[Paper Review] Improving Privacy Protection in the area of Behavioural Targeting

Frederik Zuiderveen Borgesius|ArXiv.org|Dec 15, 2025

Privacy, Security, and Data Protection22 citations

TL;DR

A PhD thesis examining how EU data protection law could strengthen privacy protections in online behavioural targeting, proposing a shift from a pure empowerment via consent to a combined approach that also prioritizes protection.

ABSTRACT

This PhD thesis discusses how European law could improve privacy protection in the area of behavioural targeting. Behavioural targeting, also referred to as online profiling, involves monitoring people's online behaviour, and using the collected information to show people individually targeted advertisements. To protect privacy in the area of behavioural targeting, the EU lawmaker mainly relies on the consent requirement for the use of tracking technologies in the e-Privacy Directive, and on general data protection law. With informed consent requirements, the law aims to empower people to make choices in their best interests. But behavioural studies cast doubt on the effectiveness of the empowerment approach as a privacy protection measure. Many people click "I agree" to any statement that is presented to them. Therefore, to mitigate privacy problems such as chilling effects, this study argues for a combined approach of protecting and empowering the individual. Compared to the current approach, the lawmaker should focus more on protecting people. The PhD thesis is a legal study, but it also incorporates insights from other disciplines, such as computer science, behavioural economics, and media studies. This study is among the first to discuss the implications of behavioural research for European data protection policy. The topic of whether data protection law should apply to pseudonymous data is discussed in depth. The study contains a detailed analysis of the role of informed consent in data protection law, and gives much attention to the tension between protecting and empowering the individual within data protection law.

Motivation & Objective

• Assess the effectiveness of informed consent under EU e-Privacy Directive and GDPR for behavioural targeting.
• Explore how data protection law can better protect individuals in online profiling.
• Examine the role of pseudonymous data and the tension between protection and empowerment.
• Propose a combined legal approach emphasizing protection alongside empowerment.

Proposed method

• Legal analysis of EU data protection and e-Privacy Directive concepts.
• Interdisciplinary synthesis incorporating computer science, behavioral economics, and media studies.

Experimental results

Research questions

• RQ1 How should European data protection law apply to behavioural targeting and pseudonymous data?
• RQ2 What is the role of informed consent in protecting privacy in the context of online profiling?
• RQ3 How can law balance protecting individuals with empowering them in the area of behavioural targeting?

Key findings

• Consent-based approaches may be insufficient to empower users and protect privacy in behavioural targeting.
• A combined approach that emphasizes protection in addition to empowerment could improve privacy outcomes.
• The study discusses the implications of behavioural research for European data protection policy.
• The work contributes to understanding how pseudonymous data is treated under data protection law.
• The analysis highlights tensions between protecting and empowering the individual within data protection law.