Legal scholar establishes that personalised online advertising violates current legislation

Personalised online advertising is a multi-billion business based on the analysis of personal data. © stock.adobe.com - SparkJ Design

Your click, their billions

When you open Instagram in the morning, you see an advert for the exact trainers you were talking about yesterday. At lunchtime, YouTube suggests a video that addresses your political uncertainty precisely. In the evening, a travel portal tempts you with a personalised offer. All of this is possible thanks to an advertising system that condenses every click, location and search query into a profile. This system is, quite simply, illegal. This is the conclusion reached by Dr Amelie Mehlan in her doctoral thesis on "Personalised Online Advertising" at the Faculty of Law of the University of Münster.

Her research delivers an unequivocal finding: 'Personalised online advertising, as it is practised today, violates current data protection laws.' Her approach, however, is novel. The legal scholar combines a detailed analysis of the technical and economic workings of the digital advertising market with a comprehensive legal assessment.

Behind every advertisement lies a market that operates in milliseconds. In a process known as real-time bidding, personal data such as location, interests, and health information are simultaneously transmitted to hundreds of companies. The company that bids the most is allowed to display the ad. According to Statista, Meta generated around 131.9 billion US dollars in advertising revenue in 2023, corresponding to over 97% of the group's turnover. 'The structures of the personalised advertising market are so complex that even the market participants cannot say who will end up with the data profiles,' explains Amelie Mehlan. Informed consent, as required by the European General Data Protection Regulation (GDPR), is therefore effectively impossible. Likewise, cookie banners with large "Accept" buttons alongside barely visible "Reject" options fail to create genuine freedom of choice.

Dr Amelie Mehlan © privat The consequences extend far beyond data protection. The same infrastructure could be exploited for political manipulation. For example, in 2016, Cambridge Analytica used the data of 87 million Facebook users to influence the US election. There have been documented data flows to Russia and China, and cases in which advertising data revealed the locations of military personnel. These demonstrate the security policy dimension of the problem. There have also been documented cases of discrimination. For example, job ads for technical roles were shown to women less frequently than to men, even when the ads were worded in a gender-neutral way. 'If someone never sees an advertisement, they cannot know that they have been denied a professional, economic or social opportunity,' warns Amelie Mehlan.

Although the legal position is clear, there is no systematic enforcement taking place. 'The proceedings take years, and the responsible Irish data protection authority acts notoriously slowly,' notes the legal scholar. For corporations such as Meta and Google, fines remain a calculable operating expense, as profits from the unlawful business model regularly exceed penalties. Amelie Mehlan therefore calls for faster proceedings and a reform of sanctions, such as the relinquishment of unlawfully obtained profits modelled on competition law. Above all, existing data protection laws must be consistently enforced. As a last resort, a statutory ban on personalised advertising also remains a possibility, a measure that the EU has already discussed.

Further research is essential, e.g. into the assessment of new tracking technologies and the use of personal data in training AI models. However, scientific findings alone are not enough. Legislators, supervisory authorities and the courts must now enforce the existing law effectively. 'As long as that does not happen, data protection will remain a mere promise on paper while the data economy creates new facts every day,' says Amelie Mehlan.

Short CV

Dr Amelie Mehlan studied law at the University of Münster. During her subsequent doctoral studies, she worked first as a research associate and then as managing director of the public law department at the Institute of Information, Telecommunication and Media Law (ITM), also at the University of Münster. She held a teaching position in IT and media law, as well as constitutional and administrative law, at the FOM University of Applied Sciences for Economics and Management. She is currently completing her legal traineeship at the District Court of Münster. She most recently worked as a research associate at the Higher Administrative Court of the State of North Rhine-Westphalia. She completed her doctorate at the University of Münster in 2025.

Author: Kathrin Kottke

This article is taken from the university newspaper wissen|leben, issue no. 4, 17 June 2026.

Further information

• The June issue of the university newspaper as a PDF (in German)
• All issues of the university newspaper at a glance (in German)