Europeans users' data shared with advertisers 376 times per day
Real-time bidding is the 'biggest data breach ever recorded,' says ICCL
Data about an average European internet user, including their geolocation and what they are reading online, is shared with advertisers and data broking firms 376 times per day, according to the latest report by the Irish Council of Civil Liberties (ICCL).
The figure jumps to 747 times per day for users in the United States.
According to the ICCL report [pdf], the real-time bidding (RTB), the online ad-targeting industry that analyses internet users' personal information, transmits information to third-party firms around 178 trillion times every year in the United States and Europe alone.
The online behaviour and whereabouts of US internet users are tracked and shared 107 trillion times a year, whereas the data of Europeans is shared 71 trillion times per year.
"RTB is the biggest data breach ever recorded," says the ICCL.
"It tracks and shares what people view online and their real-world location 294 billion times in the US and 197 billion times in Europe every day."
According to the report, the figures reported for RTB broadcasts are a low estimate.
"Real-time bidding (RTB) is a $117+ billion industry that operates behind the scenes on websites and apps. It tracks what you are looking at, no matter how private or sensitive, and it records where you go," ICCL states.
According to the ICCL report, Google and Microsoft are the world's biggest RTB firms. Index Exchange, PubMatic and Magnite are other significant players.
The figures in the ICCL report do not include numbers from two advertising behemoths, Meta and Amazon. The data came from a Google feed over a 30-day period. That data is made available to the industry, but not the general population.
Google, the largest player in the RTB ecosystem, allows 4,698 firms to receive RTB data about the US-based users, while Microsoft says it may send similar data to 1,647 firms.
Per the report, Google transmits 19.6 million broadcasts about the online behaviour of German internet users every minute they are online.
Private data of European and American internet users is sent to companies all around the world, including China and Russia, with no way of knowing what happens to it in those countries.
For years, privacy campaigners have raised concerns about RTB, particularly in Europe, where rules are in place to prevent such a systematic abuse of people's data.
Dr Johnny Ryan, an ICCL senior fellow, is currently fighting the Data Protection Commission of Ireland (DPC) in the High Court, accusing the regulator of years of inactivity on RTB complaints.
In his complaint, Ryan expressed concern that the RTB systems of Google and IAB Europe (the digital advertising industry body) involve unauthorised and potentially unrestricted sharing and processing of personal data.
In numerous cases, he believes that Google and IAB have violated the EU GDPR.
ICCL has also complained to the EU Ombudsman about the European Commission's failure to adequately oversee implementation of the legislation, prompting the EU Ombudsman to initiate an investigation into the Commission's claims to the contrary early this year.