Re-Identification-Based Advertising

The digital advertising industry relies on extensive behavioural profiling, a practice that the EU General Data Protection Regulation (“GDPR”) sought to constrain in order to protect privacy. This paper examines how digital advertising companies have responded to GDPR by deploying two main strategies: purporting to obtain user consent, or claiming that data are anonymized and therefore outside the GDPR’s scope. However, routine re-identification of pseudonymized data challenges makes the l