Legal issues of user tracking technologies

A person's right to privacy as well as their right to protection of personal data are granted by the Charter of Fundamental Rights of the European Union. The European Union (EU) has issued a number of legal texts trying to ensure those rights. The most prominent of the aforementioned texts is probably the General Data Protection Regulation (GDPR). Its coming into effect in 2018 has caused a stir. United States (of America) (U.S.) companies were suddenly blocking traffic coming from the EU and people who have given little thought to data protection before started talking about it. Despite the sudden rise in interest about data protection, many people are still unaware that personal data has become a major source of economic value. Monetary value is mostly established indirectly, e.g. by how useful the data in question is to companies which are trying to target potential customers with personalised advertisements.

By establishing economic value of personal data, it was assumed that Austrian companies collecting personal data for business purposes exist. This thesis aims to validate said assumption by performing a technical survey of user tracking methods utilised by Austrian enterprises, especially focusing on web and mobile tracking methods. Lastly, coming back to the legal aspect of personal data, methods used are analysed considering their legal implications.

The following are the main research questions considered in this work:

1. What is currently considered state-of-the-art user tracking in regard to web or mobile phones, and what other methods are (still) in use?

2. Which (state-of-the-art) user tracking technologies are currently being used by Austrian enterprises for business purposes?

3. In which ways are these technologies covered by Austrian or European law? Which technologies in use pose potential threats to users’ privacy and are currently not regulated?