HbbTV: the stumbling block
Cookie banners have become a common sight for internet users in Europe. Recently the first cookie banners also appeared on Austrian TV screens.1 This is a side effect of the hybrid broadcast broadband TV ("HbbTV") standard, which merges classical television with the internet. HbbTV offers a broad variety of new services to viewers, such as an electronic programme guide, video on demand, "super text" (an advanced teletext with a more attractive user interface with more information), games, and much more. All these services are accessible on the TV screen without the need to switch the channel.
On the other hand, HbbTV enables broadcasters to track the viewing habits of their audience in real time with great accuracy to optimise strategic programming and advertising. To this end, broadcasters use conventional web analytics services like Google Analytics, which in turn are based on cookies and similar technologies to make the individual devices identifiable. In February 2020, the HbbTV TA standard was introduced, replacing generic TV commercials in a linear broadcast feed with targeted ads delivered via broadband. Targeted advertising also relies on unique identifiers, provided e.g. via cookies or device IDs.
The ePrivacy Directive
It is important to point out that Art. 5 (3) ePD is technology neutral. First, its scope is not limited to cookies but covers all technologies that store or access data on users' devices. Art. 5 (3) ePD thus also covers inter alia web storage, fingerprinting, or accessing a device-ID or advertising-ID. Second, it does not only apply to surfing the web on a computer but to the usage of electronic communications networks in general by all kinds of devices.
HbbTV typically uses the internet to access unique identifiers that are stored on a device. Art. 5 (3) ePD therefore applies and viewers must be informed and, where necessary, asked for their consent.
Since HbbTV has become a common standard in Europe, cookie banners will soon become prevalent on TV screens as well. But do cookie banners actually strengthen viewers' privacy?
Providing information on how data is used obviously is important and cookie banners as well as privacy policies therefore serve a very legitimate purpose. However, a 2018 study showed that half of all participants considered the likelihood that they would click on the link in a cookie banner to receive additional information to be less than 13 %.2 Those few users who actually want additional information may face serious challenges: An analysis of 150 privacy policies showed that the vast majority require at least college reading level.3 Most privacy policies, which tend to be verbose and full of legal and technical jargon, are therefore incomprehensible for the average reader.
HbbTV has brought cookie banners onto our TV screens. But will it stop there? Analytics of usage behaviour and targeted ads are also a common phenomenon on mobile apps, yet cookie banners or requests for consent are still scarce.
For most users, cookie banners remain an annoying phenomenon. And those cookie banners which do not comply with the law are indeed just that. But the ultimate question should not be "How to achieve better compliance?" but rather "How to achieve better user privacy?" This goal may require a change of direction. Privacy should not be the concern merely of the website publisher, mobile app developer or TV broadcaster. Rather, privacy should be integral to the underlying technical standards itself. Whenever a new standard is developed, such as HbbTV, the protection of privacy should be considered right from the start. In the authors' opinion, this is what privacy by design should actually mean in practice.
4 Utz/Degeling/Fahl/Schaub/Holz, (Un)informed Consent: Studying GDPR Consent Notices in the Field
5 Matte/Bielova/Sanots, Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework