GDPR after Brexit: UK citizens must keep protections

The commercial challenges for media online are well-documented: online advertising pays for utilities such as search and social networking many times over, but not for media beyond user-generated content and low-investment journalism.

There are also costs from a user perspective: wasted time, harmful content created to attract views, and the collection, sale, use and frequent leakage to criminals of personal data.

Different sectors have found varying success with alternatives: games, video and music are attracting user payments, driving the paid online economy up 15.5% to £8.2 billion in 2018.

Recently issued regulator rulings on Google, ad tech companies and Facebook challenge prevailing online advertising practices of obtaining user consent under the EU’s General Data Protection Regulation (GDPR)

Rulings from France on Google and ad tech partners of media owners called them out for inadequate disclosure to users, and excessive merging and processing of data

In a landmark precedent for Germany, the Federal Cartel Office found that Facebook lacked “freely given” consent from users, calling its terms “exploitative” and an abuse of its dominant position, also harming competitors

For much of the online media industry, GDPR compliance has stalled at basic data audits and box ticking, as firms wait for the rest of the privacy regime to emerge

But weighing technicalities of legitimate interest and consent misses the point: transparent consumer value will be the only sustainable basis for processing personal data

The scrutiny of Google and Facebook privacy practices involves an added antitrust dimension, potentially leading to processing limits as remedies