Singling Out People Without Knowing Their Names – Behavioural Targeting, Pseudonymous Data, and the New Data Protection Regulation

40 Pages Posted: 18 Feb 2016

Date Written: February 16, 2016

Abstract

Information about millions of people is collected for behavioural targeting, a type of marketing that involves tracking people’s online behaviour for targeted advertising. It is hotly debated whether data protection law applies to behavioural targeting. Many behavioural targeting companies say that, as long as they do not tie names to data they hold about individuals, they do not process any personal data, and that, therefore, data protection law does not apply to them. European Data Protection Authorities, however, take the view that a company processes personal data if it uses data to single out a person, even if it cannot tie a name to these data. This paper argues that data protection law should indeed apply to behavioural targeting. Companies can often tie a name to nameless data about individuals. Furthermore, behavioural targeting relies on collecting information about individuals, singling out individuals, and targeting ads to individuals. Many privacy risks remain, regardless of whether companies tie a name to the information they hold about a person. A name is merely one of the identifiers that can be tied to data about a person, and it is not even the most practical identifier for behavioural targeting. Seeing data used to single out a person as personal data fits the rationale for data protection law: protecting fairness and privacy.

Keywords: Pseudonymous data, data protection law, personal data, privacy, online behavioral advertising, behavioral targeting, profiling, cookie, IP address, tracking

JEL Classification: K12, K00, D10, D11, D20, D30, D40, D60, D70, L00, L11, L20, L51

Suggested Citation

Zuiderveen Borgesius, Frederik, Singling Out People Without Knowing Their Names – Behavioural Targeting, Pseudonymous Data, and the New Data Protection Regulation (February 16, 2016). Available at SSRN: https://ssrn.com/abstract=2733115 or http://dx.doi.org/10.2139/ssrn.2733115

Frederik Zuiderveen Borgesius (Contact Author)

iHub, Radboud University, Nijmegen ( email )

Nijmegen
Netherlands

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Downloads
1,970
Abstract Views
10,641
Rank
17,344
PlumX Metrics