Challenging YouTube’s Use of Unnecessary Detection Script:
Potential Enforcement Measures:
Hanff expects the DPC to investigate the matter and issue an enforcement notice to YouTube, compelling them to cease and desist these activities unless they obtain consent in accordance with the GDPR. Additionally, Hanff suggests that YouTube should reverse any account bans resulting from using these detection scripts and delete any unlawfully processed personal data.
Legal Terminology and Lex Specialis:
Acknowledging the difficulty of labeling YouTube’s ad block detection code as “spyware,” Hanff uses strikethrough formatting to emphasize that it falls under the category of potentially unwanted programs (PUPs) in the security industry’s defamation defense terminology. Hanff highlights that the ePrivacy Directive takes precedence over the GDPR where laws overlap, emphasizing that personal data collected without consent is unlawful under Article 5(1) of the GDPR and cannot be processed legally.
Voiding Terms and Conditions Contrary to Privacy Rights:
YouTube argues that using an ad blocker violates its Terms of Service, but Hanff asserts that any terms and conditions that restrict the legal rights and freedoms of EU citizens are void under EU law. Article 5(3) of the ePrivacy Directive is specifically designed to protect the fundamental right to privacy under Article 7 of the Charter of Fundamental Rights of the European Union. Consequently, any terms that limit EU individuals’ ability to control access to their own devices would be unenforceable.
Alexander Hanff’s complaint against YouTube’s ad block detection code represents a significant challenge to the company’s practices. If the Irish DPC rules in favor of Hanff, it could have far-reaching implications for user privacy rights. This case serves as a reminder of the ongoing battle between privacy advocates and technology companies over the control and protection of personal data. The outcome will undoubtedly shape the future of online advertising and the obligations of platforms like YouTube to obtain user consent before deploying tracking scripts.