Produced and animated by Kari-Ruth Pedersen; co-produced by Joe Sinclair
You can enable subtitles (captions) in the video player
Ad tech is the business model that underpins the internet. Most websites and apps may be free to use, but they make money by displaying digital advertising targeted specifically at you. An entire industry has grown up around auctioning and targeting online adverts as accurately as possible using data collected about each and every user.
Whenever you visit a website, your computer can send out personal data to thousands of ad tech companies. They take the information and use it to bid for the adverts that you see when the page loads. It takes milliseconds.
Billions of bid requests are made each week in the UK alone. Europe's entire digital ad market hit 55.1bn euros in 2018.
But Europe's new privacy law, the General Data Protection Regulation, has put the industry under a spotlight because of the troves of personal data it trades. And not just between the website and an advertiser, but between advertising companies that are building profiles of us.
A damning report from the UK data protection regulator found that the ad tech industry was breaking the law by illegally collecting and bartering in special category data which requires our explicit consent. The regulator has given the ad tech industry six months to clean up its practices. That deadline expires in December 2019.
The industry must decide. Can it legally continue to auction off our personal data, or must it change its ways to be more transparent and to minimise how much data it collects?