New GDPR guidelines effectively bans targeted ads (Nov 2017)
1. Using private data for advertising, is single purpose.
2. Each purpose require seperate consent.
3. A consent must freely given. If consent is not given, none, degraded or higher-priced service cannot be offered instead.
From http://eur-lex.europa.eu/eli/reg/2016/679/oj
Article 7(4). When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
From the guidelines above
[Example 1]
A mobile app for photo editing asks its users to have their GPS localisation activated for the use of its services.
The app also tells its users it will use the collected data for behavioural advertising purposes. Neither geo-localisation or online behavioural advertising are necessary for the provision of the photo editing service and go beyond the delivery of the core service provided. Since users cannot use the app without consenting to these purposes, the consent cannot be considered as being freely given.
[Example 6]
A bank asks customers for consent to use their payment details for marketing purposes. This processing activity is not necessary for the performance of the contract with the customer and the delivery of ordinary bank account services. If the customer’s refusal to consent to this processing purpose would lead to the denial of banking services, closure of the bank account, or an increase of the fee, consent cannot be freely given or revoked.