Privacy advocate Alexander Hanff filed a complaint with the Irish Data Protection Commission (DPC) challenging YouTube's use of JavaScript code to detect the presence of ad-blocking extensions on the site's visitors' browsers.
It claims that under the European ePrivacy Directive, YouTube must ask for permission to run tracking scripts because it is not technically necessary. If the DPC agrees, it would be a major victory for user privacy.
Asked how he hopes the Irish DPC will respond, Hanff replied via email:
“I expect the DPC to investigate and issue an enforcement notice to YouTube asking them to cease and desist these activities without first obtaining their consent (under Europe's General Data Protection Regulation (GDPR)) for the development of detection scripts -spyware- and furthermore to order YouTube to unban accounts blocked as a result of these detections and to delete any personal data that was unlawfully processed (Article 5(1) GDPR) since they started running their spyware detection scripts.”
Hanff uses the term "spyware" for YouTube's ad blocker detection code. The standard terminology for such things is PUPs or potentially unwanted programs. Hanff, who has a master's degree in law, added that the ePrivacy Directive is lex specialis in the GPDR. This means that where laws overlap, the specific one prevails over the more general one.
As it claims, personal data collected without consent is unlawful under Article 5(1) of the GDPR and cannot be processed in any lawful way for any purpose.
Regarding the claim that using an ad blocker violates the site's Terms of Service, Hanff argued:
"Any terms and conditions that limit the legal rights and freedoms of an EU citizen are void under EU law." In essence, "any such terms that limit the rights of EU individuals and restrict access to their terminal equipment are void and unenforceable," he added.
George is still wondering what he is doing here….
