Overview
On average, every 3.8 minutes, a company somewhere in the world is looking at the average European citizen: you, your family, and your neighbours. That adds up to a staggering 376 times per day of your data being broadcast through digital advertising. The tools underlying this advertising system were built to show ads, but governments use these same exact tools and processes to track, surveil, and manipulate.
The average European citizen has their data broadcasted a staggering 376 times per day.
Digital advertising companies sell the idea of “perfect” data. With more data, they say, they can place ads to the right people at the right time. For the past three decades, this sales pitch has justified the extraction and aggregation of data for their business model. But, this practice has left citizens and countries vulnerable. Foreign national security, intelligence, and control systems are fed by this unregulated, undemocratic, opaque data infrastructure, turning it into a system of manipulation.
The digital advertising (“adtech”) system is part of a widespread net of technological dependencies. Europe, despite best efforts to rapidly and efficiently regulate for privacy protections, has already given an unprecedented amount of intelligence and control away to foreign actors. We need to change this, quickly.
Check My Ads proposes a four-point Action Plan for European securitisation from the advertising system. This plan includes the enforcement of existing data protection, consumer protection, Digital Services, Digital Marketing, and antitrust laws. It introduces new centralised laws for the adtech industry. It establishes a new EU-wide public authority to govern data extraction and monetisation. And, it supports the development of online advertising and adjacent digital infrastructures for public benefit.
Introduction
Europe is a world leader in data protection, but still alarmingly vulnerable. The European Union has built the world’s strongest personal data protection regime, but despite a generation of legislative effort to safeguard citizens’ rights in the digital age, a vast commercial surveillance and exploitation infrastructure operates to systematically undermine these protections.
The core of this infrastructure is advertising technology. Valued at €645 billion EUR in 2024, the adtech industry is expected to grow in 2026 with new innovations in artificial intelligence and targeting capabilities – each relying on personal data. Adtech functions as the core data extraction mechanism, facilitated by the digital advertising sector. This automated, auction-based advertising system accounts for approximately 90% of all digital display advertising spend globally (€488.6 billion EUR), and continues to grow.
Adtech’s dual purpose as mass surveillance infrastructure
The adtech ecosystem, as currently constructed, functions as a largely unregulated intelligence pipeline. This pipeline runs in both directions: extracting surveillance-grade data about European citizens and delivering precision-targeted influence operations back at them.
The growth of adtech is powered by the trade in consumer data. The real-time bidding process broadcasts personal data to thousands of unverified participants in every ad auction. This data is then obtained for both advertising purposes, and by entities that people have never heard of, for purposes we have never agreed to, all for financial gain.
Data-powered digital advertising is the largest revenue driver for the world’s largest technology firms. For Europe to govern data protection, it must go up against the most powerful corporate entities, such as data brokers and adtech companies, whose political and financial reach extends to nearly every country on the planet. The EU now faces a threat that has seemingly outgrown its arsenal of governance tools.
Three American tech giants, Google, Meta, and Amazon, command 60% of the digital ad revenues. These platforms operate surveillance and influence infrastructure more pervasive than any nation-state has ever built, extracting private information from hundreds of millions of European citizens every day, and then using it to shape their information environment to influence Europeans in ways that result in profits for their platforms.
Unlike state intelligence services, which operate under legal constraints and democratic oversight, this ad-enabled surveillance infrastructure is commercially operated, minimally transparent, and accountable to shareholders rather than citizens.
The Threat
Data privacy and human rights advocates have long warned about the vast flows of personal data in modern digital advertising. Through the use of cookies and tracking pixels, mobile app tracking, search engine surveillance, and other tactics, adtech harvests innumerable and persistent data points from users, both online and offline.
Data brokers will sell data to anyone willing to pay for it. That includes financial institutions, insurance companies, and advertisers, as well as government agencies and even foreign actors. It provides foreign states, non-state actors, and commercial surveillance firms with access to granular personal data about European citizens – including military personnel, elected officials, judges, and defence industry workers – through mechanisms that often evade existing law.
For decades, private companies across various sectors have partnered with law enforcement and intelligence agencies to provide and extend additional surveillance capabilities. This commercial trade in consumer data provides a workaround for governments to circumvent legal process and safeguards, while supplementing intelligence collected via channels such as Open Source Intelligence and Human Intelligence (referred to as OSINT and HUMINT), the cornerstones of intelligence gathering for the past few centuries. While these commercial products from the adtech industry are used to primarily sell data to brand marketers, they can also be used to manipulate public opinion, surveil dissidents, and identify high-value governmental targets, a practice known as ADINT. For example, the German police have come under fire for using the Gotham software developed by the US company Palantir. Finland, Sweden, France, Poland, the Netherlands, Austria, and Greece are among other EU countries that have government contracts with Palantir, while Italy, Romania, and Spain have private contracts with the company.
The threat operates through three primary channels:
1. Commercial Surveillance: The use of adtech infrastructure andcommercially-available information for governmental intelligence operations and law enforcement
2. Adtech Opacity: the opacity of adtech business models and data flows make it difficult to track how data is actually used, and by what actors
3. Exploitation by Adversaries: Foreign-owned platforms, which can funnel money and data directly to adversarial states and have made data syndication a globally available commodity. Similarly, foreign adversaries may exploit adtech platforms, spinning up websites or apps, and engaging in ad fraud as a means to generate revenue; or misusing targeted ad systems to manipulate individuals, including members of the military or government officials
These threats are inseparable from the nature of platform power. The companies that dominate this infrastructure are not simply large corporations. They control systems that function as de facto public utilities, mediating access to information for entire populations, while remaining privately governed and deliberately opaque.
Action Plan
While the EU recognises the importance of technological sovereignty for its security, threats to this are often misconstrued. In the digital context, the single biggest threat to European security is the commercial surveillance infrastructure, with adtech at its core. These adtech services are provided by a handful of non-European companies that use their infrastructural capacity to sabotage any state-led initiative to reassert jurisdictional sovereignty and security in the online ecosystem. These commercial entities that threaten European sovereignty and security often distort the narrative and present themselves as the only ones who can ensure security. This means that any genuine step to ensure sovereignty and security in Europe must recognise that companies such as Google are false guardians, causing the very demise they pretend to save Europe from.
Starting from this premise, ensuring European sovereignty, security, and competitiveness in the digital domain requires not deregulation, so that commercial surveillance infrastructure is able to extract more value from Europeans and expose them to serious security harms, but a four-point approach that fully reasserts the rule of law, including security checks and balances in the online ecosystem, starting with monetisation and the adtech ecosystem.
This policy must include the following modes of action:
4. Enforcement: apply the EU digital rulebook to tackle the current business models.
a. Strict personal data protection, consumer protection, and DSA enforcement must ensure that the online environment is monetised in a way that is safe for individuals and society. This includes punishing the adtech industry, especially Big Tech, for deliberately disregarding public interests in pursuit of profit.
b. Strict antitrust and DMA enforcement must level the playing field in markets for monetising the online environment, such as adtech. The DMA is the EU “golden sword”, and the European Commission must wield it.
5. Regulation: streamline the EU digital rulebook.
a. Make it easy for users to exercise their privacy preferences:
i. This means the EU would centralise the consent framework for practices that monetise the online environment, with particular emphasis on online advertising and AI training.
b. Regulate the digital advertising ecosystem to:
i. Make supply chain transparency legally mandatory.
c. Standardise targeting, security, and measurement practices in a way that reflects public interests in the EU.
i. Introduce common ownership rules and best- interest duties to curb conflicts of interest in advertising markets. ii. Introduce adtech and data broker registry that registers all companies that directly or indirectly extract and monetise data in the online environment in the EU.
d. Introduce know-your-customer (KYC) and due diligence obligations within the ecosystem.
6. Oversight and governance: To ensure independence from political interference in the information ecosystem, establish a new EU-wide public authority to govern data extraction and monetisation in the online ecosystem. Mandate this authority to engage in standard-setting, certification, supervision, and enforcement of rules related to a centralised consent framework, and digital advertising.
7. Innovation: Industry and policy-oriented solutions are both needed to encourage viable alternatives to the use of surveillance advertising in the digital advertising ecosystem.
a. The EU should strategically support the development of online advertising and adjacent digital infrastructures that advance public-interest objectives, including privacy-preserving contextual advertising solutions, open-source ad-tech components, and European user-agent technologies such as a browser engine, where market incentives alone have proven insufficient.
b. Industry stakeholders across both buy and sell sides must standardise and codify how privacy-preserving advertising solutions are created, governed, and executed. This includes but is not limited to self- regulatory bodies, European brands and their media agencies, and adtech firms. Media agencies have a specific duty to their brand clients to expose them and their customers to the least amount of risk. Therefore, media agencies should promote effective privacy-preserving advertising methods over intrusive, data-extractive practices that put brands and their customers at risk.
Summary
The AdTech and Military-Industrial Complex intersection has quietly emerged as a threat to European security, sovereignty, and democratic governance. The Action Plan’s measures – strong enforcement of the EU’s digital rulebook, streamlined regulation to make the adtech ecosystem more transparent and trustworthy, investment in privacy-preserving advertising technologies, and the creation of an independent EU regulator to hold adtech companies accountable – will fundamentally transform the relationship between European citizens and the systems that collect, trade, and exploit their data.
The result: an advertising ecosystem that is healthy and fit for purpose, where data moves only when and where users expect it to, where adtech intermediaries know they will be held accountable for any failures, and where foreign adversaries, bad actors, and opaque data pipelines are no longer able to exploit commercial surveillance architecture for their own manipulative gain. Europe can lead the world into a new future where digital advertising can remain the business model of the internet – without being weaponised.
Check My Ads Institute, The Adtech Watchdog
Check My Ads Institute is an independent 501(c)3 non-profit global digital advertising watchdog, headquartered in the United States. Our organization serves the stakeholders that are most impacted by the digital advertising ecosystem: publishers, advertisers, policymakers, small businesses, and the public. We help these stakeholders navigate the complex industry and understand not only how advertising budgets flow, but how they shape the information ecosystem, often disappearing before ever reaching real people.
Our mission is to bring transparency and accountability to the notoriously opaque and purposefully complex digital advertising ecosystem. The global advertising industry has grown to be worth more than 750 billion USD and is among the world’s largest unregulated industries. Check My Ads has advanced market reform by providing stakeholders with new ways to demand accountability from Big Tech and Adtech. We work globally with policymakers to advance many common-sense safeguards to protect the public. We are pushing for reforms to apply the same rigorous standards required in the finance industry to the digital advertising industry, including supply chain transparency, Know-Your-Customer requirements, best interest duties for adtech intermediaries, and common ownership rules.
Our work with advertisers and advertising practitioners demonstrates how the current system allows advertising budgets to unintentionally fund harm and waste, to the detriment of brands and their growth. We also uncover how adtech business practices contribute heavily to starving quality publishers of digital advertising revenues.
We are proud to be fully independent and free from industry influence. We do not accept any money from tech companies. Our advocacy is driven by facts and the desire to make the internet fairer for all who use it. Check My Ads exists to empower the people and organizations most affected by the broken adtech system. By shining a light in the dark corners of this opaque ecosystem, we push for systemic changes that will reform how the internet is funded – and, in turn, how it can serve and protect all of us.