Improving Privacy Protection in the area of Behavioural Targeting

TL;DR

This thesis explores how European law can better protect privacy in behavioural targeting by combining legal analysis with insights from behavioral economics and computer science, highlighting the limitations of consent-based approaches.

Contribution

It offers a novel legal perspective on enhancing privacy protection by integrating multidisciplinary insights and advocating for a focus on individual protection over empowerment.

Findings

Consent requirements are often ineffective due to behavioral biases.

Current laws may not sufficiently protect privacy in behavioural targeting.

A combined approach of protection and empowerment is recommended.

Abstract

This PhD thesis discusses how European law could improve privacy protection in the area of behavioural targeting. Behavioural targeting, also referred to as online profiling, involves monitoring people's online behaviour, and using the collected information to show people individually targeted advertisements. To protect privacy in the area of behavioural targeting, the EU lawmaker mainly relies on the consent requirement for the use of tracking technologies in the e-Privacy Directive, and on general data protection law. With informed consent requirements, the law aims to empower people to make choices in their best interests. But behavioural studies cast doubt on the effectiveness of the empowerment approach as a privacy protection measure. Many people click "I agree" to any statement that is presented to them. Therefore, to mitigate privacy problems such as chilling effects, this study argues for a combined approach of protecting and empowering the individual. Compared to the current approach, the lawmaker should focus more on protecting people. The PhD thesis is a legal study, but it also incorporates insights from other disciplines, such as computer science, behavioural economics, and media studies. This study is among the first to discuss the implications of behavioural research for European data protection policy. The topic of whether data protection law should apply to pseudonymous data is discussed in depth. The study contains a detailed analysis of the role of informed consent in data protection law, and gives much attention to the tension between protecting and empowering the individual within data protection law.