In its latest decision, the Online Interest-Based Advertising Accountability Program highlighted the need to provide consumers with “enhanced notice” when data is collected for interest-based advertising (IBA) on either a desktop computer or smartphone.
Tipped off by a consumer complaint, the Accountability Program reviewed the website of sneaker retailer Finish Line and observed that data was collected by “a number” of third-party companies known to engage in IBA. A full examination of Finish Line’s compliance with all applicable requirements of the Digital Advertising Alliance’s (DAA) Principles followed.
During that review, the Accountability Program found that third parties were collecting cross-app data through “Finish Line – Winner’s Circle,” Finish Line’s mobile app. Despite this collection, the Accountability Program failed to find any enhanced notice links or locations prescribed by the Mobile Guidance. Nor could it locate a statement of adherence to the DAA Principles or a disclosure of third-party IBA activity on Finish’s Line’s privacy policy page.
The examination also revealed that at least one third party was collecting latitude and longitude coordinates to the sixth decimal place, the Accountability Program added.
In response to the Accountability Program’s inquiry letter, Finish Line revised both its app and website. As the authorization of third-party data collection for IBA on its website triggered the enhanced notice obligations, Finish Line added an enhanced notice link labeled “Interest-Based Ads Policy,” separate from its “Privacy Policy” link, on each page of its website through which third parties collect information for IBA. The link takes website visitors to a page that includes disclosure of the third-party activity as well as links to the DAA’s WebChoices page and an opt-out page.
Finish Line also implemented its own custom opt-out mechanism and added a statement of adherence to the DAA Principles when it revised its privacy policy.
As for its mobile app, Finish Line included a description of the third-party IBA taking place through its app, along with a link to the DAA’s AppChoices app and a statement of adherence to Finish Line’s privacy policy. To satisfy the enhanced notice compliance obligations under the Mobile Guidance, Finish Line added a new link to its IBA policy near the top of its privacy policy page.
Finish Line amended its privacy disclosures to include language that the company may collect precise location data for IBA purposes and provided full instructions to consumers for disabling the collection. In addition, the company developed a pop-up dialog box that users see after they first open the Finish Line app, which describes the collection and use of location data that takes place and provides a link to the precise location data section of Finish Line’s IBA disclosure.
“By providing an up-front notification directing users to a disclosure about the collection of precise location data for IBA purposes, Finish Line ensured that users are informed not only about the fact that their precise location will be collected, but also about how their data is used,” the Accountability Program explained in its decision.
To read the Accountability Program decision, click here.
Why it matters: “In the mobile environment as well as the desktop space, first parties must ensure that consumers are provided with enhanced notice of third-party data collection occurring on their digital properties,” the Accountability Program reiterated in the decision. “And where certain sensitive data types are at issue, companies should be especially careful to get consumers’ consent before using them for IBA. The requirement to provide timely, up-front notice to consumers sits at the heart of a self-regulatory regime that relies on respect for individual autonomy.”