As I worked on developing the “follow the governance” approach and methodology, I looked into “online advertising & personal data” as a pilot topic to help me test and refine the methodology tools I was coming up with.

The use and abuse of people’s data by big tech companies that make a lot of money by selling that to advertisers (like Alphabet, which owns Google and YouTube, and Meta, which owns Facebook, Instagram and WhatsApp) is a topic very much present in the news and as an object of investigations by the media.

Yet, I believe most people, me included, don’t really know — much less understand — the governance system behind online advertising and personal data.

• who, legally or factually, own the data people generate through their online activity?
• who owns the physical infrastructure that allows and powers the internet (e.g. those undersea cables and those huge data centres that host the information we are told is “in the cloud”)?
• who are the intermediaries between advertisers (companies selling stuff) and online advertising platforms (Google, YouTube, Facebook, Instagram, TikTok…) and how does the whole thing work?
• who and when started collecting people’s personal data as they browsed the internet? How was that regulated — or was it simply not regulated at all?
• what are the current regulations in Europe about that?
• what are the established practices and who benefits from them and who loses out?

And those are just a few questions that quickly come to mind when one starts thinking about online advertising and people’s data through the “follow the governance” perspective.

During the preliminary research, I found out some potentially relevant leads and research questions to follow:

• different types of companies (advertisers from different sectors, early online platforms, tech infrastructure companies) started experimenting with online advertising in 1994
• traditional advertising regulation didn’t apply to the web by then
• benefiting from the lack of regulation, corporate actors started issuing standards and other codes to self-regulate themselves, which then became established practices and influenced future actual regulation
• the companies started collecting people’s personal data almost immediately — how many people clicked on an ad, how long it took them to click once the ad was served, how much time the person spent on the webpage open by the ad —, which quickly became an established practice, with a whole new business developing around that
• public authorities have struggled and keep struggling to regulate such personal data collection and processing
• the surrendering of personal information — and sometimes also labour — to online platforms for free quickly became normalised, and perceived by many as an integral part of ‘how the web works’
• indeed, the way the web has developed — towards content produced and uploaded by the users (the so-called web 2.0) and then towards an online ecosystem dominated by digital platforms that make money out of online advertising and hoarding people’s data — seems to be a direct consequence of those first experiments with online advertising and the collection of personal data
• the business of online and digital targeted advertising has contributed to the development and spread of dis- and misinformation

Those are just some points that start making sense as a coherent story as one researches the governance system and its recent history.

As of July 2024, I am planning to continue this research, and I am also now thinking of the best and most practical way to make my work documents about this research publicly available, so that other journalists and researchers can use them, adapt them, criticise them and contribute to them (see the “what next” page to read about what I’m generally planning to do regarding FTG).

Another interesting point that arose out of the preliminary research, as I see it, is that the governance system behind so-called generative AI software — which has been very much in the spotlight since OpenAI publicly launched ChatGPT in late 2022 — is being developed, negotiated, discussed and fought about now, and that in some respects it is heir to and echoes the history of how the governance system of online advertising and personal data was shaped very much in favour of corporate actors. That’s why I thought that it makes sense to look into “AI governance” as another case study to keep testing and refining the FTG methodology, and that’s more work that I’m planning to do in the future.