CNIL Imposed GDPR Consent Requirements On An Advertising Network Company

The French Supervisory Authority for Data Protection ("CNIL") has issued a formal warning to the start-up company Vectaury, according to which the company has failed to meet the conditions for valid consent under the GDPR. Vectaury is an advertising network that buys online advertising space for its customers (advertisers) and offers them a tool that enables them to collect geolocation data on devices and browsers of users, and, in turn, processes, for profiling purposes and advertising targeting, geolocation data that it receives via real-time bidding offers, in order to allow the company to purchase advertising space.

CNIL ordered the company delete all data obtained on the basis of invalid consent, and noted that the entire industry should view this case as an example. CNIL has become very active lately in the field of behavioural advertising, as this is the second time within a few months that CNIL has issued a formal warning relating to this type of issue (see