The Irish Data Protection Commission has taken a stand against YouTube for violating the ePrivate Ad Blocker Detection Rule

YouTube began rolling out ad block detection to Europe earlier this year and is now preventing some European users from viewing its content if they have an ad blocker enabled. The EU’s ePrivacy Directive requires online service providers to get explicit permission to “gain access to information stored in the terminal equipment of a subscriber or user.” Hanff, an expert advisor to the European Data Protection Board, alleges that YouTube’s use of JavaScript-based detection scripts to look for specific HTML page elements rendered by a user’s browser is subject to that requirement and he believes it is failing to abide by it.

YouTube said in June that it was launching a small experiment to block ad blockers. Users with ad blockers are not able to watch videos on the platform. Instead of showing the video, YouTube displays a prompt that encourages users to either allow ads on YouTube or subscribe to YouTube Premium.

The European Commission was first contacted by Hanff about the use of ad blocker detection tools. The commission confirmed that the scripts used to detect ad blockers also fall under the rule of the ePrivacy Directive that requires websites to ask user consent before storing or accessing information on a user’s device. The commission wrote that there is no limit to any particular type of information or technology, such as cookies. The storage of websites of scripts in users terminal equipment would be looked into if users install or use ad blockers.

Hanff’s most recent complaint to the commission references his earlier letter. The DPC should take action against YouTube because it uses ad blocker detection tools. Hanff tells The Verge that in addition to violating Article 5.3 of the ePrivacy Directive, he believes it’s also a breach of the fundamental right to privacy under the Universal Declaration of Human Rights and other conventions. Since submitting his complaint, Hanff says the Irish DPC has already acknowledged it and that he has had a call and “a number of emails” exchanged with them. The DPC didn’t reply immediately, but The Verge reached out to them.

The script that [YouTube] deploys can be used to detect things like what software people are running on their machines or how they are using their browser. It’s not okay. Hanff agrees, saying it’s illegal. We have a fundamental right to privacy under Article 7 of the European Charter of Fundamental Rights. We have a fundamental right to data protection under Article 8.”