Most websites and apps may be free to use,

but they make money by displaying digital advertising

targeted specifically at you.

An entire industry has grown up around auctioning and targeting

online adverts as accurately as possible

using data collected about each and every user.

Whenever you visit a website, your computer

can send out personal data to thousands of ad tech companies.

They take the information and use it to bid for the adverts

that you see when the page loads.

It takes milliseconds.

Billions of bid requests are made each week in the UK alone.

Europe's entire digital ad market hit 55.1bn euros

in 2018.

But Europe's new privacy law, the General Data Protection

Regulation, has put the industry under a spotlight

because of the troves of personal data it trades.

And not just between the website and an advertiser,

but between advertising companies

that are building profiles of us.

A damning report from the UK data protection regulator

found that the ad tech industry was breaking the law

by illegally collecting and bartering

in special category data which requires our explicit consent.

The regulator has given the ad tech industry six months

to clean up its practices.

That deadline expires in December 2019.

The industry must decide.

Can it legally continue to auction off our personal data,

or must it change its ways to be more transparent

and to minimise how much data it collects?