T HE EU’S GENERAL Data Protection Regulation ( GDPR ) has opened the way for a range of complaints about online advertising auctions.

A British group called Privacy International says that companies collecting, buying and selling user-data in order to buy and sell advertising do not have the “legitimate interest” in doing so that GDPR requires. The group has argued to British, French and Irish regulators that legitimate interest covers things like fraud detection by banks—a reasonable thing to do with data gathered in the course of business—but it does not stretch so far as covering an entire business model.

None of Your Business (noyb), another activist group, filed a complaint with Belgian, French and German regulators the day the GDPR came into effect over “forced consent”. In the months prior to the introduction of GDPR, Facebook required its customers to agree to new terms and conditions which it felt to be GDPR compliant. If they did not acquiesce, they faced being blocked from their Facebook, Instagram and WhatsApp accounts. Agreement under such strictures, noyb argues, should not be considered valid. In January France’s Commission Nationale de l’Informatique et des Libertés ( CNIL ) agreed with part of the noyb complaint against Google’s requirement that users of its Pixel phones opt in to its data-collection policies and fined Google €50m ($57m). Google immediately appealed; a spokesperson for the company says that people “expect high standards of transparency and control” from it and that it was “committed to meeting those expectations”.

In September ITN Solicitors, acting on behalf of Michael Veale and Jim Killock in Britain and Johnny Ryan in Ireland, filed a brief with the British and Irish regulators aimed at the basic infrastructure through which companies bid for users’ attention. Mr Ryan, who works for a web-browser company called Brave, says that because the online-bidding process is, by default, open to anyone who pays to take part, it sends personal data to unknowable destinations hundreds of billions of times a day. The amount of data involved is far greater than that lost to hacking or carelessness in one-off data breaches.

The complaint takes aim at two of the biggest real-time bidding systems, Authorised Buyers, Google’s in-house system, and Open RTB , the system which the rest of the industry uses. It asks the regulators to examine the software protocols that auction off users’ attention and to hold Google and the Interactive Advertising Bureau ( IAB ), the industry body which runs Open RTB , responsible for any improper use that those protocols allow.

Google and the IAB hold that it is not up to them how third parties use the tools they create. If regulators agree with that, they may follow the alternative course of seeking out and punishing companies that have abused the personal data that the real-time-bidding systems broadcast. If flaws being abused were thus identified, they might then look at getting the industry to make the protocols more secure.