Dutch political parties breaking privacy rules by sharing voter data without consent

Parties from across the political spectrum are violating the General Data Protection Regulation (GDPR) on dozens of websites by using illegal tracking cookies, with PVV linked to the majority. As a result, people’s personal data, including political preferences, end up with American tech firms such as YouTube and Google without consent, according to Vrij Nederland and the Internet Cleanup Foundation. Researchers from the organizations analyzed 6,168 relevant URLs using the code program Playwright.

Illegal tracking was found on more than 40 sites. The URLs studied included not only those belonging to political parties but also the affiliated youth wings and regional chapters. By far the most, 28, were linked to PVV. Such illegal tracking cookies were also found on three local ChristieUnie, two to FVD, and two to JA21. D66, De Nederlandse Alliantie, CDA, SGP, and PRO all have one each. Last year, Stiching Data Bescherming Nederland had already reported seven political parties for using illegal tracking cookies; six have since removed them from their national sites.

“It is negligence. Political parties should set the right example,” Felienne Hermans, a computer science professor at Vrije Universiteit Amsterdam, told Vrij Nederland. According to the expert, political parties’ platforms usually strongly emphasize independence from U.S. tech firms.

“Big Tech can use previous data to estimate how receptive you are to certain information,” Hermans said. “The information you see becomes increasingly one-sided. That is curious, especially now that CEOs themselves hold extreme views.”

Since 2018, data held by American technology firms can be demanded on orders from the U.S. government. “You do not want to think about world leaders knowing which party you sympathize with,” Hermans added.

Political parties now share less illegal data through cookies than 10 years ago, but the number of those that do is still high. The fact that it keeps happening despite warnings is striking, said the Internet Cleanup Foundation.

Enforcement is reportedly mild. “When you punish certain parties, you are easily associated with a political preference,” said Frederik Zuiderveen Borgesius, a professor of information and communications technology law. “You see, for example, that the authority does go after commercial companies over tracking cookies.”