Privacy advocate Alexander Hanff filed a complaint with the Irish Data Protection Commission (DPC) challenging the use of code JavaScript by YouTube to detect the presence of ad-blocking extensions in the browsers of website visitors.
It claims that under the European ePrivacy Directive, YouTube must ask for permission to run tracking scripts because it is not technically necessary. If the DPC agrees, it would be a major victory for user privacy.
Asked how he hopes the Irish DPC will respond, Hanff replied via email:
“I expect the DPC to investigate and issue an enforcement notice to YouTube asking them to cease and desist these activities without first obtaining their consent (under Europe's General Data Protection Regulation (GDPR)) for the development of detection scripts -spyware- and further order YouTube to unban accounts that have been blocked as a result of these detections and to delete any personal data that was unlawfully processing (Article 5(1) GDPR) since they started running their spyware detection scripts.”
Hanff uses the term "spyware" for YouTube's ad blocker detection code. The standard terminology for such things is PUPs or potentially unwanted programs. Hanff, who has a master's degree in law, added that the ePrivacy Directive is lex specialis in the GPDR. This means that where laws overlap, the specific one prevails over the more general one.
As it claims, personal data collected without consent is unlawful under Article 5(1) of the GDPR and cannot be processed in any lawful way for any purpose.
Regarding the claim that using an ad blocker violates the site's Terms of Service, Hanff argued:
“Anyone terms and conditions that limit the legal rights and freedoms of an EU citizen are void under EU law.” In essence, "any such terms that limit the rights of EU individuals and restrict access to their terminal equipment are void and unenforceable," he added.
