Targeted and Invisible: Algorithmic Advertising under South African Law and the AU’s Malabo Convention

Abstract

Algorithmic targeted advertising has become a defining feature of digital markets, enabling platforms to personalise content through continuous data collection, behavioural profiling and automated optimisation processes. While often justified in terms of efficiency and relevance, these systems operate in ways that are largely opaque, raising significant concerns for consumer autonomy, privacy and equality. This article critically examines whether South Africa’s legal framework, principally the Protection of Personal Information Act 4 of 2013 (POPIA), the Consumer Protection Act 68 of 2008 (CPA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA) and, in limited contexts, the National Credit Act 34 of 2005 (NCA), is capable of addressing these risks. The article argues that, despite formal alignment with international standards, the current framework is structurally misaligned with the realities of algorithmic advertising. The analysis considers the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), which is treated as the principal international-law benchmark rather than a peripheral comparator. It considers the Convention’s entry into force, South Africa’s status as a signatory, and the relevance of its processing principles, data-subject rights and independent-supervision requirements to algorithmic advertising. Read alongside the AU Data Policy Framework and Continental Artificial Intelligence Strategy, the Convention exposes the limits of an individualised, consent-based model in platform markets. The GDPR is used as a supplementary comparative framework. Drawing on empirical evidence, including Sáez-Linero’s study on algorithmic advertising and inequality, the article illustrates how these systems can reproduce and amplify socio-economic and gender-based disparities through discriminatory audience segmentation and exclusionary targeting. It further evaluates the Department of Trade, Industry and Competition’s proposed amendments to the CPA Regulations, arguing that while the introduction of an opt-out registry enhances consumer control, it fails to confront the underlying logic of algorithmic targeting. The analysis is situated within a broader comparative and regional context, engaging more substantively with the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) and drawing on the EU General Data Protection Regulation (GDPR). The article concludes that meaningful regulation requires a shift from individualised, consent-based models to a structural approach that integrates data protection and consumer protection tools.