The investigation is potentially bigger than Google and could determine the future of real-time bidding. That is, if regulators agree with the claims and take action. Ryan is trying to force change, and has amassed a detailed dossier of evidence that suggests all RTB exchanges are non-GDPR compliant by their nature. As well as using it to file complaints with multiple European data regulators, Ryan’s been walking U.S. senators through the ins and outs of RTB, and arguing his case with intelligence and eloquence. Much of it boils down to consent, and how people that use the internet can knowingly consent to such widespread collection of data, and subsequent profiling, “by companies they have never even heard of”.

Within the dossier, Ryan notes the IAB’s own position on real-time bidding and GDPR, highlighting key lines: “As it is technically impossible for the user to have prior information about every data controller involved in a real-time bidding (RTB) scenario, programmatic trading, the area of fastest growth in digital advertising spend, would seem, at least prima facie, to be incompatible with consent under GDPR.” The document goes on to state that without consent under the EU’s definitions, there is no legal basis “for such [data] processing to take place or for media to monetise their content in this way”.

Regulators tend not to hurry when it comes to making big decisions. Ryan acknowledges that it may “take years for GDPR to take effect”, but already, he suggests, “things are looking very bleak” for Google and others. Ryan, by the way, advocates contextual targeting as the solution.