The Better Business Bureau’s Online Interest-Based Advertising Accountability Program (“the Accountability Program”) issued its first ever compliance warning on October 14, a move that is intended to clarify the obligations of websites where data are gathered for Online Behavioral Advertising (“OBA”) purposes. The result is that operators of such websites are now expected to ensure that consumers receive “enhanced notice” under the Principles, and cannot simply rely in all instances on third parties, such as ad networks, to bring the websites into compliance with the Principles by displaying such notice within OBA ads appearing on the operators’ websites. Failure to meet this requirement can result in an enforcement action by the Accountability Program beginning on January 1, 2014.
The Accountability Program’s compliance warning concludes its investigation into whether a number of websites were in compliance with the Digital Advertising Alliance (“DAA”) Self-Regulatory Principles for Online Behavioral Advertising (the “Principles”) as it relates to first-party obligations (that is, obligations for websites with whom the consumer is interacting, as opposed to ad networks and others, which are generally referred to as “third parties” in the Principles). According to the Accountability Program, a significant minority of website operators otherwise in compliance with the Principles were not providing “enhanced notice” on every web page where data is collected for interest-based advertising by third parties. (Although the warning focuses on compliance in the context of third-party collection of data for OBA, the requirements also apply in cases where a website operator collects data on its own webpage and transfers the data to a third party for use for OBA purposes on non-affiliate webpages.) This type of notice—in addition to the notice regarding delivery of interest-based advertisements that is commonly provided within the OBA ads themselves—is, according to the Accountability Program, also required by the OBA Principles, at least on those pages where data are collected for OBA purposes but where no such OBA ads bearing the enhanced notice appear.
According to the Accountability Program, many companies are “genuinely confused” about their first-party notice obligations under the principles. Hence the compliance warning, rather than a set of case decisions, which explains that the Transparency Principle of the OBA Principles requires websites to provide notice outside of their privacy policies whenever third parties collect a consumer’s browsing activity for OBA purposes. As the compliance warning puts it, the Transparency Principle “shines a light on interest-based advertising whenever and wherever it is occurring online.” This includes the collection of information regarding browsing activities by third parties for their use in interest-based advertising—not just the actual delivery of interest-based ads.
Simply put, this compliance warning makes clear that under the DAA’s OBA Principles, first parties have a responsibility to make sure that consumers are aware that OBA activities are occurring on the website, whether by third parties displaying it in or around OBA ads on the website, or on pages where OBA ads are not delivered, by the first party itself. Since the Accountability Program will start enforcing this requirement on January 1, 2014, websites that allow third parties to collect information for OBA purposes will need to have in place a separate notice mechanism.
How to Comply
First parties can comply with this requirement by:
(1) using a “clear, meaningful, and prominent link” on the website itself (the “enhanced notice link”—this is separate from the privacy policy link, and can be the AdChoices Icon or a text link); which
(2) takes the user to the first party’s disclosure of OBA activity, such as the specific portion of the first party’s website that addresses OBA activity; which itself must either:
(a) point to an industry-developed Web page such as the DAA’s Consumer Choice Page (e.g., www.aboutads.info/choices); or
(b) individually list all third parties engaged in OBA on the website, with links to the choice mechanisms regarding the collection and use of data for OBA for each applicable third party. (The new warning cautions that any website operator that chooses to individually list each third party collecting data for OBA on its website must provide an accurate, up-to-date and comprehensive list, which in practice requires sufficient technical and/or contractual safeguards to prevent unauthorized third parties from engaging in OBA collection.) Website operators that provide an individual list need to make sure that it is accurate and up-to-date, and that there are no unauthorized third parties engaging in OBA data their websites.
Website operators are now on notice that the DAA’s transparency and choice principles for OBA require more than enhanced notice for the delivery of OBA advertisements. According to the compliance warning, the only way a website operator could be in full compliance without providing the information described above is if OBA ads bearing in-ad notice are served on every page of the website where third parties are also collecting data for OBA—and, even then, those in-ad notices would have to provide information on all third parties collecting data on the website.