Datum: 26.09.2019
Ort: Luxemburg
A Study on Subject Data Access in Online Advertising after the GDPR
Online tracking has mostly been studied by passively measuring the presence of tracking services on websites (i) without knowing what data these services collect, (ii) the reasons for which specific purposes it is collected, (iii) or if the used practices are disclosed in privacy policies.
The European General Data Protection Regulation (GDPR) came into effect on May 25, 2018 and introduced new rights for users to access data collected about them.
In this paper, we evaluate how companies respond to subject access requests and portability to learn more about the data collected by tracking services. More specifically, we exercised our right to access with 38 companies that had tracked us online.
We observe stark differences between the way requests are handled and what data is disclosed: Only 21 out of 38 companies we inquired (55%) disclosed information within the required time and only 13 (34%) companies were able to send us a copy of the data in time. Our work has implications regarding the implementation of privacy law as well as what online tracking companies should do to be more compliant with the new regulation.
