internet privacy gdpr european-union italy
Can internet providers use navigation data for advertising / profiling?
<p>My internet provider knows which sites I am connecting to (even if only the server names, when using https). Can they legally use that information for profiling / advertising? For instance, if they see me visiting <a href="http://www.babynames.com" rel="nofollow noreferrer">www.babynames.com</a> they might decide to send me ads for strollers and diapers.</p>
<p>What is the legal status of this form of profiling? I am interested about Italy personally, but answers about other legal systems (EU/GDPR in particular) is also welcome.</p>

<p>The GDPR has no explicit rules on this, but the ePrivacy directive covers telecommunication services including internet providers. Your network traffic falls under the ePrivacy's concept of <em>traffic data</em>. Such traffic data may be only used per Art 6:</p>
<ul>
<li>for performing the transmission (e.g. they have to look at IP addresses in your traffic to correctly route your traffic)</li>
<li>after anonymizing the data (which precludes targetted ads)</li>
<li>for billing purposes</li>
<li>for marketing electronic communication services or for providing value added services, <strong>if you give consent</strong></li>
</ul>
<p>So no, they cannot use your traffic for profiling or advertising unless you opt in to such services. The GDPR requires that refusing consent brings no detriment to you, but such consent could in principle be encouraged e.g. by slightly lower prices.</p>
<p>However, ePrivacy is merely a directive and each member state should have implemented it in their own laws. Italian laws could have slight modifications.</p>
