The Information Commissioner’s Office (ICO) has issued a stark warning to the ad tech industry to put its real-time bidding house in order or face increased regulation.

In June last year, the ICO released a report that highlighted a number of issues and concerns around the use of personal data in the real-time bidding process, and it gave the industry six months to respond to its findings. Just last week IAB UK issued its response, in the shape of a series of actions designed to help companies engaged in real-time bidding to understand and meet their data protection and privacy compliance obligations in practice.

In a blog post today, Simon McDougall, the ICO’s executive director of technology and innovation, paid tribute to the IAB’s work, naming it and Google as “two key organisations in the industry” who “are starting to make the changes needed”.

But he noted also that “while many organisations are on board with the changes that need making, some appear to have their heads firmly in the sand.” He added that the ICO had reviewed a number of justifications for the use of legitimate interests as the lawful basis for the processing of personal data in RTB and found that the justification offered by organisations is insufficient.

“Furthermore,” he wrote, “the Data Protection Impact Assessments we have seen have been generally immature, lack appropriate detail, and do not follow the ICO’s recommended steps to assess the risk to the rights and freedoms of the individual. We have also seen examples of basic data protection controls around security, data retention and data sharing being insufficient.”

And he warned the industry that if it does not put things right, regulation is inevitable, saying: “We will continue to investigate RTB. While it is too soon to speculate on the outcome of that investigation, given our understanding of the lack of maturity in some parts of this industry we anticipate it may be necessary to take formal regulatory action and will continue to progress our work on that basis…

“I am both heartened at how much progress we have made, and disappointed that there are some who are still ignoring our message. Those who have ignored the window of opportunity to engage and transform must now prepare for the ICO to utilise its wider powers.”

Aaron Goldman, CMO of 4C Insights, said the ad tech industry should take the ICO’s warning seriously. “The latest ICO update will have significant consequences for ad tech companies operating on the open web and in particular using real-time bidding,” he said. “These latest developments along with Googles announcement that it will do away with third-party cookies spell doom for demand side platforms that are not interoperable within and across walled gardens. Going forward, the imperative for publishers and broadcasters will be to create closed ecosystems with opt-in consumers and enable brands to connect with consumers on multiple screens through targeted placements.”