The JENTIS Legal Digest - 4th ed.

Written by Tomislav Rachev LL.M.

Welcome to the JENTIS Legal Digest, your bi-weekly news update

on all things data privacy around the world

In this edition?

Times of change for Big Tech's privacy policies?

• What Google's new policy on TCF means for publishers
• The GPDR fines' effect - both Microsoft and?Meta?with privacy changes
• Zoom introduces option for?data localization?
• Breaking up Google's?ad services?may be the only remedy in antitrust?EU Commission warns

Data privacy around the globe: EU, US, Nigeria

Times of change for Big Tech's privacy policies

The perfect storm? IAB launches a new TCF standard and Google changes?new policy for serving ads?

Recently, Google announced it will only serve personalized ads on publishers who rely on CMPs running on the?latest version 2.2.?of the?Transparency Consent Framework (TCF), introduced by IAB last month.?

Google is expected to?release a list of approved CMPs and start enforcing this policy later on this year.?Google will serve only non-personalized ads?if publishers do not use CMPs, which are?up-to-date with the new standard or if?users do not?provide consent.

TCF 2.2 unveiled:

The updates to the TCF 2.2 include improvements in providing information to end-users, standardization of additional information about vendors' data processing operations, transparency regarding the number of vendors seeking a legal basis, and specific requirements to facilitate users' withdrawal of consent. Most notably, however, Version 2.2. removes the option to use legitimate interest as legal basis for the purpose of advertising and content personalisation.?

In the following months, CMPs will have to implement the new TCF standard and get approved by Google.?

Key insights:

• Industry standards evolve following guidelines and case-law of supervisory authorities and could be facilitated by big industry factors such as Google.?
• The new standard will likely decrease consent rates and negatively affect ad income of publishers.?
• The volume of personal data available for ad targeting and measurement will likely decrease, as companies can no longer rely on legitimate interest as a basis for data collection within the TCF framework.?
• These developments create a need for?alternative solutions such as marketing and analytics, not relying on exact user profiles, but rather on interest-based segments and context-based advertising.?

Read more ?

The GDPR fines' effect - both Microsoft and Meta with privacy changes

After getting fined 60M euros?over Bing cookies in France Microsoft followed the authority's instructions and changed its cookie policy, including tracking configuration and cookie banner design.?As a result, dark patterns are gone and users can now give or reject their?consent to cookies, used for combatting advertising fraud.?Read more??

Following German antitrust intervention and a hefty GDPR fine, Meta has announced plans to introduce a new accounts center enabling users to refuse?cross-site tracking.?Read more??

Key insights:

• Slowly, but steadily,?Big Tech giants appear to concede to certain demands of data protection authorities, showing a correlation between increasing fine amounts and effectiveness of GDPR enforcement.

Data localisation in the EU gains traction with Zoom the latest to introduce changes?

Video communications platform Zoom recently announced new privacy measures in response to increased scrutiny and a record fine imposed on social media giant Meta. Zoom will allow paying customers in Europe to?keep their data within the European Economic Area (EEA) and pledges to share it?with US teams only in "exceptional cases such as?with Zoom’s Trust & Safety team".?Read more??

Key insights:

• Looking back to late 2022, AWS pledged to give users control over the data location in its "sovereignty pledge" and Microsoft announced the rollout of its multi-year plan?EU Data Boundary.?
• This trend?shows the effort of US companies to avoid the?legal uncertainty and turmoil surrounding transatlantic data transfers by keeping Europeans' data in Europe.

Data privacy?around the globe

• Sweden: 5M fine against Spotify due to failure to respond to data access requests
• US: Warrantless mass surveillance to continue?despite bi-partisan voices for reform?
• US: Nevada latest state?to pass a health data protection bill
• Nigeria: New GDPR-inspired Data Protection Bill signed into law?