and pop-ups have “clearly been inadequate as a single solution for consumer privacy.” She added, “Cookie walls, notice fatigue, deceptive banner design (“dark patterns”), and the practical inability of expecting users to make informed choices, are all real problems that deserve better legal approaches.”

King said, “I would suggest we need to think at a higher level about the decisions we could make that have a more systemic effect on how our data is collected and used, instead of thousands of micro transactions that grind away at our patience.”