Outsourcing advertising and GDPR
Outsourcing the provision of advertising to third parties could well have GDPR implications.
The GDPR makes it clear that you are not allowed to predicate provision of service on acceptance of advertisements:
"A data controller may not refuse service to users who decline consent to processing that is not strictly necessary in order to use the service (Article 7(4))"
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)
Look for article 7 section 4, which is in Chapter II - Principles
"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."
So if you are not already asking for positive consent from your advertising marks, there's a regulator with big stompy boots in your future.
Passing Personal Data on to third parties (which includes IP addresses*) falls within the scope of GDPR, so using third parties to serve up advertisements requires you to gain explicit consent, which in the case of minors, requires the consent of their parent or guardian. Anyone using third party advertising services/networks should be feeling rather worried by now.
If you are covered by the GDPR, and have not explicitly consented to see advertising (and you can revoke that consent at any time), you shouldn't be seeing any from legitimate organisations, unless the service provider can successfully argue that it is strictly necessary for them to provide their service to you. The argument that you can't provide the service without the income from advertising doesn't meet this standard. You can read Max Schrems take on this in the discussion on the complaints filed against Google, Instagram, WhatsApp and Facebook.
It will, of course, take a while, but if your business model is dependent on income from online advertising, I can see future problems. It will not be pretty, and online (only) journalism financed by advertising may not survive. El Reg could be living on borrowed time, which is a shame. Maybe a viable method of microfinancing page views will appear. Or the online journalism industry will die by paywall. I've enjoyed reading The Register while it lasted.
*19 Oct 2016 - the Court of Justice of the European Union (CJEU) ruled that dynamic IP addresses could be considered as personal data under GDPR. See http://curia.europa.eu/juris/document/document.jsf?docid=184668&doclang=EN&cid=1095511