New standard contract removes personal data from advertising supply chain
The Movement for an Open Web (MOW) is today introducing its Model Terms for Marketing (MTM), a new standard contract for the advertising supply chain that promises to enhance consumer privacy, clarify definitions around personal data and remove friction from the advertising supply chain. The MTM allows publishers, agencies, adtech providers and advertisers to effectively remove personal data from the advertising supply chain. The terms use embedded contracts in advertising data that leverage established legal precedents to ensure that advertising data is not personal data under European or US laws.
The MTM is designed to overcome the increasingly arcane limitations faced by the Open Web as a result of confused and excessive privacy regulation and guidance. The current system relies on the arbitrary collection of uninformed consent from consumers who don’t understand (or often care) about the questions they are being asked. This consent structure doesn’t add to consumer privacy and benefits the tech platforms who are effectively exempt from it. The MTM removes the need for this consent friction by ensuring that data passed through the advertising supply chain is not personal data and cannot be legally reidentified.
How it works
Under the MTM scheme, advertising works without personal data moving through the supply chain. The scheme is designed so that the personal data stays with the organization the person actually visits or already deals with (the Operator, typically a publisher). Everyone downstream receives a Match Key, a piece of data which the scheme leaves them no lawful way to link to a person, bundled with the person’s advertising preference and the metadata (creator domain, timestamp and cryptographic signature).
Some AdTech businesses have the technical means to link data like this to other data or to track individuals. The MTM takes the use of those means away by contract. Every recipient warrants that it has no means reasonably likely to be used to identify anyone from the Covered Data.
Under the MTM, covered data is not personal data in the hands of recipients. This position follows from the definition of personal data in the GDPR and from key decisions of the Court of Justice of the European Union. Those decisions ask a practical question. Can this organization, with the means reasonably available to it, identify a person from the covered data? Where the answer is no, the data is not personal data for that organization, even though it remains personal data for the Operator, who stays fully subject to the GDPR. United States privacy law points the same way, with California’s statute setting out the mechanism expressly.
The MTM allows users to make a choice about their marketing preferences. A person’s marketing choice sits alongside the Match Key. There are two marketing settings, personalised or standard marketing, and both are off until the person makes an affirmative choice, which they can change at any time.
Sensitive data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life or sexual orientation, genetic or biometric data, criminal history, or anything else classed as special category data) is excluded from the MTM scheme entirely.
Why this isn’t personal data
The GDPR defines personal data as information relating to an identified or identifiable person (Article 4(1)). Recital 26 explains how to judge identifiability. Account should be taken of all the means reasonably likely to be used, considering the cost, time and technology involved. Data that one organization can link to a person may therefore be impossible for another organization to link to anyone. The question is always asked of a specific holder with specific means. Three decisions of the CJEU establish this.
Breyer (C-582/14, 2016). A dynamic IP address held by a website operator was personal data only because German law gave the operator a lawful channel to obtain the linking information from the internet provider. The Court held that identification must be practically and lawfully possible, not merely conceivable, and that means are not reasonably likely to be used where identification is prohibited by law or practically impossible. An abstract, theoretical risk does not make data personal.
SRB (EDPS v SRB, C-413/23 P, 2025). The Single Resolution Board shared pseudonymized comments with the consultancy Deloitte. The Court confirmed that identifiability must be assessed from the perspective of each recipient, and that pseudonymized data is not automatically personal data for every recipient in every circumstance. Where the recipient has no lawful means to obtain the additional information needed to identify anyone, the data is not personal data in its hands, even though it remains personal data for the sender.
Scania (C-319/22, 2023). A vehicle identification number is not, in itself, personal data. It becomes personal data only for someone who reasonably has the means to connect it to a specific person.
Now apply that test to the MTM scheme. Many advertising businesses have the technical means to link a reference like a Match Key to other data. The MTM takes the use of those means away. Through the scheme a recipient receives no name, no contact details, no raw identifiers and no browsing history tied to an identity. It warrants that it has no means lawfully available to be used to identify anyone from the Covered Data, and it is barred from using the means it has, or acquiring more, to identify anyone, including by combining Covered Data with other data it holds. Any attempt is a breach that exposes it to termination, a public breach notice and notification of the data protection authorities.
The prohibition is contractual and carries penalties. It is published publicly and it cannot be varied. Breaking it risks discovery through the notices the scheme requires and the scrutiny of counterparties and regulators, and the consequence is ejection from the scheme. Under the scheme a recipient could identify someone only by breaching an enforceable contract, losing its data supply and advertising its own wrongdoing. Such a recipient is not reasonably likely to use those means. On the test in Breyer, SRB and Scania, the Covered Data is not personal data in the recipients’ hands.
Why this matters
The MTM has the potential to benefit web users, publishers, adtech companies, advertisers and all participants in the open web. By removing personal data from the advertising supply chain, it will enhance consumer privacy, remove consent friction for publishers and users, help the Open Web compete on a level playing field with platforms and will provide simple clarity for regulators and Data Protection Officers.
Third party support
Richard Reeves, Managing Director of the Association of Online Publishers (AOP) said: “The Model Terms for Marketing have the potential to change the game in digital advertising data. By creating a technical infrastructure that clarifies the status of personal and non-personal data it removes a significant swathe of complexity and uncertainty that has been holding the Open Web back. The Model Terms mean that every step of the value chain will be bound by contractual terms that define the nature and handling of the data flowing through it – that creates a robust legal infrastructure that can support the compliant and seamless sharing of non-personal data to power advertising services. We support this initiative and encourage businesses across the market to be a part of the project.”
Christian Cockcroft & Sherif Malak, Partners at Shoosmiths said: “MTM represents a novel approach to one of the most persistent challenges in digital advertising: how to balance effective advertising, user choice and privacy expectations in a world increasingly shaped by consent fatigue. It offers an innovative attempt to reduce reliance on personal data within the advertising supply chain while preserving meaningful user choice and promoting greater clarity for market participants”.
For more information about MTM visit https://m4ow.uk/mtm/.
Image created with Canva