The regulator has been investigating how personal data is used when online ads are bought and placed on websites, specifically whether the process complies with the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations (PECR).

Under data protection law, people must give their explicit consent to have their data used to serve them with ads, but the ICO ruled that this is not currently happening.

Simon McDougall, executive director for technology and innovation at the ICO, said: “Sharing people’s data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties, raises questions around the security and retention of this data.”

Current practices for processing personal data – particularly the processing of special category data without explicit consent – are ‘problematic’, the ICO said.

It also expressed concerns about the complexity of the data supply chain, saying that relying on contractual agreements to protect data is not enough.

The watchdog has warned that it expects the industry to change its approach to privacy notices, use of personal data, and the lawful bases applied within RTB.

McDougall said: “We want to see change in how things are done. If you operate in the adtech space, it’s time to look at what you’re doing now, and to assess how you use personal data. We already have existing, comprehensive guidance in this area, which applies to RTB and adtech in the same way it does to other types of processing – particularly in respect of consent, data protection by design and data protection impact assessments (DPIAs).”

The ICO will work with the industry over the next six months and may conduct another review later in the year if its demands are not met.