“The fact that I am still getting tracked and targeted is problematic. The fact that I don't know why, or by whom - even as a 15-year veteran of ad tech - is unbelievable.”
There’s a bunch of cases where a business should not delete data even if requested by a user; the biggie is crime/fraud prevention. However, if that data was later disclosed in a breach the company would be subject to penalties. The request for removal does count as rescinding consent, so you would no longer be able to do anything that required consent anyhow.
Data could be thought of as radioactive so long as it has a unique identifier. If you can aggregate your fraud detection data in some way to remove the pseudonymous/personal identifiers then you should. If you can’t, then your usecase needs to justify the risk of keeping that radioactive material around.
Watch out that your aggregates can’t be reverse engineered though. There’s a reasonableness test around how easy it would be to recompile a users profile etc. As technology advances things that were once unreasonable become reasonable think md5). I find it helpful to think of reasonableness being connected to the best 10 people you recently interviewed, or the actions of any competitor in the space. If a prosecutor can point to the competitor and ask why you didn’t do what they did, you need a very good reason to pass reasonableness.
I wonder why a HK incorporated company based their Privacy Policy on EU GDPR principals? Gives non-EU users the same rights as EU users (right to be forgotten, correction, etc).
Enforcement would have to come from an EU user though; and with the EUR20m fine I imagine a single breach puts AirHelp under.
Aggregated data could be traded under this agreement (they can use legitimate interest as their legal basis for processing under GDPR so long as there is some form of anonymising aggregation). For example stats shared with airports about the types of people visiting them at different times of year, etc and what other products they buy. E.g. Hey JFK, 10% of your fliers shopped at X in the 30 days before they visited, but 12% did after, proving that X's ad campaign must have worked. From that perspective it's a pretty massive panel.
If Amazon had let you control their retail pricing wouldn't that be price fixing? You can set a recommended price, but once you've accepted the wholesale price, you live with it. If the retailer decides to dump your product at a loss, that's their choice no?
An important difference between buying ads on 400k sites and 5k sites is the margin for the middlemen. The money is going to get spent anyway, so the middleman needs to optimise his take.
The bigger the sites; the more leverage they have over middlemen. The lower the fees exchanges/ssps can collect - for big sites (ones people have actually heard of) the fee is effectively zero, and are needed by exchanges as loss leaders to attract any demand. Little sites with no leverage will expect to pay around ~70% to the middlemen (although not all of that will be disclosed).
True story: about 250 domains will get you above 98% of online population in most countries. This is plenty large enough for dvertisers to do all kinds of fancy targeting and optimisation within this pool.