Germany de.indymedia
EU study: European tech regulation is failing when it comes to online advertising
The billion-dollar online advertising market not only harms consumers, but also advertisers and publishers. European digital laws do not get the problems under control. That shows
Deutsch (original) ·Auto-translated to English
The billion-dollar online advertising market not only harms consumers, but also advertisers and publishers. European digital laws do not get the problems under control. This is shown by an extensive study commissioned by the EU Commission.
Online advertising is a huge business: advertisers are said to have spent almost 800 billion euros on it last year, of which 63 billion euros were in the EU. Europe is the third largest online advertising market in the world after the USA and China, and the trend is rising. However, a market that is pretty broken and that even the EU's extensive tech regulation cannot get under controlhttps://op.europa.eu/en/publication-detail/-/publication/d466f207-d7fd-1...Study commissioned by the EU Commissionexplained.
The 570-page study by the consulting firm AWO is probably one of the most comprehensive analyzes of the advertising industry ever. It paints a detailed picture of an industry that is characterized by extreme complexity and opacity, in which many processes are already automated and in which artificial intelligence could further exacerbate existing problems.
According to the study, it is an industry that, according to the study, is dominated by a few central players, above all Google and Meta. They generate hundreds of billions of dollars in advertising every year because, on the one hand, they operate closed ecosystems in which they collect extensive data about billions of people and can show them advertising, and, on the other hand, because they also operate important infrastructure for online advertising on the open network. There, in turn, thousands of different companies are involved in the ecosystem that hardly anyone knows about - from auction platforms for advertising space to data traders.
The study does not stop at describing this industry, but also traces numerous problems associated with how it operates today. Initiatives that have been set out to solve these problems are also examined in detail - from technical standards to industry proposals to EU tech regulation.
The bitter conclusion is that nothing has really worked so far, which is why the authors are submitting numerous proposals for new measures to the EU Commission. The moment could be right: Tomorrow, Wednesday, the Commission wants to present its proposal for a Digital Fairness Act, with which it wants to close gaps in digital consumer rights. One that recently became publichttps://euobserver.com/248072/digital-fairness-act-eu-cracks-down-on-ste...of the designHowever, this suggests that not a single suggestion from the mega-study will be implemented.
A long list of problems
The investigation is based on numerous studies from science and industry as well as our own surveys and interviews with industry representatives and experts.
The list of problems presented by online advertising alone is so long that addressing them could easily go beyond the scope of this article. It covers, among other things, “issues of data protection and privacy, exploitative practices to the detriment of vulnerable people, the dissemination of content associated with systemic risks, risks to media pluralism and competition, and issues of fairness.”
According to the authors, most of these problematic effects “are caused by the market’s dependence on personal data.” Much has been written in recent years about the potential for manipulation inherent in comprehensively recording and analyzing human behavior for online advertising. On netzpolitik.org we reported on, among other thingshttps://netzpolitik.org/2023/microsofts-datenmarktplatz-xandr-das-sind-6...detailed categories, into which the advertising industry sorts people. The study addresses, among other things, the dangers for adolescents and addicts as well as political manipulation.
It has also become increasingly clear in recent years that commercial surveillance for advertising targeting also represents a security problem because data supposedly collected only for advertising purposes ends up on a large scale with data traders. The study also mentions one in this contexthttps://netzpolitik.org/2025/databroker-files-targeting-the-eu/">2025published researchfrom netzpolitik.org and Bayerischer Rundfunk with the Belgian newspaper L’Echo as part of thehttps://netzpolitik.org/databroker-files/">DatabrokerFiles, which showed that such data could also be used to spy on high-ranking EU personnel.
A market that almost only knows losers
What is interesting is that, in addition to problems for users, consumers and citizens, the study also takes a close look at the negative consequences of the current system for advertising customers and publishers, for example for apps or websites on which advertising is displayed.
Phenomena such as fraudulent advertising (scams), malware distributed with advertising (malvertising) or inappropriately placed advertising could damage the reputation of both media and brands (brand safety). According to research, if consumers perceive advertising targeting to be too invasive (exploitative personalization), this could also lead to advertising having the opposite effect and certain brands and products being avoided.
Rampant fraud schemes (ad fraud) are really big money, in which bots are used, for example, to generate fake clicks on advertisements and thus drive up prices even though no one has seen the advertisement. The authors cite a study that suggests a quarter of all advertising spending in the EU could have been lost to ad fraud in 2025, i.e. around 15 billion euros.
The problem for both advertising customers and publishers is that they often have to rely completely on the many AdTech platforms that provide the infrastructure for pricing and measuring the success of online advertising. In particular, the dependence on Google and Meta, but also other important gatekeepers such as TikTok, Amazon, Microsoft and Apple, is a problem here.
The end result is a picture of a market in which, with the exception of the AdTech middlemen, there are only losers.
–––
Against ID checks online.
We are fighting for an open internet.https://netzpolitik.org/spenden/?via=rss">Thisonly possible with your support.
–––
The study warns that the use of AI, which is already extensive today and will probably continue to increase in the future, will exacerbate problems. It is feared, for example, that the merging of search engines and chatbots will cause the reach and thus the advertising revenue of journalistic media to collapse because people will click on sources even less frequently in the future.
Cat and mouse game over tracking protection
For the first time, the study takes a detailed look at different developments in recent years with which the advertising industry has wanted to address its problems or which are positioned as alternatives to the currently prevailing model of behavior-based targeting.
For example, the study recognizes context-based advertising as a frequently discussed alternative. With this advertising model, ads are not tailored to the user's data profile, but rather to the context in which they are seen. To put it simply: advertising for football boots comes in a video about football. In addition to the media content consumed, other factors such as the general location or the weather are usually taken into account. In practice, however, context-based advertising is often not used as an alternative, but as a supplement to behavioral advertising, so that there is hardly any positive effect on data economy.
In turn, technical initiatives that are intended to make tracking with cookies or fingerprinting of devices more difficult, for example, are repeatedly circumvented by the industry. The advertising industry is playing a constant cat-and-mouse game with research and users “in which innovations that aim to maintain tracking-based advertising meet innovations that want to strengthen data protection.”
In the past, the most effective data protection initiatives were gatekeepers, i.e. companies that have central infrastructure such as browsers or smartphone operating systems. In particular, Apple's extensive measures have been effective for data protection, especially the App Tracking Transparency Mechanism (ATT). For a few years now, this has allowed users to prohibit apps from tracking for advertising purposes with a simple click. However, Apple implemented the measure in such a way that it favors the group's own advertising tracking, which is why other advertising companies and newspaper publishershttps://netzpolitik.org/2026/bundeskartellamt-apple-muss-tracking-schutz...Concerns against ATT successfully raisedhave.
The authors state that the measures that have been most effective for data protection have so far been implemented by gatekeepers in such a way that they disadvantage competitors. The plans announced by Google over several years to prevent third-party cookies in the Chrome browser and replace them with another tracking system called Privacy Sandbox could have had a similar effect, according to the study. However, Google has now buried the project, which is why the authors assume that tracking will continue in its existing form for the time being.
The GDPR is failing
According to the study, the EU's extensive digital regulation has not helped much so far. This applies primarily to the General Data Protection Regulation (GDPR), which was passed ten years ago. “Despite numerous decisions by data protection authorities and court rulings on the subject of online advertising, there is little evidence that the relevant players in the online advertising market have significantly changed their practices,” write the authors.
This suggests that “the enforcement of the GDPR has had little impact on the structure and functioning of the market with regard to the processing of personal data”.
In this context, the study points to onehttps://op.europa.eu/en/publication-detail/-/publication/8b950a43-a141-1...Investigation, which AWO had already prepared for the EU Commission in 2023. The main problem under data protection law is therefore the uncertainty regarding the legal basis for advertising tracking. This actually requires the voluntary and informed consent of the users, but problems with both criteria emerged.
Voluntariness is repeatedly undermined by manipulative design, so-called dark patterns. These include cookie banners in which the “Accept everything” option is highlighted, while rejecting tracking is complicated. In turn, being informed is hindered by the complexity of the advertising ecosystem, where users can hardly understand who is processing their data.
The current functioning of this ecosystem also prevents those affected from being able to enforce their rights guaranteed by the GDPR, such as the deletion of their own data. There is currently no central consent management.
DMA and DSA also come to nothing
The study also confirms that newer EU regulations such as the Digital Services Act (DSA) and the Digital Markets Act (DMA) are largely ineffective. The former, with its requirements for reducing systemic risks, does not cover large parts of the advertising business on the open internet at all, since advertising intermediaries do not fall under the DSA's definition of online platforms.
The DSA requires very large online platforms and search engines such as Google, Instagram or TikTok to be transparent about targeting mechanisms and advertising libraries for overview purposes. However, this is implemented very differently and has so far hardly helped users to actually understand why they were selected as a target group for an ad. The problem is exacerbated by algorithmic targeting of the platforms, where in the end it is less the target group criteria selected by advertisers that are decisive and more the opaque relevance calculation by AI systems.
Bans on using sensitive data categories for targeting in certain contexts would also not have the desired effect in practice. This is due, among other things, to the fact that the requirements can be circumvented by not using a sensitive category directly, but instead mapping it via a detour (proxy targeting), for example using location data. From these you can, for example, see who regularly visits certain religious buildings, which allows conclusions to be drawn about religion without having to explicitly work with the category of religious affiliation.
The Digital Markets Act, in turn, requires gatekeepers to share data on the price and performance of advertisements with advertisers and publishers. In practice, however, the rule hardly compensates for the information asymmetry between the different market players. This is due, among other things, to the fact that auctions for advertising space are not properly covered by transparency requirements.
–––
The work of netzpolitik.org is financed by donations from our readers.
You too can support our public interest-oriented, advertising- and tracking-free journalism.https://netzpolitik.org/spenden/?via=rss">Donatenow..
–––
Reform instead of turning away from the current system
The study concludes that the problems of online advertising cannot be solved without far-reaching regulatory measures. The proposals are partly based on existing regulations, but go far beyond them.
According to the authors, for example, privacy and security risks from advertising auctions could be avoided by holding advertising auctions without transmitting personal data to potentially thousands of companies. Targeting is also possible by assigning to target group categories decentrally on the devices of those affected.
One of the most important proposals aims to give users more control over their consent by managing it centrally in the browser or operating system. This would be possible, among other things, via so-calledhttps://netzpolitik.org/2026/digitaler-omnibus-neues-buendnis-will-das-e...signals, i.e. technical transmissions of user preferences that AdTech companies would have to accept. This is exactly what the EU Commission had to do within the framework of thehttps://netzpolitik.org/tag/digitaler-omnibus/">Digital Omnibus ReformThe EU member states have just proposed the GDPRhttps://netzpolitik.org/2026/eu-laender-einig-beim-daten-omnibus-mehr-ki...pronounced.
Other conceivable measures are aimed more at reducing information asymmetries between different players in the advertising ecosystem. These include proposals to tighten up the Digital Markets Act, which will increase transparency about advertising auctions and performance measurements for advertising customers and publishers. According to the authors, transparency regulations in the Digital Services Act should also be tightened, for example with regard to the transparency of targeting processes and advertising libraries.
Antitrust interference in the role of advertising infrastructure operators such as Google would go further. These could, for example, be prohibited from simultaneously offering advertising services and marketplaces for auctioning advertising space because they could benefit themselves in doing so.
What all of the proposals have in common is that they are not aimed at a radical departure from the current system of targeted advertising based on interests and behavior, but rather simply at reforming this system. A far-reaching proposal that civil society organizations repeatedly bring up is not discussed at all: a fundamental ban on tracking and profiling for advertising purposes. Several years ago I also had onehttps://netzpolitik.org/2021/privatleben-im-netz-sollen-wir-personalisie...comprehensive initiativeA corresponding proposal was put forward by European parliamentarians, but in favor of thishttps://netzpolitik.org/2022/digitale-dienste-gesetz-wie-die-datenindust...received majority.
Consumer advocates: Proposals “are not enough”
At the request of netzpolitik.org, civil society experts welcome the study with its comprehensive problem analysis, but criticize that the suggestions it contains do not go far enough.
“The study shows once again that personalized advertising poses significant risks for consumers and that despite the existing regulations, large gaps in protection remain,” writes Florian Glatzner from the Federal Association of Consumer Organizations. Suggestions such as better risk reports, advertising archives and due diligence obligations make sense. “However, they are not sufficient as long as the comprehensive tracking of consumers, the merging of data sets and the derivation of individual weaknesses remain permissible.”
Glatzner explicitly welcomes the fact that the study proposes “automated data protection signals” as a solution so that “consumers no longer have to reject or agree to tracking every time they visit a website.” That the member states submit a corresponding proposal from the EU Commission as part of the Digital Omnibushttps://netzpolitik.org/2026/eu-laender-einig-beim-daten-omnibus-mehr-ki...have, be unfortunate. “It is now up to the European Parliament to reopen this option and strengthen the rights of consumers.”
Tracking researcher: “Online advertising is broken”
Even more clear is the renowned tracking researcher Wolfie Christl, who has been conducting independent research into the data practices of the advertising industry for more than a decade. “The study offers a detailed analysis of regulatory gaps and provides a number of well-founded suggestions,” he writes in response to a request from netzpolitik.org. “Nevertheless, I have the impression that the core of the problem is somewhat lost in the almost 600 pages: online advertising is broken and needs a complete restart.”
His years of research show that GDPR-compliant data processing in the area of online advertising is more the exception than the rule. “Hardly any website or app operator, nor the advertising and data trading companies involved, know where the data really flows.” And further: “The alleged informed consent is a pure farce under these conditions.” The uncontrolled data flows are not only a problem for fundamental rights, but also a major security risk “for states, the private sector, civil society and for everyone else.”
More plain language is therefore needed, demands Christl: "In our beautiful new digital consumer world, there is a huge gap between legal regulations and practice. This is poison for trust in digitalization and the future of a democratic information society."
–––
Your donation for digital freedom rights
We report on current internet policy developments, uncover scandals and initiate debates. We are completely independent. Because our fight for digital freedom rights is financed by donations from our readers.https://netzpolitik.org/spenden/?via=rss">Nowdonate.