“Data about an individual” is too vague, as is “to target them.” Would this ban search-based advertising? What about using an IP address to guess at a language?
I think this can be done. I just don’t have the domain expertise to do it, and haven’t seen a proposed definition that made sense. The only intuition I have is around ephemeral versus permanent profiling.
don't browsers send a header telling the server what language they expect?
I live in Belgium where there's 3 national languages, and my preference isn't even one of them. Please us whatever language my browser tells you to (English)
For search based advertising we use the search query and location (taken from the country the user chooses in settings - and that can be "None" in which case we just use the search query). The language of the search query could be used rather than IP. Key for us is to never store IP and never pass on any part of it.
> Key for us is to never store IP and never pass on any part of it
I think this might hold the key. The law likely doesn’t need to try to regulate advertising per se, but instead the types of data advertisers are allowed to retain (or access).
Maybe a first step is creating a definition of an advertiser, requiring registration (not licensing) and the annual filing of the inputs their algorithm uses? All inputs, even the most banal? This assumes defining advertiser and algorithm and inputs is easier than what we’re trying to ban.
I think this can be done. I just don’t have the domain expertise to do it, and haven’t seen a proposed definition that made sense. The only intuition I have is around ephemeral versus permanent profiling.