348 ARTICLE International Data Privacy Law, 2021, Vol. 11, No. 4 Reflections on the murky legal practices of political micro-targeting from a GDPR perspective Cristina Blasi Casagran * and Mathias Vermeulen** Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 Introduction Key Points Political campaigns are increasingly shifting their cam- paigning efforts from traditional media to online plat-  This article seeks to explore one of the recent forms, utilizing the advertising tools offered by Facebook/ controversial EU debates related to political mi- Instagram,1 Google/YouTube, Twitter, Pinterest or cro-targeting (PMT): is the practice of PMT TikTok. Advertisers believe they are better able to target compliant with the EU’s General Data Protection or reach an audience that may be interested in their mes- Regulation (GDPR)? sage by using an ad platform’s targeting tools. Online data  After examining the two most relevant ad tar- collection practices by both the advertiser and the plat- geting tools used for PMT, this article examines form allow them to classify and segment their desired au- how PMT raises several questions related to (i) dience in an attempt to tailor their messages according to some of the principles listed in Article 5 of the the make-up and profile of specific groups. GDPR, (ii) the uncertainty on who the data Within this context, the phenomenon of political controller is, (iii) the ways to gather valid con- micro-targeting has emerged. The term ‘micro-targeting’ sent, (iv) excessive profiling practices, and (v) refers to the extreme form of audience segmentation the limited privacy by design and default made possible by mining audience data and combining features. multiple datasets for predictive analysis.2 The prefix mi-  It can be argued that significant changes are cro- is used to indicate that a highly specific audience is necessary with regards to the manner in which being targeted, ie it always focuses on small, precise, ho- political actors and social media platforms en- mogeneous groups based on common factors. However, gage with their data protection obligations in the precise threshold criteria that distinguish micro- PMT. If these cannot be met and/or are not be- targeting from ‘regular’ targeting practices are not clearly ing complied with, the current way in which defined elsewhere, as they really depend on each specific PMT is performed could likely be considered context and scope.3 Micro-targeting can be seen as a sub- unlawful. set of ‘online behavioural advertising’ (OBA),4 in the sense that not commercial actors but political actors5 tar- * Cristina Blasi Casagran, Assistant Professor, Public Law Department, 3 Tom Dobber, Ronan Ó Fathaigh and Frederik Zuiderveen Borgesius, Autonomous University of Barcelona, Bellaterra, Spain, Email: cristina. ‘The Regulation of Online Political Micro-targeting in Europe’ (2019) 8 blasi@uab.es Internet Policy Review 4. ** Mathias Vermeulen, Associate Fellow Law, Science and Technology 4 See Juan Miguel Carrascosa and others, ‘I Always Feel like Somebody’s Research Group Vrije Universiteit Brussels, Brussels, Belgium.This work Watching Me: Measuring Online Behavioural Advertising’, CoNEXT ’15: was supported by the Re:constitution programme of Forum Proceedings of the 11th ACM Conference on Emerging Networking Transregionale Studien and Democracy Reporting International. The Experiments and Technologies 13 (2015), 1–13; Edith G Smit, Guda Van authors would also like to thank the editors of this journal, the anony- Noort and Hilde AM Voorveld, ‘Understanding Online Behavioural mous reviewers, as well as the useful suggestions and comments from Advertising: User Knowledge, Privacy Concerns and Online Coping Colleen Boland, Daniel Morente, Christopher Neeson and Laureline Behaviour in Europe’ (2014) 32 Computers in Human Behavior 15–22. Lemoine on this article. 5 For the purpose of these study, the general term of ‘political actor’ 1 See ‘Facebook Ad Library’, Facebook accessed 6 August 2021. brokers or other data analytics companies. 2 ‘Who targets me’ accessed 6 August 2021. C The Author(s) 2021. Published by Oxford University Press. V This is an Open Access article distributed under the terms of the Creative Commons Attribution-NonCommercial-NoDerivs licence (http://creativecommons. org/licenses/by-nc-nd/4.0/), which permits non-commercial reproduction and distribution of the work, in any medium, provided the original work is not al- tered or transformed in any way, and that the work is properly cited. For commercial re-use, please contact journals.permissions@oup.com Cristina Blasi Casagran and Mathias Vermeulen  Political micro-targeting from a GDPR perspective ARTICLE 349 get individual voters with highly personalized messages Ad targeting tools relevant for political by applying predictive modelling techniques to voter micro-targeting data.6 In the European Union (EU) and its Member States, PMT usually takes place via social media platforms. The the practice of PMT has been increasingly considered a majority of online ad-driven platforms enable adver- threat to the electoral process, partly because it can op- tisers to define particular target groups for the ad prior erate as a vector for disinformation.7 It also raises con- to its creation. Then the platform delivers the ad to spe- cerns due to the fact that PMT could be used to increase cific users based on the advertisers’ budgets, their ad polarization of the electorate,8 and identify and target performance objectives, and the predicted relevance to weak points where groups and individuals are most vul- certain users. For PMT conducted by social media nerable to strategic influence,9 amongst others. For in- platforms, two advertising mechanisms stand out: (i) stance, it has been evidenced that during the US Attribute-based Audiences technology, and (ii) Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 presidential election of 2016, the Russian Internet Personally Identifying Information Audiences Research Agency (IRA) used online targeted advertising technology.13 to exacerbate tensions and suppress voter turnout Attribute-based Audiences targeting tools allow among certain groups, including most notably young political actors to manually select a target audience black Americans involved in racial justice activism. 10 In for a particular ad or ad campaign based on various fact, it was as a result of the experiences in the 2016 US characteristics, using data that the social media plat- presidential elections that PMT began to receive in- form has previously collected and processed about creased attention from policymakers in the EU. individuals. Facebook, for instance, lists five charac- This study seeks to explore one of the recent contro- teristics that can be selected for such targeting: (i) lo- versial EU debates related to PMT:11 is the practice of cation, (ii) demographics, (iii) interests, (iv) PMT compliant with the EU’s General Data Protection behaviour, and (v) connections. Through this tool, Regulation (GDPR)?12 After examining the two most rel- political actors could, for instance, specify that their evant ad targeting tools used for PMT the article explores ad campaign should target ‘males living in Barcelona how PMT raises several questions related to some of the interested in politics and religion, between the ages principles listed in Article 5 of the GDPR, namely (i) law- of 25-30’. Their ad would be displayed for users that ful processing (ii) the purpose limitation principle (iii) the platform estimates fit these attributes, but politi- the data minimization principle (iv) the data accuracy cal actors in principle will not have access to those principle, and (v) data accountability. It can be argued users’ personal information. It is important to add that significant changes are necessary with regards to the that for these cases, the ad platform is the sole data manner in which political actors and social media plat- controller. forms engage with their data protection transparency A second category of targeting tools is termed obligations in PMT. If these cannot be met and/or are Personally Identifying Information Audiences (PII not being complied with, the current way in which PMT Audiences) ad delivery tool. Depending on the plat- is performed could likely be considered unlawful. form, this tool is referred to as ‘Custom Audiences’ 6 Ira Rubinstein, ‘Voter Privacy in the Age of Big Data’ (2014) 5 Wisconsin 11 Samuel Stolton, ‘EU Executive Mulls Tougher Rules for Microtargeting Law Review 861–936. of Political Ads’ (Euractiv, 3 March 2021) accessed 6 August 2021. Misinformation or the New Evil for Voting Rights (2020) 8 Groningen 12 Regulation (EU) 2016/679 of the European Parliament and of the Journal of International Law 1. Council of 27 April 2016 on the protection of natural persons with regard 8 Judit Bayer, ‘Double Harm to Voters: Data-driven Micro-targeting and to the processing of personal data and on the free movement of such Democratic Public Discourse’ (2020) 9 Internet Policy Review 1, 10; data, and repealing Directive 95/46/EC (General Data Protection Matteo Cinelli and others, ‘The Echo Chamber Effect on Social Media’ Regulation) [2016] OJ L119/1 (‘GDPR’). (2021) 118 Proceedings of the National Academy of Sciences 9. 13 These technologies have been previously analysed by Giridhari 9 Anthony Nadler, Matthew Crain and Joan Donovan, ‘Weaponizing the Venkatadri and others, ‘Privacy Risks with Facebook’s PII-based Digital Influence Machine: The Political Perils of Online Ad Tech’ Data Targeting: Auditing a Data Broker’s Advertising Interface’ Proceedings of & Society Research Institute, 5 (datasociety.net, 17 October 2018) the IEEE Symposium on Security and Privacy (S&P), May 2018; and accessed 6 August 2021. Facebook’s Targeted Advertising’ (2019) 1 Proceedings on Privacy 10 Jason Parham, ‘Targeting Black Americans, Russia’s IRA Exploited Racial Enhancing Technologies 227–44. Wounds’ (Wired, 12 August 2018) accessed 6 August 2021. 350 ARTICLE International Data Privacy Law, 2021, Vol. 11, No. 4 Table 1. Main personal data items that political actors can upload to create PII Audiences Name Email Phone Nr. City/ State/ Birthday/ Employer Site Mobile ZIP Province Gender user ID Advertiser ID Facebook Instagram Twitter Google Pinterest LinkedIn Giridhari Venkatadri and others, ‘Privacy Risks with Facebook’s PII-based Targeting: Auditing a Data Broker’s Advertising Interface’ Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 Proceedings of the IEEE Symposium on Security and Privacy (S&P), May 2018, 2. (Facebook),14 ‘Customer Match Audiences’ (Google),15 data (online or offline) through a variety of methods and ‘Tailored Audiences’ (Twitter),16 ‘LinkedIn’s Audience sources, including from the membership/donors registers Match’ (LinkedIn)17 and ‘Pinterest’s Audiences’ of the political party, from public voter files, or in return (Pinterest)18 respectively. In theory, these tools would for some form of ‘free’ service/voucher for which users allow political actors to target their existing contacts on had to first provide their personal details. the ad-driven platform via multiple methods. The most It is important to note that in this context US politi- common way to execute this is by uploading a list of cal parties have access to far more personal information email addresses, phone numbers or mobile advertiser on their voters than political parties in the EU. Both the IDs19 the political actor already possesses in order to Republicans and the Democrats have their own ‘in- then identify the associated social media accounts of the house’ databases, a system called ‘Votebuilder’, which existing customer. The personal information that politi- include voter registration data, data from commercial cal actors can upload varies from one platform to an- and public sources, as well as data from telephone poll- other, as shown in Table 1 below. ing and voter contact. Similar data sources do not exist Some of these items are sufficient as stand-alone in Europe, so there is comparatively less information attributes to create a custom audience. For instance, on available on how such parties collect data on the wider Facebook it is enough to have an e-mail address, phone electorate, beyond that of their members, donors, and number, mobile advertiser ID, Facebook app user ID, or regular contacts.21 These parties rely on the expertise of Facebook page user ID to create a custom audience, political marketers and analysts who can easily produce whereas other items such as the user’s first name or the so-called ‘enhanced voter files’ by merging their lists city require complementary personal data before such a with other databases, and double check the accuracy of custom audience can be generated.20 There is no limit on the results through targeted surveys on political the size of lists that can be uploaded to PII Audiences preferences.22 tools. As a result, in theory political actors (and adver- Once the personal data is uploaded to the social me- tisers in general) are able to introduce thousands of dia platform, the platform creates an audience of users pieces of personal data if they wish to do so. Political that correspond with an attribute. It typically takes up actors using these tools could have obtained personal to a few hours for the social media platform to create 14 See ‘How to use Facebook custom audiences’ accessed 6 August 2021. device (although it can be reset by the user). Advertisers use it to target 15 See ‘Google customer match help’ accessed 6 August 2021. 20 Ibid 3. 16 See ‘Tailored audiences’ accessed 6 August 2021. Law: Can Political Parties Campaign in Europe as they do in North 17 See ‘Account Targeting’ accessed 6 August 2021. 22 Solon Barocas, ‘The Price of Precision: Voter Microtargeting and Its 18 See ‘Stop interrupting. Start inspiring.’ accessed 6 August 2021. Conference on Information and Knowledge Management, Proceedings, PLEAD’12 - Proceedings of the 2012 ACM Workshop on Politics, Elections and Data, Co-located with CIKM 2012, 32. Cristina Blasi Casagran and Mathias Vermeulen  Political micro-targeting from a GDPR perspective ARTICLE 351 Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 Figure 1. Tracking pixel audiences’ procedure. Source: Own elaboration. the custom audience after the advertiser uploads the in environment and animals, one could assume that the personal data.23 This is performed through an algorith- user might be more inclined to vote for Green parties. mic method that matches the initial personal data with In addition, on Facebook there is an interesting feedback people who supposedly share similar interests and loop made available to advertisers (including political traits.24 Although the relationship between party data- actors) to redefine their ads as well as their audience. In bases and ad-targeting through social media differs sig- fact, social media platforms like Facebook constantly refine nificantly from country to country, investigations elements such as text, imagery, organization, and colour conducted by data protection authorities (DPAs) have when serving ads. As illustrated in Figure 1, once advertisers helped clarify the sources of personal data collected, have created unrefined and/or refined custom audiences for used and combined for PMT.25 As illustrated in the their ad, they receive a pixel code to include on their web- Table 2 below, after comparing three of the main ad site. The pixel is a small portion of Javascript code from platforms, it can be concluded that each of them offers Facebook that advertisers can install on their website, which different attributes for targeting purposes.26 collects information on whether a user actually arrives there Many of these categories do not formally reveal political from the Facebook ad. By monitoring Facebook users’ affiliations,27 but they could serve as a proxy for someone’s interactions with the website, advertisers can then use the political views, without being political data as such. This personal characteristics of these users who visited the exter- could be the case with data on social policies, education, nal website to refine their original audience, discarding national economy, homeland security, or migration- those users that are not likely to click on the advert. related issues. When combined, some of these pieces of in- Many researchers and campaigners have long raised formation can serve as extremely relevant for political par- concerns about the lack of transparency related to the ties, as they may indirectly indicate political ideology use of both categories of ad delivery tools,28 with trans- traits. For instance, by targeting people who are interested parency being a critical component in determining 23 Venkatadri and others, Privacy Risks with Facebook’s PII-based advertisers (including political actors) need to go through to launch an Targeting (n 13) 2. ad via each of these social media platforms. One of the authors followed 24 Most platforms state that they do not capture customer information the procedure to create and publish political ads for each of the three se- uploaded for custom audience creation. See ‘What Happens When I lected social media platforms (Facebook, Twitter and LinkedIn). Upload My Customer List to Facebook?’ accessed 6 August 2021; ‘Intro to data that advertisers can tick before the ad is actually launched. Custom Audiences < https://business.twitter.com/en/help/campaign- 27 ICO (n 25). setup/campaign-targeting/custom-audiences.html> accessed 6 August 28 Upturn, ‘Leveling the Platform: Real Transparency for Paid Messages on 2021; ‘Audience Targeting’ accessed 6 August 2021; and ‘How Google uses Customer ads/> accessed 6 August 2021; Mathias Vermeulen, ‘The Keys to the Match data’ Kingdom. Overcoming GDPR-concerns to Unlock Access to Platform accessed 6 August 2021. Data for Independent Researchers’ (2020) OSF Preprints accessed 6 August 2021. See also the Personal information and political influence’, 22 and ff, July 2018 letter that more than 200 Researchers Signed Supporting Knight Institute’s ‘Proposal to Allow Independent Research of Facebook’s accessed 6 August 2021. Platform’ accessed 6 August 2021. 352 ARTICLE International Data Privacy Law, 2021, Vol. 11, No. 4 Figure 2. Potential data controllers and processors in PMT. Source: Own elaboration. Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 Figure 3. Non DPbDD v. DPbDD practices. Source: Own elaboration. GDPR compliance. Likewise, the European Data is subject, (iv) the processing seeks to protect someone’s Protection Board stated in 2019 that the manner in vital interests, (v) the performance of a task carried out which personal data is processed to enable micro- in the public interest or in the exercise of official au- targeting by political actors could pose serious risks, not thority vested in the controller, and (vi) the purpose is only to individuals’ rights to privacy and data protec- of legitimate interest pursued by the controller or by a tion, but also to wider trust in the integrity of demo- third party. cratic processes themselves.29 Two main issues of concern arise when assessing the Moreover, as detailed in the following sections, PMT compliance of such principles. First, it is not always easy raises several questions related to some of the principles to determine in PMT who the data controller is. In ad- listed in Article 5 of the GDPR, namely (i) lawful proc- dition, once the data controller is identified, it is often essing, (ii) the purpose limitation principle, (iii) the unclear whether they have obtained valid consent from data minimization principle, (iv) the data accuracy users prior the processing of their personal data for principle, and (v) data accountability. PMT purposes. This is especially important because PMT performed by any other actor than political parties requires explicit consent, regardless of whether the data Is personal data lawfully processed for items used are sensitive or not. PMT purposes? Pursuant to Article 6(1) of the GDPR, personal data Who is data controller? processing is lawful only if the data controller applies To determine whether these grounds are adequately one of six legal grounds for processing: (i) the data sub- met, it is essential to first identify who the data control- ject has given consent, (ii) the processing is necessary ler is. In this regard, one of the main complexities un- for the performance of a contract, (iii) the processing derlying PMT is how it can involve many different complies with a legal obligation to which the controller actors, which could create uncertainty as to who the 29 EPDB, ‘Statement 2/2019 on the use of personal data in the course of po- tools/our-documents/statements/statement-22019-use-personal-data- litical campaigns’ (13 March 2019) accessed 6 August 2021. Cristina Blasi Casagran and Mathias Vermeulen  Political micro-targeting from a GDPR perspective ARTICLE 353 data controllers and data processors are. In particular, based on the rationale that an entity exercising influence PMT could include the participation of political adver- over the processing of personal data can be considered a tisers, political parties, political consultants, online plat- data controller, regardless of whether they have issued forms, data brokers and data analytics companies. written instructions to that effect.35 In general, two types of actors could qualify as data However, it could be possible that PMT be con- controllers of data processed during PMT: the online ducted entirely by political actors without any involve- platforms and the political actors. Yet, as illustrated in ment from online social media platforms (for instance, Figure 2 above, these two groups could be still divided by sharing an ad on their own websites). In such cases, into many different sub-categories of actors that may the political actors themselves should be considered sole use personal data in the course of political campaigns, data controllers. A debate has emerged in this regard be- such as interest groups, data brokers, analytics compa- cause the term ‘political actors’ encompasses a variety of nies, or ad networks. All these actors can play an impor- sub-categories.36 The first sub-group would include Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 tant role in the election process and their compliance core political advertisers, ie actors which exist for the should be subject to supervision by independent data sole purpose of gaining and exercising political repre- protection authorities.30 On data brokers specifically, sentation. This can include (European) political parties, the Commission has explained that they ‘may act as elected officials, candidates, parliamentary factions or controllers or processors depending on the degree of political foundations. The second sub-group would be control they have over the processing’.31 Similarly, ana- composed of peripheral political advertisers, ie actors lytics companies could be data controllers or data pro- which either (i) receive any form of compensation from cessors depending on whether they collect data on core political advertisers to spread their messages or (ii) potential voters themselves or they process data origi- speak on behalf of core political advertisers and their nally collected by political parties. interests, such as social media influencers, or indepen- Online platforms such as Facebook, Twitter, or dent organizations and corporations running political LinkedIn should be considered the only data controllers ads. if the ad is distributed via the above-mentioned A full legality assessment of PMT by all of these Attribute-based Audiences tool. Yet, the same conclu- sion does not seem to apply when the Personally actors is beyond the scope of this article. However, for Identifying Information Audiences tool is used. Online the purposes of this analysis, it is important to flag that platforms have long argued that they are mere data pro- currently the GDPR does allow political parties to pro- cessors in the use of Personally Identifying Information cess personal data on people’s political opinions ‘for Audiences tools, as it is the advertiser who initially col- reasons of public interest’ where, in the course of elec- lects and introduces personal data items into the online toral activities, the operation of the democratic system platform system. In 2018 the Bavarian Administrative in a Member State requires such processing.37 Yet, the Court had to assess whether it was only the advertiser or meaning of ‘electoral activities’ and ‘reasons of public also Facebook who processed personal data via PII interest’ is not clearly defined and the issue has not been Audiences tool. The Court concluded that both raised yet in complaints to data protection authorities. Facebook and the user of the Audience tool should be Therefore, in practice, political parties are given signifi- considered joint data controllers.32 Similarly, the Court cant leeway to process personal data, including even of Justice of the EU (CJEU)33 as well as national data special category data such as political beliefs or religion. protection authorities34 have supported this idea that Yet, that same leeway is not afforded to other political social media companies offering ‘custom’ audiences actors and to online platforms—which in practice should be considered joint controllers with the adver- would need to rely on users’ consent to process special tiser. This broad interpretation of joint controllership is category data. 30 Ibid. 34 ICO, ‘Direct Marketing Code of Practice Draft Code for Consultation’, 8 31 European Commission, ‘Answer given by Ms Jourová on behalf of the January 2020 accessed 6 August 2021.. 35 Case C25/17 Tietosuojavaltuutettu [2018] ECLI:EU:C:2018:551, para 68. 32 VG Bayreuth, Beschluss v. 08.05.2018 – B 1 S 18.105. 36 Julian Jaursch, ‘Defining Online Political Advertising. How Difficulties in 33 Case C-210/16 Wirtschaftsakademie Schleswig-Holstein [2018] Delineating Paid Political Communication Can Be Addressed’ (2020) ECLI:EU:C:2018:388. Stiftung Neue Verantwortung 19–20. 37 GDPR (n 12) recital 56. 354 ARTICLE International Data Privacy Law, 2021, Vol. 11, No. 4 The need for valid consent to process data for Furthermore, consent should not be regarded as PMT freely given if the data subject has no genuine or free choice, or is unable to refuse or withdraw.43 For the Given the lack of transparency surrounding social media purpose of this study, the possibility to withdraw a ad delivery,38 it is virtually impossible to validly obtain user’s consent from being micro-targeted on Facebook consent from data subjects for PMT. Articles 13 and 14 has been explored.44 After navigating through all of the GDPR have strict requirements on information options accessible to Facebook users, it was concluded that must be provided to data subjects, such as the pur- that Facebook only partially allows withdrawal of con- poses for collecting data, the recipients of data and the legal basis for processing. In this sense, it is particularly sent to being subject to micro-targeting, and there is no important to ensure transparency in cases of ‘invisible’ possibility to withdraw consent to being subject to processing,39 where users are not aware that a specific PMT. In particular, Facebook users have the capacity to uncheck (i) advertisers including the user in a list, (ii) Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 actor is collecting and using their personal data for a specific purpose—which is often the case with PMT. In shops interacted with through the platform, (iii) pages line with the transparency requirements described by liked, and (v) ad clicks through the platform. However, the Article 29 Working Party, a data subject should be users have no choice to opt out of being targeted via able to determine in advance what the scope and conse- specific attributes such as location, gender, age, etc. quences of the processing are, and they should not be Also, users have no possible way of preventing exposure taken by surprise at a later point by the ways in which to ads launched by political actors. their personal data has been used.40 This criterion is Lastly, since a user’s political beliefs are considered a clearly not met with the ad delivery practices described special category of data,45 PMT performed by any other in the Section ‘Ad targeting tools relevant for political actor than political parties requires explicit consent, re- micro-targeting’ above. gardless of whether the data items used are sensitive or Even obtaining general consent for non-special cate- not. In 2011, Korolova had already demonstrated that gory data is challenging for PMT purposes. Pursuant to through the Attribute-based Audiences technology on Article 7 of the GDPR, consent needs to be ‘freely given, Facebook, advertisers could correctly infer the sexual specific, informed and unambiguous’. Yet, consent in re- orientation of a non-friend even when they were sharing lation to targeting practices is generally bundled into their status in a ‘Friends Only’ visibility mode.46 Many wider terms and conditions associated with the social similar experiments conducted on Facebook have also media platform, which makes it difficult to fulfil the re- shown that the platform—through ‘likes’ and content quirement outlined above. As concluded by the CJEU in uploaded from other users—can automatically and ac- the Planet49 case, failing to collect consent via a ‘clear af- curately predict a range of highly sensitive personal firmative action’ by the users could led to a breach of the attributes such as sexual orientation, ethnicity, religious, GDPR.41 For instance, according to the court, it would gender, and political views.47 Therefore, based on these appear impossible in practice to determine objectively precedents, it could be argued that PMT should be con- whether users had actually given their consent by not sidered sensitive in and of itself: it consists of targeting deselecting a pre-ticked checkbox that is required for users who are likely to agree with the particular political continuing their primary activity on the website visited.42 ideology of a political actor. Consequently, prior explicit 38 Upturn (n 28); Vermeulen (n 28) 12–15. warns that ‘You may still see ads from advertisers for other reasons, such 39 ICO, ‘Audits of data protection compliance by UK political parties’, as your age, gender, visiting their website or shopping at their shop’. Summary Report, November 2020 accessed 6 August 2021. not to effectively withdraw micro-targeting. 40 Article 29 Working Party, ‘Guidelines on Transparency under Regulation 45 GDPR (n 12) art 9. 2016/679’ (2018) wp260rev.01. 46 Aleksandra Korolova, ‘Privacy Violations using Microtargeted Ads: A 41 C673/17 Planet49 GmbH [2019] ECLI:EU:C:2019:801, para 61. Case Study’ (2011) 3 Journal of Privacy and Confidentiality 1, 35. 42 Ibid, para 55. 47 Kurt Thomas, Chris Grier and David M Nicol, Unfriendly: Multi-party 43 GDPR (n 12) recital 42. Privacy Risks in Social Networks, PETS (Berlin, Springer 2010); Michal Kosinski, David Stillwell and Thore Graepel, ‘Private Traits and 44 The experiment was conducted on December 2020 and it was focused on Attributes are Predictable from Digital Records of Human Behavior’ the social media platform Facebook as it is the main advertising platform (2013) PNAS: Proceedings of the National Academy of Sciences of the that conducts PMT. The authors accessed the data through the option United States of America 110, 15; Neil Zhenqiang Gong and Bin Liu, ‘You ‘manage your data’ on Facebook and could find out the business that Are Who You Know and How You Behave: Attribute Inference Attacks had included them in their lists via ‘Business who uploaded and used a via Users’ Social Friends and Behaviors’ (2016) Proceedings of the 25th list’. With this information, the authors could click on each of the busi- USENIX Security Symposium. nesses and were given the chance to stop being part of the specific list linked to the business. However, in the ‘What to expect’ tab Facebook Cristina Blasi Casagran and Mathias Vermeulen  Political micro-targeting from a GDPR perspective ARTICLE 355 consent to target users should be obtained by political periodic reviews of the data held, with deletion of the actors. data items that are no longer necessary. Assessing In conclusion, it can be argued that significant whether PMT conforms with this principle is consider- changes are necessary with regards to the manner in ably complex. Micro-targeting requires the collection of which political actors and social media platforms engage large amounts of data: big data sets are first sorted by with their data protection transparency obligations in the online platform according to predictive analytics PMT. If these cannot be met and/or are not being com- and psychological targeting,50 but the exact type and plied with, the current way in which PMT is performed number of personal data items combined and aggre- could likely be considered unlawful. gated for micro-targeting purposes is usually not fully disclosed by social media platforms. The data minimization principle may be infringed Compliance with other data protection upon due to the vast amount of data categories collected Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 principles and put at the disposal of political actors (see Table 2 Apart from the aforementioned difficulty of proving above). In fact, data items used for PMT could corre- valid consent to be subjected to PMT, the practice is dif- spond to the same categories selected by very different ficult to square with a number of other data protection advertisers, such as those advertising perfumes or shoes. principles. One of the main data protection-related con- This could be used as an argument to impose additional cerns of political advertising is the potential violation of restrictions on the kinds of available data sources certain the purpose limitation principle. Particularly, Article political actors could use. However, any such restriction 5(1)(b) of the GDPR establishes that a specific and legit- may in fact conflict with Article 10 of the European imate reason is needed for any personal data collected. Convention on Human Rights (ECHR). It could be ar- Regarding the question of whether PMT processes data gued that PMT represents a form of political speech. under a legitimate purpose, the answer is not as Under Article 10 of the ECHR, such political expression straightforward. One could assume that the legitimate would enjoy a ‘privileged position’, and would thus re- purpose would be to increase ‘political or democratic ceive considerable legal protection.51 engagement’.48 As such it would enable a wide range of In addition, a proper application of the transparency political activities inside and outside election periods principle would also lead to necessary reinforcement of such as: communicating with electors and interested the accuracy principle. Users would be able to check parties; surveying and opinion gathering; and activities what data has been used to build their profiles for tar- to increase voter turnout.49 But it is unclear whether all geting by political actors, and they would also have the activities linked to PMT would fit within this definition. right to enforce the rectification principle on potential Also, it is worth adding that the collection of personal inaccurate personal data if necessary (Article 16 of the data by social media platforms and then processed for GDPR). Even in cases where the specific data item is political advertising is based on an objective different correct, the aggregation of that piece of data to a profile from the original (commercial) collection purpose, and could result in an inaccuracy. On the question of therefore this second processing should be restricted, whether inferred data could be rectified if inaccurate, unless there is informed consent from the user. Article 29 WP concluded that both the ‘input personal One of the other principles relevant to conducting data’ (the user’s personal data used by the controller to PMT is the data minimization principle. Article 5(1)(c) create the profile) and the ‘output data’ (the profile it- of the GDPR establishes that the processing of personal self created by the controller or ‘score’ assigned to the data has to be ‘adequate, relevant and limited to what is person) could be challenged by a user as in breach of necessary in relation to the purposes for which they are the data accuracy principle.52 However, social media processed’. In essence, compliance with this principle platforms could always argue that the spotted inaccu- would mean that the personal data items used to target racy is of a subjective nature,53 as the same data item voters are the minimum criteria that political actors separated from the profile would not require any rectifi- need to fulfil their purpose. It would also require cation at all. 48 Bennett (n 21) 266–67. 51 Dobber, Ó Fathaigh and Borgesius (n 3) 8. 49 See ICO, ‘Lawful databases’ accessed 6 August 2021. WP 251 rev.01, 6 February 2018, 17–18. 50 IDEA, ‘Webinar Series: Online Political Advertising and Microtargeting: 53 Sarah Eskens, ‘A Right to Reset your user Profile and more: GDPR-rights The latest legal, ethical, political and technological evolutions’, 15 and 18 for Personalized News Consumers’ (2019) 9 International Data Privacy June 2020, Meeting Report, 4. Law 3, 169. 356 ARTICLE International Data Privacy Law, 2021, Vol. 11, No. 4 Table 2. User attributes identified for micro-targeting Attributes FACEBOOK TWITTER LINKEDIN Education Financial status according to the ZIP code Interest in economy and finance Anniversaries Information on whether the person in away from home / expats Family and parenting, including age of children Relationship status Life stages (mum, dad, auto-intender, empty nester, Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 students. . .) Information related to work (employer, sector, job title. . .) Work experience (skills, years, level) Recent change of job Interest in business, industry, marketing & retail Interest in automotive topics Interest in beauty, style & fashion Interest in music & radio Interest in books and literature Interest in art & entertainment (movies & TV) Interest in specific movies or TV shows Interest in specific events Interest in politics Interest in charity Interest in community issues and volunteering Interest in environment Interest in law / government Interest in religion Interest in sustainability / home & garden Interest in careers / job search Interest in sports & sporting events Interest in specific food / drink Interest in health Interest in pets Interest in science Interest in travel Hobbies and interests (guitar, gossip, cigars, comedy, dance, paranormal stuff etc.) Veterans Consumer classification for specific non-EU countries Interest in digital activities, technology, computing, social media Engaged shoppers / people previous campaigns or ads Location Age Gender Languages Users’ connections (eg friends of people who Like a political party page Group) Specific conversation topics Device model /carrier Cristina Blasi Casagran and Mathias Vermeulen  Political micro-targeting from a GDPR perspective ARTICLE 357 Finally, PMT practices may not conform with the ac- and online apps, accessed through paying intermediar- countability principle either. As stated in Article 5(2) of ies such as digital marketing analysts and data brokers. the GDPR, controllers and processors should take re- These two options could also be combined, pairing sponsibility for their processing activities and put ap- voter profiles from political registers with social media propriate measures and records in place to demonstrate data. their compliance with data protection principles. Yet to- It is worth adding that profiling can be applied to a day the information and scope of PMT is still unknown: group or to an individual, and it can be direct or indi- there is not sufficient knowledge about the amount and rect.60 For political advertising, individual and direct types of data that are used for targeting, and there is no profiling usually takes place when data is collected via public accountability or scrutiny mechanisms regarding membership registries or when users subscribe to any of the algorithms created by social media platforms to de- the political party’s products. An example can be found liver ads either.54 There is thus an accountability gap in the data collected by Brexit campaigners in 2016 Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 created by the use of massive amounts of personal data through the app thisisyourdigitallife. This data was sub- in non-transparent ways, as well as via the provision of sequently used to profile and build political audience countless ads targeted at various audiences to impact characteristics. In this case, hundreds of thousands of people’s political choices.55 users were paid to take personality tests and agreed to have their data collected for academic use.61 Profiling concerns In contrast, if ads from political actors are delivered through social media platforms, in principle only group While people’s interactions with online social media profiles are targeted, either directly or indirectly. services serve as inputs for the construction of personal Through the above-mentioned Attribute-based profiles,56 PMT is a way to successfully create user pro- Audiences tool, advertisers do not introduce any spe- files for ad delivery by political actors. Thus, in addition to the rules on lawful bases for processing, PMT may in- cific personal information for the target group, but volve automated decision-making (profiling) related to rather only attributes. For instance, advertisers could a person’s vote in an election. choose for their ads to be displayed for all 35-year-old According to the GDPR, ‘profiling’ consists of any females living in Paris and interested in environmental form of automated processing of personal data evaluat- matters. Through its machine-learning algorithms— ing personal aspects relating to a natural person.57 This trained to detect relevant patterns—the social media could include information on the subject’s performance platform would likely target thousands of profiles with at work, economic situation, health, personal preferen- the selected criteria. The advertiser would never know ces, and interests and behaviour, as well as location or (in principle) the identity behind those targeted users. movements. The platform would only inform the advertiser about Under the GDPR, data profiling is not forbidden, but the number of matched records (ie the audience size). it is subject to certain restrictions.58 Such profiling prac- Likewise, if advertisers decide to use the PII Audiences tices need to be transparent and easily accessible, as the tool instead, they would introduce one external piece of data subject whose data is profiled has the right to op- personal information, through which the platform pose them at any time.59 Yet, PMT demonstrates that would then link to its own data, targeting group profiles this is not always the case. with characteristics similar to the original piece of As outlined above, political actors that are interested information. in targeting voters online via social media have two Although these two Facebook tools are designed to main sources of data: (i) profiles already created in their provide only group profiles, previous studies have dem- own registers or (ii) profiles created by social networks onstrated that it is possible to achieve individual 54 Muhammad Ali and others, ‘Ad Delivery Algorithms: The Hidden 60 Profiling is treated as ‘individual’ when personalised information about a Arbiters of Political Messaging’ (2019) Cornell University, 13. single individual is aggregated, whereas the group profile will never ana- 55 IDEA (n 50) 2. lyse particular individuals but groups of persons with a common interest. 56 Taina Bucher, ‘(Big) Data and Algorithms’ in Leah A Lievrouw and Brian In the same way, direct profiling takes place when data collected from a D Loader (eds), Routledge Handbook of Digital Media and user is used to create a profile of that same subject; while indirect profiles Communication (London, Routledge 2020) 93. will use data from several users to create a profile linked to a particular subject. 57 GDPR (n 12) recital 7. 61 Carole Cadwalladr Carole and Emma Graham-Harrison, ‘Revealed: 50 58 EDPB (n 29). million Facebook Profiles Harvested for Cambridge Analytica in Major 59 Pursuant to art 22 GDPR any ‘data subject shall have the right not to be Data Breach’ The Guardian, 17 March 2018 accessed 6 August 2021. 358 ARTICLE International Data Privacy Law, 2021, Vol. 11, No. 4 profiling on Facebook by specifying a combination of Ten years ago, users did not have DPbDD options in criteria that match only one individual. In such a case, their main social media platforms. Several studies dur- an ad campaign could single a person out and learn ad- ing that period revealed that multiple pieces of users’ ditional information about this person.62 For instance, personal information—such as name, city, zip code, as for the Attribute-based Audiences tool, Korolova email address, phone numbers, gender, birthday, age, conducted an attack that allowed for targeting one sin- employer, friends, activities, and interests—were either gle person by introducing a set of attributes that always available or available by default on most of the uniquely (or almost uniquely) identified the user among online social media sites.67 all Facebook users.63 In the same way, for the PII Today, social media privacy settings still do not di- Audiences tool, a user could be targeted individually on rectly let a user view or control which personal data is Facebook due to the very low threshold that the plat- used for advertising.68 In the case of Facebook, concerns form has for the Custom Audience size.64 Facebook’s have recently been raised regarding compliance with the Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 threshold was easily surpassed by including users who DPbDD principles: a previous experiment has shown were known to use AdBlock or were not active on that even the information that an individual has shared Facebook in the Custom Audience specification.65 on Facebook via the ‘Friends Only’/’Only Me’ designa- Another way to achieve individual profiling on tion can be obtained by anyone,69 violating the princi- Facebook is by customizing the location and targeting a ples of DPbDD. Another study proved that users’ phone numbers could be disclosed to advertisers without the very small location (which could be as specific as a sin- user being aware of it,70 using the Custom Audience gle house). Although the location targeting feature tool and de-anonymizing all the visitors that accessed a enforces a minimum 1-mile radius, a study showed that particular website.71 Therefore, these events could not it was possible to combine 1-mile radius circles of what only infringe upon the DPbDD principles, but also should be included and excluded from the targeting, en- would breach the purpose limitation principle and the abling one to target a single household.66 adequacy of security measures in place.72 These profiling practices could be considered exces- Options for opting out of PMT are not available on sive and thus contrary to the GDPR if there are no any of the main social media platforms, either. mechanisms in place for users to opt out or object to Similarly, users cannot opt out from receiving ads from the processing used to create these individual profiles. political actors on social media. As seen in Figure 3 Moreover, profiling should never be based on special above, for PMT social media platforms automatically categories of data without explicit consent. cluster users sharing common characteristics and di- rectly target them with personalised political messages. Limited data protection by design and Therefore, more nuanced user-facing controls re- garding political actors’ advertising should be intro- by default duced,73 allowing users to make the final decision as to According to Article 25 of the GDPR, personal data whether they wish to be micro-targeted for political should not be made accessible to the controller without purposes or not. In fact, such measures could be fore- the individual’s intervention. In other words, users seen in advance in a Data Protection Impact Assessment should be able to decide on each platform what infor- (DPIA). According to Article 35 GDPR, DPIAs are re- mation they wish to make accessible to the data control- quired when there is automated processing of data, ler and what not. This is pursuant to the Data processing on a large scale of special categories of data, Protection by Design and by Default (hereinafter, and systematic monitoring of data. All of these criteria ‘DPbDD’) principles. could take place in PMT activities, so detailing the risks 62 Korolova (n 46); Irfan Faizullabhoy and Aleksandra Korolova, 67 Balachander Krishnamurthy and Craig E Wills, ‘On the Leakage of ‘Facebook’s Advertising Platform: New Attack Vectors and the Need for Personally Identifiable Information via Online Social Networks’ (2009) Interventions’ (2018) Computing Research Repository, Workshop on ACM SIGCOMM WOSN, 2009; Balachander Krishnamurthy, Konstantin Technology and Consumer Protection (ConPro), 4. Naryshkin and Craig E Wills, ‘Privacy Leakage vs. Protection Measures: 63 Korolova (n 46). The Growing Disconnect’ (2011), IEEE W2SP. 64 The threshold established by Facebook and Instagram is 20 users; 68 Venkatadri (n 12) 229. whereas Google is 1000 users, Twitter is 500 users, and LinkedIn and 69 Faizullabhoy and Korolova (n 62) 3. Pinterest is 500 users, respectively. See Facebook Marketing API: Custom 70 Venkatadri, ‘Investigating Sources of PII’ (n 12). Audience. accessed 6 August 2021. 72 See the section ‘Compliance with other data protection principles’ of the 65 Faizullabhoy and Korolova (n 62) 3. present study. 66 Ibid. 73 Ali and others (n 54) 14. Cristina Blasi Casagran and Mathias Vermeulen  Political micro-targeting from a GDPR perspective ARTICLE 359 of PMT in a DPIA before any political campaign seems GDPR provisions referring to profiling and DPbDD, to be an adequate standard to put in place. unless users are provided with new options to control their data. Overall, this study has found that, currently, Conclusions users are unable to exercise control over their data being used for PMT. Today an immense amount of data is processed and Therefore, in order to comply with the GDPR frame- analysed to craft tailored political messages to individ- work, new privacy techniques and tools need to be ual potential voters. Political actors rely on the large- scale collection and processing of personal data that is implemented by the ad platform so that PMT is done in conducted by social media platforms and offered to a balanced and sensitive way, and in a manner that leads advertisers for micro-targeting. to outcomes that benefit everyone in the democratic This article has examined the main GDPR provisions ecosystem—users, ad platform designers, and political Downloaded from https://academic.oup.com/idpl/article/11/4/348/6355314 by guest on 29 March 2023 that are relevant to micro-targeting, especially when this advertisers. Further restrictions on PMT must indeed be technique is used by political actors in order to target considered in light of the potential privileged position potential voters. Political micro-targeting (PMT) may of PMT as a form of political communication under result in the violation of many individual rights con- Article 10 ECHR, which covers politicians, political par- nected to data protection if GDPR rules are not prop- ties and platforms as well as users’ right to receive infor- erly applied. In particular, this study has first concluded mation. As a result, propositions such as outright bans that PMT could result in a breach of the principle of on PMT might be considered as inconsistent with free- lawfulness if data controllers responsible for data proc- essing are not adequately identified, and if users are not dom of expression in future case law. Moreover, at the provided with proper ways to grant prior consent. In EU level, platforms should be required to meet further addition, other data protection principles such as pur- transparency requirements in order to promote clarity pose limitation, data minimization and data accuracy with respect to PMT’s scope and data use. have been critiqued, and found to be potentially unlaw- ful in the case of PMT due to the current lack of mecha- doi:10.1093/idpl/ipab018 nisms to supervise compliance with such rules. Finally, Advance Access Publication 20 August 2021 this study has evidenced how PMT could violate the