AdTech round-up 2022: January 2023
Blog View Points

In last year’s round-up, we foresaw a busy and unpredictable year for adtech in 2022, and we weren’t wrong In our latest edition, it is clear now more than ever that there is no single source of regulation when it comes to online advertising – globally there have been developments in data protection law, competition regulation and online safety, with adtech being caught in the crossfire at all turns. This patchwork approach to regulation means that practitioners will need to consider a range of legal domains in order to achieve compliance with applicable requirements. In this edition, among other things, we look ahead to the updated UK Online Safety Bill, the finalized EU Digital Services Act, and a potentially even busier year ahead in the U.S. and Asia. UK 1 EU 3 France 5 Germany 7 Greece 9 China 10 Singapore 11 California 13 Colorado 15 Contents Reed Smith 01 Confidential Online Safety Bill In 2022, the Online Safety Bill (OSB) came under increased scrutiny and there were even rumors of its abandonment; however it finally returned to the House of Commons on December 5, 2022, with an updated version being published shortly after, containing a number of significant amendments. The OSB of course covers a very broad range of topics, but below we focus on the specific implications around adtech and advertising in the most recent draft. The current draft of the OSB covers advertising in several different respects: User-generated content In relation to user-generated content (i.e., content uploaded to a service by a user that may be accessible by other users of that service), certain advertisements may fall within the scope of this definition. Where an advertisement has been uploaded by a user to a service which other users of that service may see (i.e., a sponsored post or video uploaded by an influencer, or a live video where a user is advertising a product), this will constitute user-generated content and will therefore be subject to the OSB’s various content obligations (relating to illegal content and content that is harmful to children/adults). The result of this is that a large amount of advertising on social media platforms, which is already regulated in other ways such as by the Advertising Standards Authority, will be subject to further scrutiny by the OSB. There have been several material developments including, most significantly, the plan to include a “legal but harmful” provision regarding online content being scrapped. The changes mean that platforms will still be required to remove illegal content but have discretion to enforce their own content policies in relation to “legal but harmful” content. The changes seek to protect freedom of speech by prohibiting platforms from removing or restricting user-generated content, or suspending or banning user accounts, provided there is no breach of their terms of service or applicable law. Paid-for ads Obligations in relation to other types of advertising have also been introduced by the OSB. Advertisements that are not user-generated content (i.e., have not been uploaded by a user), but have involved the service provider receiving some sort of monetary or non-monetary payment to display that advertisement, also fall within the OSB. This type of advertisement is caught by new fraudulent advertising safety duties. Duties are specific to Category 1 services (the highest reach user-to-user services with the highest risk functionalities) and Category 2A services (the highest reach search services). Generally, Category 1 and 2A services must use proportionate systems and processes designed to: (i) prevent individuals from encountering fraudulent advertisements; (ii) minimize the length of time fraudulent advertisements are present on the service; and (iii) swiftly take down such content when alerted to its presence or otherwise becoming aware of it. Category 2A services must include clear and accessible provisions in their terms of service about technologies in place to prevent fraudulent advertisements appearing on their service, whereas Category 1 services must publish a publicly available statement containing the same information. Specific steps to address fraudulent advertising will be set out in an upcoming Ofcom code of practice. Further amendments to the OSB will be considered at the report stage in the House of Commons on January 17, 2023. While the plans were that it would come into force by May 2023, the most recent amendments may cause a delay to this. Data Protection and Digital Information Bill The Data Protection and Digital Information Bill (DPDI) was laid before Parliament on July 18, 2022 in response to the “Data: a new direction” consultation. The DPDI is still in its infancy and the second reading, which was due to take place on September 5, 2022, was postponed with no indication as to when it will take place. The impetus behind the DPDI is to update and reform the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulation 2003. The UK government has stated that nothing in the DPDI would threaten the UK-EU adequacy arrangement in place, which allows for the sharing of personal data between the UK and EU without the need for standard contractual clauses. While the wider implications for advertising and adtech are forthcoming in future drafts and guidance, the DPDI does aim to “remove the need for unnecessary cookie consent banners” and as such creates exemptions to consent requirements. These currently only extend to low-risk activities such as audience measurement; however the DPDI allows for further consent exemptions to be added via secondary legislation, so this is subject to change. UK 02 Reed Smith Confidential A year of the Children’s Code September 2022 marked the first anniversary of the Information Commissioner’s Office’s (ICO) Children’s Code (also known as the Age Appropriate Design Code), along with its 15 standards for the design of online services processing children’s personal data. Personalization of online advertising is covered by the scope of the code, which prohibits profiling by default and requires that only the minimum amount of a child’s personal data should be processed in order to provide them with an online service. In short, this mean