Privacy Advocate Challenges YouTube's Ad Block Detection Code, Filing Complaint with Irish Data Protection Commission
Introduction:
Privacy advocate Alexander Hanff has taken a stand against YouTube’s use of JavaScript code to detect ad blocking extensions in the web browsers of website visitors. Hanff argues that this practice goes against Europe’s ePrivacy Directive, as it is not technically necessary and requires user consent. If the Irish Data Protection Commission (DPC) agrees with Hanff’s complaint, it could set a significant precedent for safeguarding user privacy.
Challenging YouTube’s Use of Unnecessary Detection Script:
Hanff filed a complaint with the Irish DPC, expressing concerns about YouTube’s use of JavaScript code to identify ad-blocking extensions. According to Hanff, under Europe’s General Data Protection Regulation (GDPR), YouTube should obtain user consent before running the detection script as it is not technically necessary.
Potential Enforcement Measures:
Hanff expects the DPC to investigate the matter and issue an enforcement notice to YouTube, compelling them to cease and desist these activities unless they obtain consent in accordance with the GDPR. Additionally, Hanff suggests that YouTube should reverse any account bans resulting from using these detection scripts and delete any unlawfully processed personal data.
Legal Terminology and Lex Specialis:
Acknowledging the difficulty of labeling YouTube’s ad block detection code as “spyware,” Hanff uses strikethrough formatting to emphasize that it falls under the category of potentially unwanted programs (PUPs) in the security industry’s defamation defense terminology. Hanff highlights that the ePrivacy Directive takes precedence over the GDPR where laws overlap, emphasizing that personal data collected without consent is unlawful under Article 5(1) of the GDPR and cannot be processed legally.
Voiding Terms and Conditions Contrary to Privacy Rights:
YouTube argues that using an ad blocker violates its Terms of Service, but Hanff asserts that any terms and conditions that restrict the legal rights and freedoms of EU citizens are void under EU law. Article 5(3) of the ePrivacy Directive is specifically designed to protect the fundamental right to privacy under Article 7 of the Charter of Fundamental Rights of the European Union. Consequently, any terms that limit EU individuals’ ability to control access to their own devices would be unenforceable.
Conclusion:
Alexander Hanff’s complaint against YouTube’s ad block detection code represents a significant challenge to the company’s practices. If the Irish DPC rules in favor of Hanff, it could have far-reaching implications for user privacy rights. This case serves as a reminder of the ongoing battle between privacy advocates and technology companies over the control and protection of personal data. The outcome will undoubtedly shape the future of online advertising and the obligations of platforms like YouTube to obtain user consent before deploying tracking scripts.
