Transparency and (no) more in the Political Advertising Regulation

Introduction

The EU has taken its first steps into a sensitive space by proposing a new Regulation on Political Advertising (RPA). Simply put, the RPA does two things, which this commentary will address in turn. First, it replaces national laws on the transparency of political advertising with a single set of rules. These provide progressively more information to citizens who see an ad, to the public through ad libraries, and to regulators and private actors who are authorised to request information. Second, the RPA tightens the GDPR’s ban on using sensitive data for targeted political advertising. It leaves member states free, however, to further regulate the use of political advertising.

The RPA takes a number of important steps in political advertising law. It strengthens the transparency of the (so far largely unregulated) online political advertising environment. It expands ad libraries with information on targeting and funding. And it allows a broad range of private actors (including civil society and journalists) to request data from a broad range of companies (including ad agencies and small platforms). At the same time, the RPA not only represents the EU’s most significant effort to address concerns about political advertising’s democratic impact, but (because it fully harmonises transparency) also shapes how individuals, researchers, and national regulators can scrutinise political advertising. It is therefore important to determine whether the regulation lives up to the Commission’s hype.

Transparency is necessary, but the RPA’s approach is insufficient

The general premise the RPA builds on is that transparency is necessary to support voters' informed decision-making, fair political processes, and public scrutiny (rec. 4, 46). It does not aim to regulate other aspects of political ads, such as their substance, sponsor or timing. These are, according to the Commission, “intrinsic to national electoral law and do not form part of the functioning of the internal market” (p. 6). It is difficult to see why differences in national transparency rules are problematic from an internal market perspective, while other aspects of national political advertising rules are not. The arbitrariness of that argumentation aside, a growing body of research indeed confirms transparency’s importance as a precondition for fair political practices. The devil, however, is in the implementation. The following highlights three weaknesses in the RPA’s approach to transparency, focusing on the platforms which have become key players in this space.

First, the RPA pays insufficient attention to the way information targeted at individuals must be designed. While art. 7(1) states that information must be conveyed in a “clear, salient and unambiguous way”, it remains too vague on what this should entail. Research has shown that these design choices matter. People generally have a hard time noticing transparency information. For those who do notice such information, it matters how it is formulated, where it is positioned, and whether it is shown before, during, or after the ad. Currently, each platform conveys transparency information in their own way, and studies suggest they do so with limited effectiveness. The RPA’s ambiguous language on this point is a missed opportunity to replace the current cacophony of ineffective disclosures across platforms with specific, standardised, evidence-based guidelines. Such guidelines are worth pursuing, because literature suggests there is promise in these disclosures if we get them right. The RPA already provides a foundation for integrating insights from scientific research by empowering the Commission to modify what information is made available (art. 19), a provision that should be extended to the form in which the information is being provided.

Second, the RPA fails to fully account for the information needs of professional researchers. Helpfully, the RPA does explicitly acknowledge that e.g. journalists and academics should have access to data so they can fulfil “their specific role to support free and fair elections [including by] … analysing the political advertisement landscape” (rec. 42, 46). However, it sets few hard rules on the (interoperability of the) format in which information should be provided. Art. 7(4), for example, only requires information to be “machine readable”, and only when this is technically feasible. Similarly, though the RPA now requires transparency about targeting, it does not appear to cover information researchers have long argued to be necessary to understand targeting’s systemic risks, such as why an individual sees an ad.

Part of the problem is that the RPA builds researchers’ data access on transparency provisions that also target individuals. For example, the provision which covers disclosures about targeting algorithms requires that the individual concerned can understand their logic and main parameters (art. 12(3)(c)). Professional researchers’ information needs are different. The format in and detail with which information is provided is key to their ability to scrutinise political advertising’s systemic impacts, as opposed to only individual ads and sponsors. To genuinely enable researchers to scrutinise political advertising, the RPA must include more encompassing data access provisions, regulate the format and interoperability of data, and include mechanisms to adapt to changes in the way data is analysed.

Third, the RPA relies heavily on self-disclosure by the ad buyer to identify political ads. Political advertising publishers (including platforms) do not face any independent duty to monitor for political ads. They must only “make reasonable efforts to ensure that the information … is complete” (as opposed to reliable under art. 22(2) DSA), and enable their users to notify them of undisclosed political ads (art. 7(3), 9). Moreover, sponsors’ obligation to self-declare is phrased weakly. Art. 5 merely requires that service providers ‘shall request’ sponsors to declare political ads, instead of directly demanding of sponsors that they ‘shall declare’. This could make the declaration of political ads a mere contractual obligation, rather than a binding rule of public law enforceable by regulators and other watchdogs.

The RPA risks incorporating one of the main failures of self-regulation of political advertising on platforms: that sponsors routinely misstate key information, such as their identity, and that platforms have failed to reliably detect political ads. The RPA seems to place its hopes on citizens, national regulators, researchers, and journalists to catch violations of its rules. However, the national authorities the RPA targets already face a heavy supervisory burden under the GDPR and soon the DSA. And while civil society, journalists, and researchers have played a pivotal role in detecting the harms of online advertising, it is unrealistic and unfair to burden them with systemic oversight, especially without corresponding safeguards, entitlements and (financial) support. Ideally, a structural monitoring task would fall to the platforms who profit from political advertising, and regulators whose funding and obligation to do so is clearly secured. For now, the RPA expects too much and facilitates too little.

Moving beyond transparency

The RPA leaves important questions about the conditions under which political advertising is unacceptable or unfair unanswered. Targeted political advertising is the sole exception to this rule. The RPA itself describes targeting’s key challenge as the exploitation of individuals’ characteristics to take advantage of their sensitivity to particular messages (rec. 47). In other words: targeting’s persuasive potential and the resulting threat to citizens’ autonomy. The RPA meets this threat not only with the transparency with which it addresses all other political advertising harms, but also by tightening the GDPR’s ban on using sensitive data.

While focusing on sensitive data makes sense from a data protection perspective, for the purpose of solving democratic problems it is both over- and underinclusive. Overinclusive, because it limits targeting on the basis of political opinions and philosophical beliefs, which have clear political relevance and could actually strengthen the substance and relevance of targeted political advertising. Moreover, limiting targeting on the basis of racial or ethnic origin and religious beliefs puts parties that represent those minority groups at a disadvantage, which harms rather than benefits pluralism. Underinclusive, because it leaves out information such as personal characteristics or anxieties, the use of which poses a more obvious manipulative threat.

Protecting citizen autonomy requires a focus not on what data is used, but on how it is used. Targeting enables sophisticated persuasive strategies, and these affect autonomy: does advertising inform or mislead, engage or baselessly antagonise? This takes us into the weeds of balancing free political speech with preventing harms to citizens and public discourse. There are terrible dilemmas there, but moving around them by focusing on the data used instead does not solve them.

Conclusion

The RPA emphasises the importance of safeguarding the democratic process from manipulation, disinformation, and foreign interference, but relies almost exclusively on transparency to do so. Firstly and most obviously, this means the flaws in the RPA’s approach to transparency must be addressed. But secondly, it means questions about the norms that should apply to the use of (targeted) political advertising remain unaddressed. At present, the RPA leaves this task to the member states or future EU legislation.

However, it is doubtful whether norms on transparency and norms on the use of political advertising can be separated that clearly. National, EU, academic, and civil society actors all require transparency to design and enforce the norms that (will) apply to political advertising. The RPA risks limiting their ability to do so by spelling out in detail what information political advertising services can be compelled to provide, and providing only limited flexibility to the Commission to modify this information. It moreover does so precisely at a time when (targeted) political advertising’s impact on democracy remains unclear and continues to change quickly. To ensure the RPA does not freeze our ability to scrutinise political advertising to its currently known risks, regulators and researchers need a more open-ended right to data than the RPA now provides.

Funding

This op-ed received funding from the NWO project ‘safeguarding democratic values in digital political practices', nr. MVI.19.019.