16

The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want to get into the specifics of the case. There is one argument in particular that refers to the ePrivacy Directive’s “Cookie Law” exceptions that raises a question for me:

ePrivacy Directive’s “Cookie Law” exceptions text

Number two explicitly states that the law does not apply when the storing of data is “strictly necessary” in order for the provider to provide the service.

Here in the real world of non-taxpayer funded entities, one typically counts the existential financial viability of a newspaper among its necessities. If without advertising revenue the “service” itself would cease to exist, then the defense of vital and life-sustaining revenue streams are clearly “necessary” to provide the service. So even if anti-adblock defenses did “store” and “access” locally stored information (which they do not), it would appear that the ePrivacy Directive would protect the right to store and access data when said actions are “necessary” to provide the service.

Is there any merit in this sort of argument? Does "data processing X is required for my business model" a valid argument that "data processing X is 'strictly necessary' in terms of EU data protection law"? It seems to me that it is always possible to construct a business model that requires any specified level of data processing. If the mere existence of such a business model makes the data collection legal then there is no protection at all.

6
  • 21
    "This rule prevents me from making money therefore it shouldn't apply to me" is an... interesting... position to take. Commented Nov 2, 2023 at 11:49
  • 3
    This is "felony contempt of business model" but unironically spelled out in a legal argument.
    – Kafein
    Commented Nov 2, 2023 at 13:24
  • 1
    The Block AdBlock website seems to be down. I wonder if it is in response to this question which basically calls them out on illegal activity.
    – noslenkwah
    Commented Nov 2, 2023 at 22:51
  • Not a legal expert but it seems to me that you're glossing over the definition of "the subscriber or user" in this context. You seem to ask your question under the assumption that the company is the "subscriber or user". The breach happens between the tool and the end-user (who may or may not be using an adblocker), but it happens at the behest of the company that would profit off of these ads (if they weren't blocked). The end-user did not request for BlockAdBlocker to check if they're using an adblocker, a third party did (i.e. the company that profits from the ads).
    – Flater
    Commented Nov 3, 2023 at 5:13
  • 4
    [..] To simplify my point, Bob the Plumber isn't allowed to enter my house based on Kevin the Kingpin's claim that this is essential to his revenue model. The law only allows for Bob the Plumber to enter my house when I knowingly engage Bob's services and these services inherently require access to my house.
    – Flater
    Commented Nov 3, 2023 at 5:16

2 Answers 2

23

"Article 5.3" here means the following from the ePrivacy Directive, 2002/58/EC, as amended amended by Directive 2009/136/EC.

Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

So we are talking here about whether local storage and access by anti-adblock technology is "strictly necessary" in order to provide the website experience.

In the context of cookies, there is authoritative guidance in an opinion, 00879/12/EN WP 194, of the "Data Protection Working Party". This is not binding as law, but national authorities responsible for administering the Directive are meant to follow the guidance. (The DPWP was given authority in this arena by Article 15(3) of the 2002 Directive. It has since been replaced by the European Data Protection Board, but the role here is the same.) According to that opinion, "strictly necessary" has a restricted meaning: it is about the technical functionality of the website, not the business model behind it. For cookies, the tests corresponding to the clause in 5(3) above are:

  1. The information society service has been explicitly requested by the user: the user (or subscriber) did a positive action to request a service with a clearly defined perimeter.
  2. The cookie is strictly needed to enable the information society service: if cookies are disabled, the service will not work.

In this vein, third-party advertising cookies are likely to fail the test, but other kinds of cookies used to remember user preferences or device video capabilities may be OK. (This is described in more detail in the document.) The extensive reasoning demonstrates that the business model of the website provider is not at issue for this clause: it it was, then all sorts of things would be exempted, just because a business is making money from them. The same reading of this phrase should carry across to other kinds of local storage or access within the scope of Article 5(3).

The other thing going on here is that anti-adblock technology, whether it involves access to local storage or not, is effectively functioning by forcing the service not to work, when it otherwise would. Does this render a cookie "strictly necessary"? This is the same territory as so-called "cookie walls". National authorities have differed in their approach and it is not possible to say definitively whether an anti-adblock wall is permissible. There is slow movement towards a new EU law, an "ePrivacy Regulation", which would cover this topic - but that has yet to happen at the time of writing.

2
  • 2
    The EDPB continued the WP29 work by publishing guidelines on Art 6(1)(b) GDPR. This is not directly about ePrivacy, but provides an in-depth explanation about the European concensus on the "necessity" concept. These arguments were also used in the decision against Facebook's/Meta's "consent bypass" where ad personalization was claimed to be strictly necessary per the ToS (see NOYB coverage).
    – amon
    Commented Nov 2, 2023 at 8:10
  • I'd say it's also not an information society service, even though it's requested by the user.
    – Sam_Butler
    Commented Nov 21, 2023 at 10:52
18

No.

when storing/accessing is strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service

(Sometimes known as 'CRITERION B', by the way.)

Meaning:

  1. the subscriber or user did some positive action to request a service;

  2. the storing/accessing is necessary to provide the service, either for legal compliance or because if cookies are disabled then the service will not work.

The UK's Information Commissioner's Office says of this:

It is important to remember that what is ‘strictly necessary’ should be assessed from the point of view of the user or subscriber, not your own [the service provider]. So, for example whilst you might regard advertising cookies as ‘strictly necessary’ because they bring in revenue that funds your service, they are not ‘strictly necessary’ from the user or subscriber’s perspective.

The advertising cookies are not related to a service or functionality explicitly requested by the subscriber or user, therefore they are not exempt under that criterion. They require consent from the subscriber or user.

2
  • 4
    It would be interesting to try to conceive of a website that could not function and could not be made to function without tracking and advertisements. I just don't see how that would even be possible without it being something like "tellmewhatishouldbuynext.com"- but at that point, the end user is basically asking for ads and tracking rather than it being shoved in their face by some hostile website design.
    – Beefster
    Commented Nov 2, 2023 at 17:22
  • 2
    @Beefster indeed! "showmehowanalyticstracksmyuseofthiswebsite.com"
    – Lag
    Commented Nov 3, 2023 at 8:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .