An adtech vendor builds cross-site behavioural profiles of EU users by dropping trackers that follow browsing across unrelated publishers. Which compliance theme should the privacy lead prioritise?
Select an answer to reveal the explanation.
Short Explanation
Following someone from news site to shop is still following a person. Cross-site behavioural ads are not a free pass under 'legitimate interests forever.' Transparency plus a real consent story is usually the safer European reading—and EDPB targeting guidance backs that seriousness.
Full Explanation
An adtech vendor building cross-site behavioural profiles of EU users by dropping trackers that follow browsing across unrelated publishers should prioritise that online behavioural targeting typically requires clear transparency and a valid basis—often consent—consistent with ePrivacy storage/access rules and EDPB guidance on targeting. Following someone from news site to shop is still following a person. Claiming cross-site tracking is exempt because advertising is always a legitimate interest fails both ePrivacy consent expectations and EDPB scepticism toward LI for intrusive tracking. Saying publisher first-party analytics cookies automatically legitimise third-party behavioural ad profiles fails by conflating distinct purposes and actors. Asserting pseudonymous ad IDs erase all transparency and consent duties fails—pseudonymisation is not anonymity. Exam caveat: terminal-equipment access for non-essential trackers generally needs prior consent; GDPR transparency and purpose limitation still apply to the profiling layer. Operational check: obtain prior consent before dropping cross-site trackers, disclose purposes and recipients intelligibly, honour refusals equally, minimise identifiers shared in bids, and map roles across publishers and vendors.