It is estimated that the average consumer is exposed to up to 10,000 ads in a single day. Advertising is a big part of the consumer experience and as technology increasingly plays a protagonist role in our daily lives, it is no news that online advertisements are steadily replacing the more traditional forms of publicity. The UK's Internet Advertising Bureau recently announced that the overall digital ad spend in the UK grew by 13.8% to £5.56 billion in the first half of 2017 alone, with spend in online video ads overtaking the expenditure on banner ads for the first time.

At the same time, over 40% of the world's population now has access to the internet and users are constantly leaving digital footprints, across a range of online channels, by willingly sharing mass volumes of useful data. This creates a huge market for advertisers, as well as a vast pool of insightful information about consumer behaviours and preferences. Technology giants such as Google and Facebook are also making an impact by creating platforms that enable data not only to be collected more easily but also analysed and extracted.

These combined developments have kick-started the reshaping of the advertising industry, particularly in terms of enabling organisations to target advertising at their most receptive audiences. And the forms of targeted advertising continuously evolve – they can be based on a wide range of information, including browsing history, purchasing habits, sociodemographic traits such as consumers' age, gender, race and economic status, psychographic characteristics, including a consumer's lifestyle, opinions and values, or geographic location, to name a few. Add to the mix the increasingly sophisticated technologies that companies are developing and applying to deepen their understanding of consumer reactions and accurately predict behaviours, and you end up in a world where advertising becomes incredibly personalised.

Tracking consumers' digital footprints

The most significant type of targeted advertising is known as "online behaviouraladvertising" (OBA), and involves the use by companies of information about an individual's online browsing habits to produce advertising that is personalised to that individual's preferences and interests. This can be either "site-based" or "network-based". The majority of OBA is site-based and works through "cookie" files that are placed on consumers' computers to track the pages that the user visits either only on the tracking organisation's own website (first party OBA), or also on third party partner websites which are members of the same advertising network (third party OBA). Advertisers who use first party OBA include for example news websites or online retailers such as Ebay or Amazon. OBA can also be undertaken at a network level by making use of "deep packet inspection" (DPI) techniques which examine all traffic on a user's computer. This has been trialled in the UK, but is not currently in use.

Similarly, social media advertising also makes use of its users' browsing activities, for example by targeting ads based on Facebook pages that someone has liked. Due to the larger amount of information that social networks gather, in addition to simply reactively targeting users based on their behaviour, advertisers on social media can also create profiles and target the consumers before they even undertake any activities online. For example, Facebook allows advertisers to target an audience in three ways. Targeted advertising can take place via "precise" interests, which enables advertisers to group users according to specific words shared on their timelines (eg relating specifically to the English cricket team), or via "Facebook categories", which is aimed at those who have shared terms on their timeline that relate to a broader topic or interest (eg relating to cricket more broadly). Alternatively, targeting can take place based on "partner categories", which are groups created by third party data providers and based on the users' browsing activities outside of Facebook.

Advertisers can also undertake "locationbased advertising" by making use of the location data collected by mobile devices to personalise their messages to consumers based on their current location. Since the data is given in real time, this makes the ads very timely and this is one of the key strengths of this type of targeted advertising. For example, in 2014, Starbucks tracked users' device ID and location and provided ads based on that information. The metric for assessing success was the number of people that walked into a Starbucks as a result of the ad. The conclusion was that the likelihood of a person entering into a branch increased by 100% after seeing the location-based ad.

The next level – using technology to identify consumer reactions to ads

In order to maximise the efficiency of targeted advertising, companies are already taking it to the next level by linking different forms of targeted advertising with emerging technologies to obtain a deeper understanding of the way in which a target audience reacts to and interprets the ads that they are exposed to online.

For example, Canon Europe has been working with Clicktale, a digital customer experience company, and using "behavioural economics technology" to interpret a person's digital body language by analysing user behaviour on the website and classifying them into categories such as "focused" or "disoriented". The technology tracks online behavioural patterns based on millisecond-level actions, including hovers and scrolls. It uses cognitive computing, machine learning and psychological research to enable Canon to enhance the consumer experience and their website design.

The use of sensory research technology can also add real value to brands in the context of targeted advertising. According to Shutterstock, the picture library brand, the choice of images for online ads can be a highly influencing factor in grabbing the attention of consumers. Consequently, the company undertook eye-tracking research which revealed that the images are most effective where they reflect the demographic profile of the target customers. For instance, ads that include pictures of children are more likely to be viewed longer by parents.

Privacy, data and consumer protection concerns

All forms of targeted advertising can bring huge benefits to the organisations that make use of them, and this is even more the case where companies invest in new technologies that can help them go the extra mile in terms of research and insight. Targeted advertising can also be advantageous to consumers, who can gain free access to content and no longer have to be exposed to irrelevant advertising. Nonetheless, targeted advertising, and OBA in particular, also gives rise to a variety of concerns and associated legal issues.

Privacy is the key concern and consumers have repeatedly expressed worries about the potential misuse of the data collected. Therefore, the issue of obtaining consent from consumers is crucial. In the UK, the processing of personal data as part of OBA must be performed in compliance with the Data Protection Act 1998, which requires that individuals' personal data be processed fairly and lawfully. This means that users must be given notice about the use of their personal data and must consent to such use. However, it remains to be seen exactly how this must apply in practice, depending on the type of OBA that is being used. For example, whilst it may be sufficient to simply provide the information in a website privacy policy when undertaking first party OBA, the standard of notice for third party OBA and when using  DPI techniques may have to be higher to satisfy the fairness requirement, given the greater intrusion.

Another related question that has caused a lot of debate is whether OBA must be conducted on the basis of a user's explicit "opt-in" consent, or whether it is enough for the user to "opt-out". Evidently, best practice would be to obtain opt-in consents but the approach of the advertising industry is to rely on opt-outs. This is reflected in the UK Code of Advertising (CAP Code) and the Internet Advertising Bureau's "Good Practice Principles for Online Behavioural Advertising".

On the other hand, this is further complicated by the fact that the Privacy and Electronic Communications (EC Directive) Regulations 2003 require that prior consent (ie opt-in) be obtained before processing traffic data for the purpose of providing "value-added services". The Information Commissioner's Office (ICO) considers OBA to fall under this category of services and therefore require opt-in consent. However, again, it is unclear if this applies to all types of OBA or just where it uses DPI techniques.

More generally, OBA also has the potential to amount to a criminal offence under the Regulatory Investigatory Powers Act 2000, which prohibits intentional interception of communications and making the contents available to another person, except in certain circumstances. However, it is unclear if OBA will amount to an "interception" in all circumstances and it is likely that this will depend on how the technology works, as well as the circumstances of each case.

In addition, the Consumer Protection from Unfair Trading Regulations 2008 (CPRs) prohibit unfair commercial practices which distort consumers' transactional decisions and in the context of OBA, it remains to be seen how successfully it can be argued that a breach of the CPRs arises if consumers take a different transactional decision, for example by choosing not to view a website, because they were given false or deceptive information about how OBA works.

CONCLUSION

During the past decade, developments in the Information and Communication Technology (ICT) space, including a surge in the number of available online channels and platforms, together with shifts in consumer behaviour, have produced an ocean of data about every minute aspect of digital behaviour. In combination with significant investment in online advertising, this has caused both disruption and innovation in the digital ad market. The methods used to target advertising to the most responsive audience are clearly growing in complexity and accuracy. The opportunity is evident – but it does not come without challenges.

Chief among them is the importance that consumers place on their privacy. In 2016, a study carried out by YouGov indicated that only approximately 30% of  internet users felt comfortable with their online behavioural information being used to provide them with more personalised online ads, whereas 62% expressed feeling uncomfortable, placing greater importance on their privacy. Media owners will therefore have to overcome the challenge of reducing this resistance by appropriately explaining the "value exchange" to consumers, namely that their consent to being shown ads gives them the ability to access free content and services. The law will also have a supporting role to play in this regard – given the current uncertainty about how such consent must be obtained in compliance with data protection legislation and advertising regulation, further clarity from government and policy-makers on this point would be valuable. Knowing that there are clear requirements regarding the methods used to obtain consent for the use of personal data or for being subject to targeted advertising may ultimately contribute to a more relaxed consumer approach towards targeted ads.

Marketers should also realise that the average consumer's attention span is now extremely short – in fact, just eight seconds according to Microsoft. And the multitude of media and sales channels that people are exposed to today only further contributes to a potentially fragmented network of marketing avenues. Indeed, to some extent, a company's successes associated with targeted advertising will depend on its ability to apply adequate tools and make use of timely consumer data. But crucially, it will also largely be impacted by how well the company can assess the ways in which its ads work together across all available platforms in order to cause customers to "bite the bait" but also to take the next step and make a purchase.