Targeted advertising is the primary revenue stream for the largest online platforms that act as the internet’s gatekeepers, such as Alphabet and Meta. The financial incentives drive targeted... Show moreTargeted advertising is the primary revenue stream for the largest online platforms that act as the internet’s gatekeepers, such as Alphabet and Meta. The financial incentives drive targeted advertising towards maximizing the efficiency of algorithmically matching advertisements with consumers, which typically requires building fine-grained profiles that rely on consumers’ personal data. In the European Union (EU), the protection of personal data is a fundamental right operationalized by the General Data Protection Regulation (GDPR), establishing the limits of targeted advertising to the extent that it relies on the processing of personal data. Nevertheless, as online interface design and fine-grained personalization allow platforms and other publishers new ways to influence consumers, targeted advertising is also associated with the potential for consumer manipulation.While the consumer protection framework in the EU is the primary field that protects consumers from manipulation, it has received little attention in academia in the context of targeted advertising whencompared with the GDPR. In 2022, the EU adopted proposals for the Digital Services Act (DSA) and the Digital Markets Act (DMA), which contain consumer protection rules that directly limit targeted advertising. These developments in consumer protection law may fundamentally transform the internet, as its gatekeepers are now faced with a new legal regime that regulates their primary source of revenue.This Article provides an overview of the myriad of legislation that comprises the EU consumer protection framework—including how it intersects with the data protection framework—and analyzes how andthe extent to which it coalesces to limit targeted advertising. Show less
Upon receipt of a right to be forgotten request, private actors like Google are responsible for implementing the balancing test between competing rights of privacy and data protection and free... Show moreUpon receipt of a right to be forgotten request, private actors like Google are responsible for implementing the balancing test between competing rights of privacy and data protection and free expression and access to information. This amounts to private jurisprudence that data subjects, lawyers, and interested parties could, theoretically, game to their advantage. This paper critiques this process and argues two separate, but related points. (1) Search engines have become the sole arbiter of the rights to privacy and data protection under Articles 7 and of the Charter of Fundamental Rights and Articles 8 and 10 of the European Convention of Human Rights, when safeguarding should be a responsibility of state authorities. (2) As private actors face litigation if their decision is not acceptable to the data subject, the right to access information and the public's right to know is compromised. Search engines exert considerable power over access to and Internet usage, yet nevertheless benefit from frameworks that permit a lack of adherence to similar human rights standards as public actors or agencies. As such, empowering search engines as decision-makers over conflicting fundamental rights is problematic. Rather than allow the content of the right to be forgotten to be fleshed out by private actors, the significant body of existing jurisprudence should form the basis for public guidelines on how to implement the right to be forgotten. An analysis of case law of national courts, the European Court of Human Rights and the CJEU reveals two related matters: it is possible to reverse engineer how search engines determine which requests will be actioned and those which will be denied. This paper argues a) collectively the body of jurisprudence is of sufficient standing to develop a public and transparent balancing test that is fair to all stakeholders and b) private actors should no longer be resolving the conflict between competing fundamental rights. The paper closes by positing a framework, loosely based on ICANN's Uniform Domain Resolution Procedure for resolving conflict between conflicting cyber property rights that provides transparency and accountability to the right to be forgotten and removes search engines as arbiters of the balancing test in select cases. Show less
