Five Years of Illegitimacy of Surveillance Advertising

Surveillance advertising is one of the central business models in the digital markets, responsible for the emergence of digital platform providers, such as Alphabet and Meta, into technology giants. As it involves processing large amounts of personal data, it comes in direct tension with the right to personal data protection in the European Union. The surveillance advertising business model was one of the challenges that triggered data protection reform, resulting in the General Data Protection Regulation (GDPR). Within the first five years of the GDPR, a large part of the surveillance advertising industry proved illegitimate. For example, litigation of Meta’s surveillance advertising has found that in 2018-2023, the company engaged in surveillance advertising without appropriate legal basis under the GDPR. The same goes for surveillance advertising conducted in the open market, often called AdTech. In order to respond to the developing case law of the GDPR, the industry has now moved to a ‘Surveillance-or-Pay’ business model. This chapter finds such a model illegitimate in many cases, particularly for gatekeepers such as Meta. This conclusion also calls for urgent enforcement from the national data protection authorities and the European Data Protection Board to ensure the surveillance advertising industry does not continue illegitimately over the next five years of the GDPR.