Consumer manipulation through online behavioural advertising
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Michèle Burnier / Nando Lappert / Simon Winkler Consumer manipulation through online behavioural advertising Technological progress and the rapidly increasing abundance of consumer data have significantly changed the pervasiveness and effectiveness of online behavioural advertising (OBA). Although the marketing concept of OBA is ver- satile and holds great potential for companies, it also entails legal risks with regard to consumers’ privacy and autonomy. This article aims to describe the practice and technology of OBA. Then, it aims to outline the possible limits of consumer manipulation by OBA under Swiss law. Category of articles: Articles Field of Law: Commercial criminal law (UWG, Cartel Act, BankG, FinIA); Data protection; IT and law Citation: Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising, in: Jusletter 2 August 2021 ISSN 1424-7410, jusletter.weblaw.ch, Weblaw AG, info@weblaw.ch, T +41 31 380 57 77
Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
Contents
I. Introduction
II. Online behavioural advertising
A. Definition
B. Process of OBA
1. Data collection
2. Data storage
3. Data analysis
4. Data disclosure
5. Targeting
III. Legal considerations
A. OBA and the revised Federal Act on Data Protection
1. Do Swiss data protection regulations apply to OBA?
2. Data protection barriers to manipulative OBA
2.1. Does OBA collide with data processing principles?
2.1.1. Transparency and fairness
2.1.2. Purpose limitation and proportionality
2.2. Does OBA qualify as automated decision making?
2.2.1. Decisions usually based on profiling
2.2.2. Legal effects or a similar significantly impairment
3. Interim conclusion
B. OBA and unfair competition
1. OBA as a particularly aggressive sales method
1.1. Does OBA qualify as sales method?
1.2. Does OBA impair consumers’ freedom of choice by being particu-
larly aggressive?
2. OBA as unfair mass advertising
2.1. Does OBA qualify as mass advertising?
2.2. Does OBA have a direct connection to requested content?
3. Relying on the general clause of Art. 2 UCA as a safety net?
IV. Conclusion
I. Introduction
[1] In recent years, the convergence of big data and the deployment of artificial intelligence (AI)
have significantly changed the pervasiveness and effectiveness of online behavioural advertising
(OBA). With the rapidly increasing volume and complexity of consumer data and the ubiquitous
use of learning algorithms, companies are nowadays able to develop extremely effective advertis-
ing strategies by identifying specific consumer responses to advertisements (ads).
[2] Although the marketing concept of OBA is versatile and holds great potential for companies, it
also entails legal risks with regard to consumers’ privacy and autonomy. Data harvesting business
models of large online platforms enable advertisers to create «filter bubbles» and to make use of
«nudges», meaning that the informational context is shaped in a way that steers consumers to
make predetermined decisions based on their online footprint.1 Further, the ability of AI to pro-
cess autonomously a vast amount of personal data, combined with the technology’s tendency to
opacity, reinforces potential negative effects for consumers and increases the information asym-
1 Federico Galli, Online Behavioural Advertising and Unfair Manipulation Between the GDPR and the UCPD,
in: Algorithmic Governance and Governance of Algorithms, Legal and Ethical Challenges, 2021, pp. 109–135,
p. 110.
2Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
metry between marketers and consumers.2 Customised ads, thus, do not only tend to interfere
with privacy, they can also restrict different options for consumers and take advantage of psycho-
logical traits and vulnerabilities.3
[3] In contrast to the situation in the EU4 , no explicit provisions on online advertising are in force
in Switzerland. Yet, this does not mean that OBA operates in a legal vacuum. Rather, it has to take
place in compliance with the existing applicable laws and regulations. This article is an attempt
to detect potential limits on consumer manipulation through OBA under Swiss law. Since Swiss
legal literature and jurisprudence have barely dealt with this topic so far, the subsequent deliber-
ations are intended to encourage the legal debate on this subject. To this end, the first section of
this article highlights the technical peculiarities of OBA. The following sections examine existing
limits of this marketing technique under the revised Federal Act on Data Protection (rDPA)5 and
the Federal Act against Unfair Competition (UCA)6 .
II. Online behavioural advertising
A. Definition
[4] Online behavioural advertising (OBA) is a marketing concept that is used in online advertis-
ing.7 OBA describes the practice of (i) monitoring and analysing individuals’ online behaviour
and (ii) using the collected information to predict the individuals’ interests and preferences and
to present the individuals with marketing messages they are likely to find relevant.8
[5] In a simplified example of OBA, four main parties are involved: internet users, website pub-
lishers, advertisers and ad networks/ad exchanges.9
2 See State Secretariat for Education, Research and Innovation, Herausforderungen der künstlichen Intelligenz,
Bericht der interdepartementalen Arbeitsgruppe «Künstliche Intelligenz» an den Bundesrat, 12/2019, p. 23 et
seqq. (cit. AI Report).
3 Galli, p. 110 et seq.
4 See Art. 24 of the Proposal for a Regulation of the European Parliament and the Council on a Single Market For
Digital Services (Digital Services Act) and amending Directive, COM(2020) 825 final, https://ec.europa.eu/digital-
single-market/en/news/proposal-regulation-european-parliament-and-council-single-market-digital-services-
digital (visited: 1 May 2021).
5 Revised Federal Act on Data Protection (rDPA), final text of 25 September 2020.
6 Federal Act against Unfair Competition of 19 December 1986 (UCA), SR 241.
7 Frederik J. Zuiderveen Borgesius, Singling out people without knowing their names – behavioural targeting,
pseudonymous data, and the New Data Protection Regulation, in: Computer Law & Security Review, 2016-32-2,
pp. 256–271, doi: 10.1016/j.clsr.2015.12.013 (cit. Borgesius-Singling); Sophie C. Boerman/Sanne Kruikemeier/
Frederik J. Zuiderveen Borgesius, Online behavioral advertising: a literature review and research agenda, in: Jour-
nal of Advertising, 46(3), 2017, pp. 363–376, p. 364.
8 Frederik J. Zuiderveen Borgesius, Improving privacy protection in the area of behavioral targeting, 2014, p. 28
(cit. Borgesius-Privacy); Aleecia M. McDonald/Lorrie Faith Cranor, An empirical study of how people perceive
online behavioral advertising, 2009, p. 1, https://www.cylab.cmu.edu/_files/pdfs/tech_reports/CMUCyLab09015.
pdf (visted: 1 May 2021); Boerman/Kruikemeier/Borgesius, p. 364.
9 Jun Wang/Weinan Zhang/Shuai Yuan, Display Advertising with real-time advertising (RTB) and behavioural tar-
geting, 2017, p. 8, https://arxiv.org/pdf/1610.03013.pdf (visited: 1 May 2021); Frederik J. Zuiderveen Borgesius,
Personal data processing for behavioural targeting: which legal basis, in: International Data Privacy Law, 2015-5-3,
pp. 163–176 (cit. Borgesius-Data).
3Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
B. Process of OBA
[6] The process of OBA can be divided into the following five phases.10
1. Data collection
[7] In the first phase, companies gather information about the online behaviour of users. To mon-
itor and track the online behaviour of users, companies rely largely on cookie technologies.11
Increased consumer demand for more privacy, however, has forced companies to consider using
other means of data collection. Therefore, other tracking technologies are already in use today
that allow the collection of data, including for example, flash cookies, server logs, web beacons,
device fingerprinting, or hashed e-mails.12
[8] By using tracking technologies, companies can gather detailed information about a user’s on-
line behaviour. Such information may include, for example, «web browsing data, search histories,
media consumption data (e.g. videos watched), app use data, purchases, click-through responses
to ads, and communication content, such as what people write in e-mails (e.g. via Gmail) or post
on social networking sites»13 as well as up-to-date location data of users’ mobile devices, trans-
action data, demographic data (e.g. gender, age, religion), or psychographic data (e.g. data about
an individual’s character).
2. Data storage
[9] In the second phase, companies store the collected data that is tied to a unique identifier such
as a cookie or a similar technology.14 Algorithms assign the stored data to individual users and
create individual user profiles containing the collected online behavioural data.15 These data col-
lected and stored in the user profiles allow companies to assess essential aspects of an individual
user in the process of profiling.16
[10] To enrich user profiles, companies may merge different data sets, for example, by tying data
collected on one device to data collected on another device (cross-device targeting), by adding
offline to online profiles (onboarding) or by syncing cookies, i.e. by combining the profiles of a
single user in database of two independent companies.17
10 Borgesius-Privacy, p. 24 et seq.
11 Boerman/Kruikemeier/Borgesius, p. 364.
12 For further information, see: Borgesius-Privacy, p. 47 et seq.
13 Boerman/Kruikemeier/Borgesius, p. 364; Jianqing Chen/Jan Stallaert, An economic analysis of online advertis-
ing using behavioral targeting, in: MIS Quarterly Vol. 38 No. 2, 2014, pp. 429–450, p. 430.
14 Borgesius-Privacy, p. 61; Aleecia M. McDonald/Lorrie Faith Cranor, An empirical study of how people perceive
online behavioral advertising, in: Proceedings of the 10’ workshop on privacy in the electronic society, 2010, p. 63
et seq.; Chang-Dae Ham/Michelle R. Nelson, The role of persuasion knowledge, assessment of benefit and harm,
and third-person perception in coping with online behavioral advertising, in: Computers in Human Behavior 62,
2016, pp. 689–702, p. 689.
15 Christoph B. Graber, Personalisierung im Internet, Autonomie der Politik und Service public, sic! 5/2017, pp.
257–270, p. 257; Rolf H. Weber, E-Commerce und Recht, Zürich 2010, p. 473.
16 David Rosenthal, Das neue Datenschutzgesetz, in: Jusletter 16. November 2020, N 24 (cit. Rosenthal-EDSG).
17 Vishal Sharma/Curtis Dyreson, Linksocial: Linking user profiles across multiple social media platforms, IEEE
International Conference on Big Knowledge (ICBK), 2018, pp. 260–267, doi: 10.1109/ICBK.2018.00042.
4Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
3. Data analysis
[11] In the third phase, to extract added value from the data collected, companies analyse this
data, for example, by using data mining practices. Companies may combine these data mining
techniques with statistical modelling and machine learning (ML) to construct audience clusters
called «lookalikes» or types of people with identical or similar traits and/or habits, and to create
predictive models.18
[12] In the context of OBA, the goal of predictive models is, based on the user’s historical online
behaviour, to answer the question of what type of products users might be interested in and what
advertising messages related to that product they might respond to.19 To capture and store the
insights into patterns and correlations in users’ online behaviour gained through computerised
data analysis companies typically use profiling.20
4. Data disclosure
[13] In a fourth phase, companies may share the gathered data with others, either by selling that
data or making it available in other ways, for example, by cookie syncing.21
5. Targeting
[14] In the fifth phase, companies target a user with an ad based on the information companies
have received about that user. Programmatic advertising supports this targeted display of suit-
able ads. In the process of programmatic advertising, AI is used to decide automatically and in
real time, which inventory, i.e. unsold digital ad space, to buy and how much to pay for it.22 AI
can then also be used in the concrete design of advertising, making ads better tailored and less
intrusive.
[15] To provide individuals with ads that are tailored to their needs and preferences, companies
often use the power of ad networks and ad exchanges. In simple terms, ad networks collect
inventory from publishers, sell this pool of inventory to advertisers and fill the inventory with
ads from the advertisers as required.23 This said, ad networks act as intermediaries between
advertisers and website publishers.
[16] On the other hand, ad exchanges are technology platforms focusing on automated, real-time
bidding (RTB) based buying and selling inventory without the involvement of any intermedi-
18 Steven Finlay, Predictive Analytics, Data Mining and Big Data, Myths, Misconceptions and Methods, Hampshire
2014, p. 2.
19 Eric Siegel, Predictive Analytics: The Power of Predict Who Will Click, Buy, Lie, or Die, New Jersey 2013, p. 26.
20 Federal Council Dispatch of 15 September 2017 concerning the total revision of the Federal Act on Data Protection
and the amendment of other regulations, 17.059, p. 7019 et seqq., p. 7021 (cit. BBl 2017 6941); Oliver Heuberger,
Profiling im digitalen Zeitalter, in: Profiling im Persönlichkeits- und Datenschutzrecht der Schweiz, LBR, Lucerne
2020, N 57 et seq.; for a comprehensive analysis regarding different profiling methods, see: Heuberger, N 103 et
seq.; diss. Rosenthal-EDSG, N 25: according to Rosenthal, profiling must be targeted at an individual person
rather than a group of people.
21 Borgesius-Privacy, p. 70 et seq.
22 Guido Nota La Diega, Some considerations on intelligent online behavioural advertising, in: Revue du droit des
technologies de l’information, 2017, No. 66–67, pp. 53–90, p. 82.
23 Maciej Zawadziski, What is an ad network and how does it work?, 2018, https://clearcode.cc/blog/what-is-an-ad-
network-and-how-does-it-work/ (visited: 1 May 2021).
5Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
aries.24 Ad exchanges aggregate inventory from multiple website publishers and ad networks
to balance the demand and supply in marketplaces. With real-time per-inventory buying es-
tablished along with cookie-based user tracking and syncing, the RTB ecosystem provides the
capability and infrastructure to fully unleash the power of OBA. Reduced to a highly simplified
form, an ad-serving process based on RTB looks as follows:
[17] When a user visits a website, the user’s web browser sends a request to the publisher’s web
server asking for the website content (i.e. HTML). The publisher’s web server returns the HTML
and begins rendering the website content. If the website content contains inventory, an ad request
is sent by the publisher’s ad server to an ad exchange via an ad network or a supply-side platform
(SSPs)25 along with details available about the user. The ad exchange queries demand-side plat-
forms (DSPs)26 for advertisers’ bids. If the advertiser or DSPs, based on the details received about
the user27 , decides to bid, the bid is automatically generated and submitted. The ad exchange
performs the auction and awards the inventory to the advertiser who submitted the highest bid.
Following the reverse path, the winning bidder’s ad is sent back to the publisher’s website and
displayed to the user.28
24 Wang/Zhang/Yuan, p. 4.
25 SSPs are technology platforms, which are connected to multiple publishers, either directly or through an ad net-
work. SSPs serve publishers by connecting their inventories with ad exchanges and demand-side platforms, accept-
ing bids from advertisers and serving ads automatically on publisher’s website.
26 DSPs are technology platforms, which serve advertisers by automatically bidding for ad request on various ad ex-
changes via algorithms. DSPs hold information from the buy side about criteria for the ad inventory needed, such
as data about the desired target audience or the maximum bid price.
27 User details may be enriched by extra user details provided by ad networks or data management platforms (DMPs).
DMPs are technology platforms, which collect, store and analyse user data they receive from various data suppli-
ers. DMPs use this data to create targeted audience segments and improve (real-time) matching.
28 Wang/Zhang/Yuan, p. 11.
6Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
[18] In the following, ad networks, ad exchanges, SSPs, DSPs, and DMPs are collectively referred
to as «ad platforms».
III. Legal considerations
A. OBA and the revised Federal Act on Data Protection
1. Do Swiss data protection regulations apply to OBA?
[19] The revised Federal Act on Data Protection (rDPA) only applies when personal data is pro-
cessed.29 Personal data means any information relating to an identified or identifiable natural
person.30 An identified or identifiable person is one whose identity results directly from the data
itself, from the context of the data, or through combination with other data. Under Swiss law,
the criteria of identifiability is not met if the data subject can only be identified with dispro-
portionate effort and it cannot be expected that an interested party would undertake this effort
(cit: BBl 2017 6941, 7019).
[20] As discussed under section II.B.1, in the context of OBA, cookies are primarily used for
tracking users’ online behaviour, collecting relevant data about it, and creating user profiles.
Cookies contain a unique code (the cookie ID) which allows websites and servers to distinguish a
particular browser from other browsers and to recognise each browser by its cookie ID. Although
it is therefore possible to determine and recognise a specific browser based on a cookie ID, it is not
possible to directly identify the person behind the cookie.31 Thus, analogous to IP addresses32 ,
cookies do not automatically qualify as personal data under Swiss law.33
[21] The information contained in a cookie ID may qualify as personal data if, in combination
with other data, it allows the identification of a specific data subject.34 In the age of big data, such
combination with other data has become much easier.35 This, because more data from different
29 Art. 2 para. 1 rDPA.
30 Art. 5 lit. a rDPA.
31 David Rosenthal, Personendaten ohne Identifizierbarkeit?, in: digma 2017, pp. 198–203, p. 200 (cit. Rosenthal-
Identifizierbarkeit).
32 BGE 136 II 508, c. 3.2 et seq. (Logistep): The Federal Supreme Court held that it is not possible to determine in the
abstract whether IP addresses are personal data or not. It took the position that a data subject is identifiable if its
identity can be inferred from an existing database on the basis of additional knowledge. However, not every theo-
retical possibility of identification is sufficient for identifiability. Rather, the data processor’s interest in identifica-
tion (subjective identifiability) and the associated effort (objective identifiability) must be taken into account. In the
specific case, the Federal Supreme Court came to the decision that both static and dynamic IP addresses qualified
as personal data; crit. Thomas Probst, Die unbestimmte Bestimmbarkeit der von Daten betroffenen Personen im
Datenschutzrecht, in: AJP 2013, pp. 1423–1436, p. 1426: Probst is of the opinion that IP addresses per se are not
personal data, but that the data subject can be identified by linking IP addresses to other personal data.
33 Michael Isler, Meine Daten machen meinen Preis, in: digma 2015, pp. 18–23, p. 19; David Rosenthal, in: David
Rosenthal/Yvonne Jöhri (eds.), Handkommentar zum Datenschutzgesetz, Zurich 2008, Art. 45c TCA N 11 (cit.
Rosenthal-Handkommentar).
34 Roland Mathys/Christian Meier, Tracking – rechtliche Standortbestimmung, in: digma 2014, pp. 156–160,
p. 157; Roland Mathys/Helen Reinhart, Bestimmung von Vertragskonditionen im Rahmen automatisierter
Entscheidungen, in: SZW 2020, pp. 35–42, p. 37; Rolf H. Weber, E-Commerce und Recht, Zurich 2010, p. 436;
Rosenthal-Handkommentar, Art. 45c TCA N 11.
35 Mireille Hildebrandt, Defining Profiling: A New Type of Knowledge?, in: Mireille Hildebrandt/Serge Gutwirth
(eds.), Profiling the European Citizen, Cross-Disciplinary Perspectives, Belgium/Holland 2008, pp. 17–30, p. 20
et seq. (cit. Hildebrandt-Defining Profiling); Gabor-Paul Blechta, in: Urs Maurer-Lambrou/Gabor-Paul Blechta
(eds.), Basler Kommentar, Datenschutzgesetz, 3rd edition, Basel 2014, Art. 3 N 11; Heuberger, N 103.
7Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
sources (e.g. social network user profile, location data, device data, etc.) are available that can be
combined and merged with other data sets. In addition, with increasingly powerful processing
mechanisms such as big data analytics and, in general, learning algorithms, the identity of users
can often be determined by analysing large amounts of data linked to IP addresses and other
seemingly anonymous data, such as cookies.
[22] Against this background, the effort required by companies using OBA to identify a single
user based on a cookie ID no longer appears to be disproportionate. Accordingly, cookies used
for the purpose of OBA and linked to user profiles are to be considered personal data from the
point in time when the respective cookie is collected.36 As a result, OBA practices are subject to
Swiss privacy legislation.37
2. Data protection barriers to manipulative OBA
[23] Although OBA itself is not a data processing activity, it qualifies as a commercial practice
entailing different kinds of data processing activities. Under Swiss law, data processing activities
are permitted if they comply with the data processing principles.38 In contrast to the European
General Data Protection Regulation (GDPR), not every data processing requires justification un-
der Swiss law, but only if it leads to an invasion of privacy due to non-compliance with the data
processing principles.39 As data controllers40 , ad platforms are obliged to ensure compliance with
these data processing principles, and in general, with the applicable data privacy provisions.41
[24] In the context of OBA and consumer manipulation, the data processing principles of trans-
parency, purpose limitation, and proportionality appear to be of central importance.
2.1. Does OBA collide with data processing principles?
2.1.1. Transparency and fairness
[25] The rDPA requires that personal data is processed fairly, i.e. in good faith.42 This raises the
question of what «fair processing», or, in general terms, what «good faith» means in the context
of data protection law and, in particular, in relation to commercial settings such as OBA.
[26] From a data protection perspective, fairness requires transparency. In the rDPA, trans-
parency is created by imposing various information obligations on the data controller. These
obligations shall ensure that the data subject recognises the use of tracking technologies on a
particular website. Since such use is usually not evident from the specific circumstances, data
controllers must actively inform the data subjects about the type, scope and purpose of the track-
ing, the identity of the data controller, the recipients to whom the data is disclosed, and the
36 BGE 136 II 508, c. 3.4.
37 Regarding the problem of re-identification in case of anonymised data, see: Heuberger, N 129 et seqq.
38 Art. 30 para. 2 lit. a rDPA e contrario.
39 Art. 31 para. 1 rDPA.
40 Art. 5 lit. j rDPA.
41 Regarding the qualification under the GDPR, which applies the same concept, see: Galli, p. 114.
42 Art. 6 para. 2 rDPA.
8Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
possibility to opt out of such processing.43 The data controller must also provide information
about the collection of data if the data is collected not from the data subject directly, but from
a third party, for example, a DMP.44 This information must generally be provided at the time of
data collection.45
[27] The information provided to the data subject must be sufficiently detailed. Based on this
information, for example, data subjects must be able to recognise that their data is being used
for marketing purposes. Further, data subjects must also understand the concept of targeting.
i.e. it must be apparent to them that their data is being processed in order to provide them
with personalised ads tailored to their preferences and interests.46 On the other hand, it is not
necessary to provide information on the criteria and methods according to which the ad messages
are personalised. Merely stating that the data will be processed for «direct marketing» purposes,
for example, is likely not sufficient. With regard to the information on the recipients of the data,
one should consider that various parties are involved in the process of placing advertisements,
which makes the flow of data complicated and hardly predictable in advance. This makes it
virtually impossible to inform data subjects at the time of data collection what will happen to
their data and to which recipients it will be passed on if it is used for OBA.47
[28] It should be considered whether the principle of fairness might protect consumers more
appropriately if this principle is examined from a more commercial perspective. Accordingly,
the principle of acting in good faith could be understood as a standard of conduct, which is
characterised by honesty, loyalty and consideration for the interests of the other party. Following
this principle, at a very general level, fair processing could be understood as data processing
carried out with a view to balancing the commercial interests of the data controller against the
interests and legitimate expectations of the data subjects (in the sense of mutual respect).48 In
this light, data processing in the context of OBA should not have a disproportionate impact on
the data subject.
[29] Having said this, and following the concept of unfair competition law, the understanding of
the principle of fairness could be widened to include not only how the data is processed, but also
what (unfair or manipulative) effects the data processing potentially has on the data subject.49
According to such an understanding, the principle of fairness might represent an implicit safety
net to protect data subjects against manipulative advertising.50
43 Art. 6 para. 2 and 3, Art. 19 rDPA; Art. 45c Telecommunication Act (TCA); Bruno Baeriswyl, in: Bruno Baeriswyl/
Kurt Pärli (eds.), Stämpflis Handkommentar, Datenschutzgesetz (DSG), Bern 2015, Art. 4 N 49; Mathys/Meier,
p. 158.
44 BBl 2017 6941, 7050.
45 Art. 19 para. 2 rDPA, but see Art. 19 para. 5 rDPA.
46 Regarding the recognisability of data processing in private insurance policies, see Florent Thouvenin, in: Pri-
vatversicherungen: Datenschutz als Grenze der Individualisierung?, Zurich 2019, pp. 15–42, p. 33.
47 Borgesius-Privacy, p. 73.
48 Borgesius-Privacy, p. 156; see Benjamin Schindler, in: Bernhard Ehrenzeller et al. (eds.), St. Galler Kommentar,
Die Schweizerische Bundesverfassung, 3rd edition, Zurich 2014, Art. 5 N 55.
49 Galli, p. 117.
50 Galli, p. 117; Borgesius-Privacy, p. 156.
9Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
2.1.2. Purpose limitation and proportionality
[30] According to the principle of purpose limitation, personal data may only be collected for
a specific purpose that is evident to the data subject and may only be processed in a way that
is compatible with such purpose.51 The principle of proportionality52 states that the data pro-
cessed must be suitable and necessary to achieve the purpose pursued by the processing.53 The
principles of data minimisation and storage limitation derive from this principle. Accordingly,
the processing of personal data must be limited to the extent necessary for the purposes of the
processing. Further, the data must be deleted as soon as it no longer appears necessary for these
purposes.54
[31] The principles of purpose limitation, data minimisation, and storage limitation conflict di-
rectly with OBA, which is largely based on the concept of big data.55 Big data follows the ap-
proach that analysing more data leads to better insights, e.g. better insights into users’ online
behaviour. This directly contradicts the principle of data minimisation and storage limitation
because deleted data is no longer available for future analysis.56 There is also a fundamental con-
tradiction with purpose limitation because big data is based on gaining new insights by analysing
data for purposes completely different to those for which it was originally obtained.57 A transpar-
ent description of the purpose of the data processing carried out in the context of OBA over the
entire lifecycle of data is hardly possible. Depending on the specific context of use, the informa-
tion content of the data can change dynamically, can alternately have a personal quality and then
lose it again.58 For this reason, the correlations between data required for profiling, for example,
are hardly compatible with the principle of purpose limitation.59
[32] In this regard, however, it must be considered that data controllers may process data for
another new (secondary) purpose if this new purpose is compatible with the purpose for which
the personal data was initially collected.60 Further processing is not permitted if the data subject
may legitimately consider it unexpected, inappropriate or objectionable.61 This said, using data
to create a user profile in order to provide the user with personalised ads is unlikely to be compat-
ible with an original purpose of processing, unless the user was informed of this possibility when
the data was collected or the secondary purpose of use was apparent from the circumstances.62
In general, in view of the manipulative power of OBA, one must consider whether the further use
of the data for the purpose of OBA is «objectionable» from the user’s point of view and thus per
se not permitted.
51 Art. 6 para. 3 rDPA; Rosenthal-EDSG, p. 14.
52 Art. 6 para. 2 rDPA.
53 Baeriswyl, Art. 4 N 21.
54 Thouvenin, p. 31.
55 Baeriswyl, Art. 4 N 39.
56 Thouvenin, p. 31.
57 Thouvenin, p. 31.
58 Federal Department of Finance (FDF), Report of the Expert Group on the Future of Data Processing and Data Se-
curity of 17 August 2018, p. 77, https://www.newsd.admin.ch/newsd/message/attachments/53591.pdf (visited:
1 May 2021).
59 Heuberger, N 69.
60 Art. 6 para. 3 rDPA.
61 BBl 2017 6941, 7025.
62 BBl 2017 6941, 7025; Rosenthal-EDSG, N 36.
10Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
[33] In view of the aforementioned fundamental contradictions, the use of big data in the context
of OBA inevitably leads to a violation of the principles of purpose limitation and proportionality.
In the context of OBA, data processing is thus only permissible if the data controller can base the
data processing on a sufficient justification or if strict anonymisation can be guaranteed, what is
of course not the aim of OBA.
2.2. Does OBA qualify as automated decision making?
[34] As illustrated above, OBA represents one of the most pervasive online experiences of solely
automated decision making.63 With the RTB ecosystem on which OBA is largely based, the rel-
evant data processing and transactions take place within a few milliseconds. No human could
ever be involved in the process without making the entire operation completely inefficient and
ineffective for its purpose.64
[35] Despite its characteristics, it is necessary to assess whether OBA is a decision based solely on
automated processing that produces legal effects concerning data subjects or significantly affects
them and is thus subject to the provisions on automated decision making under the rDPA.65
2.2.1. Decisions usually based on profiling
[36] In order to speak of a decision in the context of data protection law, a certain attitude or
stance towards a data subject must be taken with some degree of binding effect that a corre-
sponding behaviour of the data subject is to be expected.66 Given the primary purpose of OBA
to entice the recipient to immediately click on the ad served to him or her, it appears that OBA is
by definition a stance or attitude that is likely to be acted upon immediately.67 Furthermore, this
decision also qualifies as an «automated» decision. Based on an evaluation of personal data avail-
able, the machine makes a decision at its sole discretion as to which ad to display to a particular
user. There is no human intervention.68
[37] In the context of OBA, this automated decision making is usually based on profiling69 . Pro-
filing describes a process that concerns the automated evaluation of essential aspects of a person
or a group of people.70 The basis for profiling is AI technologies. Self-learning algorithms use
statistical analysis to automatically identify correlations between data. These correlations are
used to analyse and evaluate certain characteristics, online behavioural patterns, preferences, or
63 Michael Veale/Lilian Edwards, Clarity, surprises, and further questions in the Article 29 Working Party draft
guidance on automated decision-making and profiling, Computer Law & Security Review, Vol. 34, 2018,
pp. 398–404, p. 401; La Diega, p. 65.
64 Galli, p. 117.
65 Art. 21 para. 1 rDPA.
66 Isak Mendoza/Lee A. Bygrave, The right not to be subject to automated decisions based on profiling, EU internet
law: regulation and enforcement, Berlin 2017, pp. 77–98, p. 87.
67 Galli, p. 118.
68 BBl 2017 6941, 7056 et seq.
69 Art. 5 lit. f and g rDPA.
70 BBl 2017 6941, 7021; Heuberger, N 57 et seq.; for a comprehensive analysis regarding different profiling methods,
see: Heuberger, N 103 et seq.; diss. Rosenthal-EDSG, N 25: according to the author, profiling must be targeted at
an individual person rather than a group of people.
11Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
interests of a person or a group of people in real time.71 Further, they are used to identify, in-
dividualise, and represent a subject or a subject as a member of a group or category.72 Based
on this, predictive models are created which are personalised to individual persons or groups of
people, showing developments in the named peculiarities.73 As a result, patterns can be discov-
ered that allow conclusions to be drawn about a person’s or a group of people’s possible future
behaviour.74 As a result, profiling and the creation of predictive models enable companies to
serve targeted ads not only to individual users, but also to entire groups of people with similar
and identical interests.
[38] In the context of profiling, links between data and information are constantly changing de-
pending on the context and purpose of the data processing. Data can be alternately enriched
with other data in the course of its lifecycle, which dynamically changes the information content
as well as the legal qualification of such data. This said, data can be anonymised, pseudonymised
and, depending on the context of use, linked again to a particular person.75 Given such a dynamic
data lifecycle, it is hardly possible for someone to determine whether a particular ad or, in general
terms, a context of a decision has been customised to his or her particular interests. Profiling thus
reinforces the danger that companies will register and categorise people’s personalities in whole
or in part. With profiling, the personality of a person is more measurable and predictable, and
consequently easier to manipulate.76
[39] Although profiling entails a high risk of consumer manipulation, the rDPA does not provide
for a general consent requirement in case of (high-risk) profiling.77 The same applies if sensitive
personal data derive or infer from profiling activities.78 Although it is possible to use OBA with-
out processing sensitive personal data, profiling can regularly create sensitive personal data by
inference from data which is not sensitive personal data in its own right but becomes so when
combined with other data.79 Correlations can be discovered in the existing data that reveal quite
easily details about people’s health, religious beliefs, or sexual orientation. For example, a study
showed that combining Facebook likes with limited survey information was sufficient to correctly
predict a male user’s sexual orientation in 88 % of cases, a user’s ethnicity in 95 % of cases, and
membership of a Christian or Muslim faith community in 82 % of cases.80
71 Heuberger, N 15, 57.
72 Mireille Hildebrandt et al., in: Mireille Hildebrandt/Serge Gutwirth (eds.), Profiling the European Citizen:
Cross-disciplinary perspectives, Cogitas, Ergo Sum: The Role of Data Protection Law and Non-discrimination Law
in Group Profiling in the Private Sector, Belgium/Holland 2008, pp. 241–270, p. 241.
73 Heuberger, N 59, 207; Roland Mathys, Big Data in der Rechtspraxis, pp. 95–102, p. 99.
74 Thierry Nabeth, in: Mireille Hildebrandt/Serge Gutwirth (eds.), Profiling the European Citizen: Cross-discipli-
nary perspectives, Reply: Further Implications?, Belgium/Holland 2008, pp. 30–34, p. 31.
75 FDF’s Report, p. 77.
76 Yvonne Prieur, Datenschutz durch «Big-Data-Geschäfte» auf dem Prüfstand, in: AJP 2015, pp. 1643–1653,
p. 1645.
77 David Vasella, Neues DSG: kein grundsätzliches Einwilligungserfordernis beim Profiling, auch nicht bei hohem
Risiko, in: datenrecht.ch, 25. September 2020; Rosenthal-EDSG, N 28, 31; diss. Heuberger, N 212.
78 Art. 5 lit. c rDPA; Rosenthal-EDSG, N 32.
79 Article 29 Data Protection Working Party, Guidelines on automated individual decision-making and profiling
for the purposes of Regulation 2016/679, WP 251rev.01, 2017, p. 22, https://ec.europa.eu/newsroom/article29/
item-detail.cfm?item_id=612053 (visited: 1 May 2021); Borgesius-Privacy, p. 196.
80 Michael Kosinski/David Stilwell/Thore Graepel, Private traits and attributes are predictable from digital
records of human behavior, Proceedings of the National Academy of Sciences of the United States of America,
2013, http://www.pnas.org/content/110/15/5802 full.pdf (visited: 1 May 2021).
12Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
[40] Notwithstanding the above, justification is required if sensitive personal data is disclosed
to third parties.81 Since user profiles usually contain sensitive personal data or at least allow
conclusions to be drawn about such data, and user profiles are passed on to third parties in the
context of OBA, the OBA process requires justification in most cases for this reason alone.
2.2.2. Legal effects or a similar significantly impairment
[41] According to the statutory provision, the existence of an automated decision does not re-
quire the data subject to be informed per se. The data subject is only entitled to information if this
automated decision has a legal consequence for, or significantly affects, the data subject. A legal
consequence is always assumed if the legal position of the person concerned is changed, or a right
or legal relationship is established, revoked or interfered with. Usually, OBA does not have direct
legal consequences for the person concerned, since advertising is not a command and, therefore,
can be ignored or even blocked.82 At most, the persons concerned cause legal consequences them-
selves, for example, if they follow a personalised ad or purchase recommendation and conclude
a purchase on their own.83 To be considered, however, is whether OBA in its most subtle and
manipulative forms significantly affects the data subject within the meaning of the rDPA.
[42] Data subjects are considered to be significantly affected if, for example, their economic or per-
sonal interests are permanently restricted.84 However, from a data protection perspective mere
harassment is not sufficient.85 In assessing whether a significant impairment exists, one should
consider whether the decision materially affects an individual’s legal interest, has a prolonged
or permanent impact on the data subject, or does not grant the data subject any alternatives.86
Further, it could be assessed whether a decision has the potential to significantly affect the cir-
cumstances, behaviour or choices of the individuals concerned.87 «Circumstances, behaviour or
choices» are recurring terms used from advocates of «libertarian paternalism»88 or «nudging»89 .
Both theories aim to exploit irrational tendencies in the human decision-making process in order
to induce individuals to make a certain decision. In doing so, an online context is shaped in which
consumers are driven to behave in a certain way, while still technically being capable of resisting
such external intervention.
[43] Today, access to big data and the use of AI and ML allow this nudging to be highly person-
alised. Based on proven or inferred knowledge about the psychology of consumers, companies
can strategically place nudges correctly and in an environment tailored to the individual con-
81 Art. 30 para. 2 lit. c rDPA.
82 Galli, p. 118.
83 Dirk Spacek, Personalisierte Medien und Unterhaltung, in: sic! 7|8/2018, pp. 377–392, p. 388.
84 BBl 2017 6941, 7057.
85 BBl 2017 6941, 7057.
86 BBl 2017 6941, 7057.
87 Article 29 Data Protection Working Party, p. 21.
88 Cass R. Sunstein/Richard H. Thaler, Libertarian Paternalism, in: American Economic Review, Vol. 93 No. 2,
2003, pp. 175–179.
89 Cass R. Sunstein/Richard H. Thaler, Nudge: Improving decisions about health, wealth and happiness, New York
2009; see also Jörn Basel/Marco S. Meier, Nudging: rechtliche Grauzone und moralische Fallstricke, in: Jusletter
21. September 2020, N 5 et seqq.
13Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
sumer (e.g. «nudging for profit»90 and «choice architecture»91 ). Thus, with the help of sugges-
tions, indirect cues or changes in environmental information, motives, incentives and decisions of
the individual are influenced and steered in a predictable direction. It goes without saying, then,
that OBA reinforces individuals’ existing behaviours and opinions by continuously showing them
content in environments that match their previous behaviours and opinions. As a result, individ-
uals are significantly impaired in their freedom of opinion formation and behavioural control.
Against this background, it seems reasonable that OBA has at least «the potential to significantly
affect the circumstances, behaviour or choices of the individual concerned»92 .
[44] Notwithstanding this, a «soft»93 OBA, in which a computer places ads based on a known pro-
file, is unlikely to be sufficient to significantly affect the individual concerned within the meaning
of the law.94 On the other hand, some particular forms of «strong»95 OBA may have such an effect
on the individual, depending on the particular characteristics of the case, including «the intru-
siveness of the profiling process, including the tracking of individuals across different websites,
devices and services; the expectations and wishes of the individuals concerned; the way the advert
is delivered; or using knowledge of the vulnerabilities of the data subjects targeted»96 .
[45] Such strong OBA can be considered automated decision making.97 Unless there are legal
exceptions98 , this has two legal consequences. First, the data subject must be actively informed
by the data controller. Among other things, the data subject has the right to be informed about the
logic of the decision and the consequences of the data processing.99 However, it may be difficult
for the data controller to fully inform the data subject about the logic when OBA is based on AI
and ML technologies. In the case of AI, the system is not given the algorithm to follow, but the
desired result of the data analysis and a sufficiently large amount of training data. The system
independently develops an algorithm that is not conclusively comprehensible, which leads to the
desired result even outside the training data.100 Second, the data subject has the right to have the
decision reviewed by a human being.
3. Interim conclusion
[46] It follows from the foregoing that OBA is unlikely to comply with the data processing prin-
ciples. This does not mean that OBA per se would constitute unlawful data processing. What is
required, however, is that the data processing activities within OBA be justified. In this context,
the consent of the data subject appears to be the relevant reason of justification. In this respect,
90 Ryan Calo, Digital Market Manipulation, in: George Washington Law Review 82, 2013, pp. 995–1051, p. 1001.
91 Daniel Susser, Invisible Influence: Artificial Intelligence and the Ethics of Adaptive Choice Architecture, in: AIES
’19: Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society, Honolulu 2019, pp. 403–408.
92 Galli, p. 119.
93 Galli, p. 119.
94 Rosenthal-EDSG, N 109; Adrian Bieri/Julian Powell, Informationspflicht nach dem totalrevidierten Daten-
schutzgesetz, in: AJP 2020, pp. 1533–1542, p. 1539; Article 29 Data Protection Working Party, p. 22.
95 Galli, p. 119.
96 Article 29 Data Protection Working Party, p. 22.
97 Galli, p. 119.
98 Art. 21 para. 3 rDPA.
99 Rosenthal-EDSG, N 112.
100 Louisa Specht/Sophie Herold, Roboter als Vertragspartner: Gedanken zu Vertragsabschlüssen unter Einbeziehung
automatisiert und autonom agierender Systeme, in: Multimedia und Recht 1/2018, pp. 40–44, p. 40.
14Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
it is questionable to what extent the data subjects concerned can give informed consent to all
relevant data processing.
[47] One should consider, for example, the case of RTB, in which data is largely exchanged «be-
hind the scenes» between the parties involved in the process. It is doubtful whether an ad plat-
form may obtain express consent from the data subject concerned to all relevant data processing
and, in particular, to the disclosure of (sensitive) personal data on the basis of sufficient infor-
mation.101 Moreover, it is debatable whether informed consent is per se capable of sufficiently
protecting individuals from the complexity of data processing in the context of OBA and the
power of modern analytics in general.102
[48] Further, it is controversial whether OBA can be justified by an overriding private interest,
e.g. by the necessity in view of the conclusion or performance of a contract.103 In this regard, it
should be noted that OBA is not necessarily required in order to conclude a contract, but is used
to increase the chances of such a contract being concluded by a particular consumer. Since justifi-
cation must be applied with great caution104 , it should not be sufficient that the data processing is
merely suitable and useful for the performance of a contract. Rather, the data processing must be
objectively necessary or, in case of strict interpretation, be indispensable for such performance.105
[49] This said, data controllers might also invoke an overriding private interest when they process
anonymised or pseudonymised data for non-personal purposes, such as scientific or statistical
purposes.106 Companies engaged in OBA could try to claim that predictive modelling for OBA is
a form of statistical analysis, which can be based on this justification.107 If this argument were to
be heard, data controllers would nevertheless have to comply with the data processing principles
when processing data, for instance when collecting data.108
[50] In light of the above, it seems urgent to conduct further research to determine whether and
to what extent OBA complies with data protection regulations. In doing so, it seems impor-
tant to make a more specific and technology-aware delineation of the practices that result in be-
havioural advertising having a similarly significant impact on data subjects (i.e. strong OBA).109
However, this step should likely take a holistic approach and also consider consumer protection
standards.110
101 Galli, p. 121.
102 Bert-Jaap Koops, The trouble with European data protection law, in: International Data Privacy Law, Vol. 4 No. 4,
2014, pp. 250–261, p. 251 et seqq.; Alessandro Mantelero, The future of consumer data protection in the E.U.
Re-thinking the «Notice and Consent» paradigm in the new era of predictive analytics, in: The Computer Law and
Security Review, Vol. 30 No. 6, 2014, pp. 643–660.
103 Art. 31 para. 2 lit. a rDPA (justification), Art. 21 para. 3 lit. a rDPA (automated decision making).
104 BGE 136 II 508, c. 5.2.4.
105 Heuberger, N 381.
106 Art. 31 para. 2 lit. e rDPA.
107 Borgesius-Privacy, p. 154.
108 Regarding the problem of re-identification in case of anonymised data, see: Heuberger, N 129 et seqq.
109 Galli, p. 121.
110 Galli, p. 121.
15Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
B. OBA and unfair competition
[51] In Europe, concern is increasingly being voiced111 that OBA might be in conflict with the
European Unfair Commercial Practice Directive (UCPD)112 . With the UCA, Switzerland has a
similar law in force. The UCA ensures fair and undistorted competition in the interest of all
parties involved, i.e. competitors, consumers, and the general public.113
[52] The UCA includes on the one hand a general «catch-all» clause in Art. 2 UCA, which leaves
leeway for the development of the law. On the other hand, the UCA includes special provisions
in Art. 3–8 UCA to combat unfair competition effectively.114 While violations of both the general
clause and the special provisions can be enforced under civil law, only violations of the special
provisions are subject to criminal prosecution. Systematically, the application of the special pro-
visions take precedence over the general clause of Art. 2 UCA (lex specialis derogat legi generali).115
[53] In the context of OBA, it is important to differentiate between possible unfairness caused by
the ultimate purpose of the OBA method itself – to steer consumers to make certain decisions
based on their online footprints – and unfairness caused by accompanying technologies deployed
within the scope of OBA, such as deceptions through deep fakes116 . This paper focuses on the
former, namely on the impairment of consumers’ freedom of choice by exploiting their psycho-
logical traits and weaknesses. Against this background, Art. 3 para. 1 lit. h and o UCA are of
particular interest.
1. OBA as a particularly aggressive sales method
[54] Art. 3 para. 1 lit. h UCA intends to protect the freely formed will of consumers, stating that
it is unfair to interfere with the customer’s freedom of choice by using any particular aggressive
sales method. Advertising methods, however, are not covered by the provision117 but are covered
by the general provision (art. 2 UCA).118
111 See Natali Helberger, Profiling and targeting consumers in the Internet of Things – a new challenge for consumer
law, 2016, p. 16 et seqq., https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2728717 (visited: 1 May 2021);
Galli, p. 121 et seqq.
112 Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-
to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Direc-
tives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC)
No 2006/2004 of the European Parliament and of the Council (Unfair Commercial Practices Directive), https://
eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32005L0029 (visited: 1 May 2021).
113 Art. 1 UCA; for further information on the purpose of the UCA, see Peter Jung/Philippe Spitz (eds.), Bundesgesetz
gegen den unlauteren Wettbewerb (UWG), 2nd edition, Bern 2016, Art. 1 N 1 et seqq. (cit. SHK UWG-Author).
114 SHK UWG-Jung, Art. 2 UWG N 1.
115 BGE 131 III 384 c. 3; SHK UWG-Jung, Art. 2 UWG N 4.
116 New technologies can provide online advertisers various new possibilities to delude consumers in subtle ways.
For instance, a 2018 Zalando campaign featuring model Cara Delevingne was carried out by using deepfake tech-
nology to create various alternative shots and voice fonts in order to micro-target consumers (see https://www.
voguebusiness.com/companies/how-deepfakes-could-change-fashion-advertising-influencer-marketing (visited:
1 May 2021); https://www.nytimes.com/2020/04/22/business/media/espn-kenny-mayne-state-farm-commercial.
html (visited: 1 May 2021).
117 BGE 132 III 414; Andreas Furrer/Martina Aepli, in: Reto Heizmann/Leander D. Loacker (eds.), UWG Kommen-
tar, Bundesgesetz gegen den unlauteren Wettbewerb, Zurich/St. Gallen 2018, Art. 3 para. 1 lit. h N 11.
118 Urs Wickihalder, in: Reto M. Hilti/Reto Arpagaus (eds.), Basler Kommentar, Bundesgesetz gegen den unlauteren
Wettbewerb (UWG), Basel 2013, Art. 3 para. 1 lit. h N 4 (cit. BSK UWG-author).
16Michèle Burnier / Nando Lappert / Simon Winkler, Consumer manipulation through online behavioural advertising,
in: Jusletter 2 August 2021
1.1. Does OBA qualify as sales method?
[55] The term sales method is relatively broad. In doctrine, the individual, personal approach to
the consumer is used to distinguish sales methods from advertising methods, as this forces the
customer to react quickly.119 In the opinion of the Federal Supreme Court, the decisive factor is
that the seller’s conduct is in itself suitable to lead directly to the conclusion of a contract.120 Thus,
the term «sales method» is not to be understood in a technical sense. Art. 3 para. 1 lit. h UCA
covers not only the conclusion of sales contracts, but also other legal transactions, such as con-
tracts, in which consumers «pay» with their personal data.121 A personal face-to-face approach
to the consumer is not necessary. Furthermore, it is not relevant how a method is designated,
meaning that labelled «telephone advertising» or «direct advertising» may also qualify as a sales
method.122
[56] In contrast to sales methods, advertising methods are not specifically directed at a consumer,
but at the general public. Advertising is defined as any public statement made with the purpose
of promoting the sale of goods or services or with the purpose of achieving any other effect. The
fact that the individual consumer has the opportunity to prepare for contract negotiations after
becoming aware of the advertising is particularly relevant for the delimitation between advertis-
ing and sales methods. Advertising methods therefore do not enable a direct feedback possibility,
which would impose an immediate reaction on the consumer or even allow it.123
[57] The principles of the Swiss Commission of Fair Trading address aggressive sales methods
in connection with distance selling (i.e. mail, telephone, e-mail, SMS, instant messaging ser-
vices, social media platforms, internet, etc.).124 Principle C.4 clarifies that for distance selling,
commercial communication methods qualify as sales methods if they are directed at individual
persons by means of personal address (e.g. personal e-mail with a specific content). In contrast,
commercial communication methods qualify as advertising methods if they are addressed to an
unspecified group of persons (e.g. spam e-mails) or addressed to personal address but with the
same standard content.125
[58] Although OBA is designated as an advertising method, it does not fulfill the distinguishing
characteristics of an advertising method, namely being directed at the general public. On the
contrary, OBA is personalised to consumers’ individual situation and preferences based on their
behaviour, preferences, needs and emotions. Pursuant to principle C.4, the personalisation of
the communication is a clear indication that OBA should be considered as a sales method. In
addition, OBA often allows a direct feedback possibility for consumers as the conclusion of a
contract is often just a few clicks away. In this case, the decisive temporal and objective distance
119 BSK UWG-Wickihalder, Art. 3 para. 1 lit. h N 6; Furrer/Aepli,Art. 3 para. 1 lit. h N 11.
120 Judgment of the Federal Supreme Court 6S.357/2002 of 18 December 2002, c. 3.1.; see also judgment of the
lower court: ZGGVP 2002, pp. 193 et seqq., p. 193; see also implicitly judgment of the Federal Supreme Court
6S.377/2001 of 16 May 2002, c. 4b.
121 SHK UWG-Oetiker, Art. 3 para. 1 lit. h N 7.
122 Furrer/Aepli, Art. 3 para. 1 lit. h N 11; SHK UWG-Oetiker, Art. 3 para. 1 lit. h N 5.
123 Furrer/Aepli, Art. 3 para. 1 lit. h N 12.
124 See https://www.faire-werbung.ch/wordpress/wp-content/uploads/2019/05/SLK-Grundsaetze_DE-1.1.2019.pdf
(visited: 1 May 2021).
125 See also Markus Spielmann, Unlauterer Wettbewerb im Internet, Diss., Bern 2001, p. 35, http://www.aarejura.ch/
download/wettbewerb_im_internet.pdf (visited: 1 May 2021).
17You can also read
