Caveat Vendor
Self-Regulatory Organization Enforcement Agreements Aim to Increase Transparency in Personalized Ads
November 06, 2014
Devon Winkles and Mary-Elizabeth M. Hadley
Last week, the Advertising Self-Regulatory Council’s Online Interest-Based Advertising Accountability Program released agreements with five website operators addressing their compliance with the Self-Regulatory Principles for Online Behavioral Advertising (“OBA Principles”). Under the agreements, Answers Corporation, Best Buy, BuzzFeed, Go.com and Yelp will provide real-time “enhanced notice links” to website visitors when third parties collect information for online behavioral advertising, as required under the OBA Principles.
The OBA Principles, which were developed by industry associations and are enforced by the advertising self-regulatory arm of the Council of Better Business Bureaus, apply to website operators (first parties), advertisers (third parties) and service providers. There are seven OBA Principles: (1) education, (2) transparency, (3) consumer control, (4) data security, (5) material changes to existing practices, (6) sensitive data and (7) accountability.
Under the Transparency Principle, third parties that collect and use OBA data must provide consumer notice at the time that data are collected and used for online behavioral advertising. For instance, an advertiser may attach a link to each advertisement, which, when clicked, provides a disclosure of its online behavioral advertising practices and provides a mechanism for exercising choice regarding such practices. Many advertisers have employed the AdChoices icon, developed by the Digital Advertising Alliance (“DAA”), to satisfy this requirement.
Website operators, meanwhile, must provide a disclosure of third-party OBA activity occurring on their websites, either in the privacy policy or in some other location on the sites, and this disclosure must either link to an industry-developed consumer choice page or list every third party conducting OBA activity on the website. In addition, website operators have an obligation for real-time disclosure and must ensure that a clear, meaningful and prominent enhanced notice link appears on each page where data are collected. This requirement can be satisfied by a third party in-ad link, as described above, or by a first-party link in a footer or sidebar, but in either case the notice link must appear on each page where data are collected. In its agreements with the website operators, the Advertising Self-Regulatory Council cited several instances where the operators did not place the enhanced notice link on each page where data were collected.
The advertising industry’s self-enforcement efforts are the latest in a trend towards increasing web users’ awareness of third-party tracking. For instance, as we have written, an amendment to the California Online Privacy Protection Act of 2003 (“CalOPPA”) now requires operators of commercial websites and online services (“operators”) to not only disclose how they respond to “do not track” (“DNT”) signals, but also to disclose whether any third parties can collect personally identifying information when a consumer uses the operator’s website or service. According to May 2014 guidance issued by California Attorney General Kamala Harris, operators should clearly identify the sections of their privacy policies regarding online tracking and should describe their response to DNT signals directly in those policies (rather than by linking to another location as CalOPPA permits). The operators are not required, however, to prohibit third party tracking or to honor DNT requests.
Expectations associated with online tracking and behavioral advertising continue to evolve. The OBA Principles represent an important self-regulatory benchmark to which regulators such as the Federal Trade Commission and state attorneys general likely will look in evaluating whether websites are engaged in deceptive or unfair practices.
Caveat Vendor is Paul Hastings’ Consumer Issues blog. We welcome your feedback. Please contact our blog editor with any thoughts or suggestions.
Subscribe to Caveat Vendor by Email. You will receive an email when the blog has been updated.