LEGITIMATE INTEREST ASSESSMENT (LIA)
FOR non-targeted advertising
Gameloft SE carries out the present Legitimate Interest Assessment (LIA) with the intention to demonstrate the compliance and legitimacy of reliance on legitimate interest as a legal basis to perform the in-game contextual advertising operations encompassed within the Interactive Advertising Bureau (“IAB”) TCF Special Purpose 2 – “Deliver and present advertising and content”.
- 1- LEGITIMATE INTEREST IDENTIFICATION
Gameloft SE (“Gameloft”) is a French headquartered mobile games publishing company, operating internationally (through 18 entities located worldwide). Gameloft’s catalogue includes a wide-range variety of games, which are distributed via major distribution platforms and which may appeal to diverse and international audiences.
Gameloft has developed a renowned expertise in the digital advertising industry, and has constituted a network composed, amongst other parties, of advertisers, media agencies and programmatic vendors. Gameloft has developed its proprietary advertising solution and provides for advertising services to websites, applications and digital properties publishers (“Publisher(s)”) interested in monetizing the advertising inventory available within their digital properties, hence appointing Gameloft as an advertising sales representative.
Within the framework of providing for such services, Gameloft is registered as an IAB Europe Vendor 1198, relying on the technical specifications and on the IAB Europe Transparency & Consent Framework – Policies (version 2023-05-15.4.0 and upcoming versions, as applicable) (“IAB TCF v2.2 Policies”).
These services consist in the selection and serving of advertising content, either directly or programmatically, within Publishers’ digital properties. In other words, the selection and display of advertising content may be carried out in collaboration with advertisers and/or media agencies Gameloft has a direct relationship with (direct operations), or with intermediary platforms, such as supply-side platforms, enabling a wide-range variety of advertisers and media agencies to have access to an advertising space and to display their advertising content, based on a real-time bidding process (programmatic operations). Regardless of the method, digital advertising may also be divided in two main categories: targeted advertising (also referred to as “interest-based” or “behavioural” advertising) and contextual advertising (also referred to as “non interest-based” advertising).
- Targeted advertising is a user-centered advertising method. It refers to the processes allowing advertisers and publishers to display advertising based on the observation of the users’ characteristics, their behaviour over time and their interests. Such observation is made possible through the collection and processing of users' personal data – such information being provided directly or indirectly by users, including where applicable their age, gender, location, user and/or device identifiers, advertising identifiers, data collected through their browsing activities and interactions with a content. In compliance with the applicable Data Protection regulations and with the IAB TCF v2.2 Policies, targeted advertising operations are carried out upon end-users’ prior, informed and express consent.
- Contextual Advertising is a content-centred advertising method. It refers to the practice of displaying advertising based on the content of an application, a website, or of a digital property the end-user is visiting/using. This means that, unlike targeted advertising, the advertising is not based on user’s personal information, and is not tailored to the end-user’s precise location, age, interests or behaviour – but is based on a limited set of data (as described hereinafter) and on the editorial content of the digital property the advertising is displayed in. Carrying out contextual advertising, for instance, may translate into displaying an advertising for a car tires manufacturer in a racing game, or and advertising for running shoes in a sports-related application.
Unlike targeted advertising that cannot be displayed to users without their specific consent, Gameloft may participate in the selection and display of contextual (non-targeted) advertising to users without receiving their consent from the Publisher. To proceed so and with respect to the contextual advertising operations encompassed within the IAB (Interactive Advertising Bureau) TCF Special Purpose 2 – “Deliver and present advertising and content” (“Special Purpose 2”), Gameloft has identified legitimate interest as a suitable legal basis.
Such legal basis is expressly described as an available legal ground under Article 6(f) of the Regulation (EU) 2016/679 (General Data Protection Regulation – hereinafter referred to as “GDPR”). Pursuant to this Article, a processing of personal data “shall be lawful only if and to the extent that at least one of the following applies: (…) (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.
- 2- NECESSITY ASSESSMENT
In the present section, we will demonstrate that, pursuant to Article 6(f) GDPR, the processing of end user’s personal data is “necessary for the purposes of the legitimate interests pursued by the controller” and that there is no less intrusive way to achieve the result contemplated herein.
As further detailed hereafter, while operating its advertising services to Publishers, Gameloft SE acts as a Controller of Publishers’ end-users’ personal data.
Is this a reasonable way to reach Gameloft’s objectives? |
Publishers can ensure the monetization of their digital properties using various mechanisms, including by monetizing their advertising inventories. As an advertising sales representative, Gameloft is appointed to ensure the sale and to optimize the monetization of Publishers’ advertising inventories. |
Could there be a less intrusive way to get the same result? |
As previously explained, such services may be provided based on targeted (interest-based) advertising operations, which are indisputably subject to Publishers’ end-users consent, as such methods involve the collection and processing of user’s device and/or advertising identifiers, which are obtained by reading and/or storing information on user’s devices. Such services may also be provided based on contextual advertising operations. Gameloft is hereby assessing its reliance on legitimate interest as a lawful legal basis to perform contextual advertising operations pursuant to the IAB TCF Special Purpose 2, as the operations encompassed within such Special Purpose are necessary for Gameloft to ensure the provision of a minimum advertising service, that does not involve the consent-based collection and processing of user, device and/or advertising identifiers and of user’s personal information for consent-based purposes. In this sense, in order to perform contextual advertising as per Special Purpose 2, Gameloft only has access to a limited set of data including: - Limited ttechnical information about device capabilities (such as the screen size/resolution.) to ensure the technical compatibility of the advertising and to facilitate the transmission of the ad to the device (for instance, for the purpose of displaying the ads in a suitable format); -IP address, to detect the user’s coarse location (country/state level). This information is not processed at user-level (to target a specific user) but is used to ensure that the advertising is displayed in a suitable language and geographical context (for instance, an advertising for a French brand or service is suitable for an audience based in France, not in the USA). The overall purpose is to technically support the advertising delivery system. Therefore, such method does not require to access to and to process any data that allows the direct and/or namely identification of a user, nor data that allows the indirect identification of a user or that provides insights on the individual’s preferences and online behaviors. In addition, the collection of the abovementioned information does not allow Gameloft to proceed to frequency capping and to click-fraud prevention operations, as these activities may be based on the collection of individual identifiers. Therefore, with emphasis put on the fact that this method is centred on the Publisher’s editorial content, and not on user-related personal information, Gameloft considers that contextual advertising operations carried out as per Special Purpose 2 are “low privacy impact” and “low intrusion” advertising practices and data processing operations. |
Will this data processing actively further the overall interest? |
No, this collection and processing of data do not contribute to an overall interest per se. The purpose of this processing is for Gameloft to be able to provide for basic advertising services to the Publishers. |
- 3- BALANCING WITH INDIVIDUAL’S RIGHTS
As a Controller, Gameloft values Publishers’ end user’s privacy and fully understands its responsibility to protect the individual’s interests.
What is the relationship between Gameloft SE and the user? |
Gameloft is in indirect relationship with the user. Indeed, in such instance, Publishers have a direct relationship with the end-users of their digital properties and are the controllers of the data collected and made accessible to Gameloft for the purposes of advertising selection and serving. Once enabled to receive and/or access to such data, Gameloft is acting as an independent controller – independently determining the means of processing and, to the extent Special Purpose 2 is concerned, determining the applicable legal basis for such processing operations. Although its relation to the users is indirect, users are informed about the operations carried out by Gameloft as a controller through Publisher’s documentation and disclosures (including Privacy Policy and/or Consent Management Platform, referring to Gameloft’s privacy disclosures as applicable, in compliance with Article 14 GDPR). |
Is any of the data considered sensitive or special? |
No – Gameloft does not collect, retrieves, nor otherwise prompts, encourages or requires Publishers to collect, process and otherwise make accessible to Gameloft any sensitive or special categories of personal data from and about end-users. |
Would the user reasonably expect Gameloft SE to use their data in this way? |
Although its relation to the users is indirect, users are informed about the operations carried out by Gameloft as a controller through Publisher’s documentation and disclosures (including Privacy Policy and/or Consent Management Platform, referring to Gameloft’s privacy disclosures as applicable, in compliance with Article 14 GDPR). To this extent, users may reasonably expect Gameloft to use their data for advertising purposes. This expectation may be strengthened by Publisher’s own general disclosures about their digital properties’ monetization methods, as applicable. |
Could some users object and say the processing is too intrusive? |
Substantially, to the extent a processing of personal data is at stake, it is understandable that an individual could express concerns regarding their privacy. For this simple reason, we cannot strictly reply “no” to this question. However, as per GDPR and other Data Protection applicable regulations, users are entitled to request more information about the processing of their personal data. As a controller of the data it receives from Publisher (for Special Purpose 2, and for other purposes as applicable), Gameloft enables users to request information about Gameloft’s data processing and privacy practices, via email, mail and via dedicated Privacy Forms (accessible through its Privacy Policy and handled by its Customer Services and Privacy Teams). Specifically, Gameloft enables users to request information about the categories of data processed and the corresponding purposes, including with respect to the set of data handled for contextual advertising purposes. |
How will the data processing impact the individual? |
As explained above, Gameloft considers that the impact of contextual advertising is very low, as the process does not rely on identifiable or sensitive data, or device/persistent identifiers, and as this process is not based on the user’s age, gender, past and detected behavior, researches, interactions with the app or other apps, preferences, etc. As previously stated, the only category of personal data involved is the user’s IP address, which is not collected to fetch user-level information or to target a specific user, but to enable the selection and serving and the technical delivery of an advertising that is relevant to a wide geographical area and in line with the language of the digital property’s content. Therefore, the core consequence of the processing of data based on legitimate interest is the display of contextual advertising within the Publisher’s digital properties (technical selection and delivery of content, exempt from frequency capping, click-based fraud prevention or similar tracking operations of any kind). Gameloft considers, from a vendor standpoint, that the possible impact is set to its minimum level. |
What safeguards can you put in place to minimize the impact? |
Regarding user’s experience, the collection of a limited set of technical information about the device enables Gameloft to ensure that the contextual advertising is served in formats that minimizes the disruption of the browsing or usage experiences of user’s on Publishers’ digital properties. Regarding data collection/access and processing operations, Gameloft’s Security standards and Data Breaches policies are applicable. In this sense, Gameloft has implemented technical and organizational measures to ensure the confidentiality, integrity and availability of the data, in transit and at rest. These measures apply to Gameloft’s servers, infrastructures, cloud storage instances and premises. In addition, Gameloft’s personnel undergoes privacy trainings and is subject to confidentiality rules and commitments. Gameloft also undertakes security and confidentiality commitments as part of its contractual relationship with each Publisher (including via Data Processing Agreements and EU Standard Contractual Clauses as applicable). |
Following the above balancing test, Gameloft is confident that the individual’s interests do not override the legitimate interests contemplated herein.
CONCLUSION. Following this Legitimate Interest Assessment, Gameloft confirms that:
- Legitimate interest is the most appropriate legal basis for the processing of end users’ personal data for displaying contextual in-game advertising operations encompassed within the IAB (Interactive Advertising Bureau) TCF Special Purpose 2 – “Deliver and present advertising and content”.
- In that sense, Gameloft confirms that the processing is necessary and that there is no less intrusive way or more relevant legal basis to achieve the same result.
- Furthermore, Gameloft confirms that end users’ data are processed in ways they would reasonably expect or in ways they would find intrusive or which could cause them harm.
- To the extent that Gameloft has not identified a significant privacy impact to this processing, it has not considered conducting a DPIA.
- Gameloft undertakes to monitor this LIA on a regular basis and to update it, shall the circumstances, including but not limited to the data processing methods, security measures and regulatory obligations, be evolving.
***