Privacy, consent and consumer law

Platform policies are contracts: break them and you lose an account. Laws are different: break them and a regulator or a court can come after the business and sometimes the people behind it. Two bodies of law matter most to search arbitrage. Privacy law governs the data you collect about visitors. Consumer protection law governs what your ads and pages lead people to believe. This lesson is general education, not legal advice.

A shop needs two kinds of honesty. It must not rifle through customers' bags without asking, and it must not put a false sign in the window. Privacy law is about the bags. Consumer law is about the sign.

Privacy: why an arbitrage page handles personal data

An arbitrage page looks simple, but a lot of data moves when it loads. The tracker stores a Click ID tied to a device. The feed's code sets or reads cookies. A tracking pixel or Conversions API tells the ad platform what the visitor did. Under European law, identifiers like these are personal data, and storing or reading information on someone's device generally needs their consent first.

Europe: GDPR and consent

The GDPR applies when you offer services to, or monitor, people in the European Economic Area, wherever your company sits. The UK has its own near-identical version. Alongside it, the ePrivacy rules (the 'cookie law') require consent before non-essential cookies or similar storage are used. Consent must be a real choice: asked before the data flows, as easy to refuse as to accept, and possible to withdraw.

Google turns this law into a contract term. Its EU user consent policy requires anyone using Google's ad products for users in the EEA, the UK and Switzerland to obtain legally valid consent for cookies and for using personal data to personalise ads, to keep records of that consent and to name the parties who receive the data. Google's policy change log shows the policy was extended to Swiss users on 31 July 2024.

1. Use a certified consent toolFrom January 2024 Google has required publishers using AdSense, Ad Manager or AdMob for EEA and UK users to use a Google-certified consent management platform that works with IAB Europe's Transparency and Consent Framework (consent management).
2. Ask before anything loadsThe banner appears first. Tags that set cookies wait for the answer.
3. Pass the answer onThe choice is sent to Google and other vendors. Google's consent mode carries four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. The last two were added in the version Google required from March 2024.
4. Respect a noIf consent is refused, Google's tags do not store advertising cookies. In advanced consent mode they send limited cookieless signals instead. Your own tracker and server-side events must respect the same choice.
5. Keep the recordYou may be asked, by Google or a regulator, to show that consent was given.

United States: state privacy laws

The US has no single federal privacy law for advertising. Instead, a growing list of states, led by California, have passed their own. They differ in detail but share a core: tell people what you collect, and let them opt out of the sale or sharing of their data for targeted advertising. California also requires businesses to honour browser-level opt-out signals. For an arbitrage site with US visitors, the practical minimum is a clear privacy notice, a working opt-out, and a consent tool configured for US states as well as Europe.

Consumer law: the FTC and deception

In the United States, Section 5 of the FTC Act prohibits unfair or deceptive acts in commerce. An ad is deceptive if it is likely to mislead a reasonable consumer about something that matters to their decision. This is the law that stands behind every platform rule on a misleading ad. The UK, the EU and most other countries have equivalents. A headline promising a benefit that does not exist is a policy problem and can also be a legal one.

Native ad disclosure

The FTC applies the same principle to format. If an advert looks like an article or an editorial recommendation, people must be able to tell that it is advertising. The FTC's guidance on native advertising, published in December 2015 alongside an enforcement policy statement on deceptively formatted advertisements, sets out how.

• Disclose when needed. The more an ad resembles the surrounding editorial content, the more a disclosure is required (native ad disclosure).
• Put it where people look. Near the headline, in front of or above it, not tucked to the side or at the bottom.
• Make it readable. Clear font, contrast with the background, and repeated on the page the ad leads to if that page is also advertising.
• Use plain words. The FTC favours terms such as 'Ad', 'Advertisement' or 'Sponsored Advertising Content', and cautions that labels like 'Promoted' may not be understood.
• Everyone in the chain is responsible. Advertisers, agencies and affiliate networks that help create or place the ad share the duty.

For search arbitrage this bites at two points. The native ad that brings the visitor is labelled by the network, but your headline must not undo that by posing as news. And on your page, the sponsored results must be recognisable as advertising (ad disclosure), which is also what Google, Taboola and Outbrain require.