In its latest decisions, the Digital Advertising Alliance (DAA) Accountability Program (the Program) worked with websites and mobile apps devoted to retail and pharmaceutical products on issues of notice.
The first case involved Johnson & Johnson. A consumer complained that the website for Neutrogena skin care products allowed third parties to collect data for interest-based advertising (IBA) without providing sufficient notice and choice as required by the DAA Principles.
A review of the website failed to turn up an enhanced link that took users directly to a disclosure about IBA that was distinct from a general privacy policy link. Nor was there a link to an opt-out mechanism or a statement of the company’s adherence to the DAA Principles.
During its exam, the Program noted that a mobile app for Johnson & Johnson’s Zyrtec appeared to send information to third parties that may engage in IBA and lacked enhanced notice to consumers.
In response, Johnson & Johnson worked with the Program to revise its privacy disclosures. The company added an enhanced notice link labeled “AdChoices” featuring a DAA icon that takes users to an updated section of the Neutrogena privacy policy, which contains a website disclosure about third-party IBA and an opt-out link.
To resolve its issues with the mobile app, the company committed to adding a jump link directing users to language describing mobile IBA and a link to the DAA’s AppChoices app.
Johnson & Johnson also updated the websites of several of its other products and committed to full compliance for the rest of its mobile apps by the end of 2019.
The second case was similarly triggered by a consumer complaint. The Program reached out to PVH Corp. after a consumer saw a number of retargeted ads for True&Co products on unaffiliated websites but found no information on how to opt out of the ads.
Moreover, True&Co failed to provide a link to a disclosure of the third-party IBA activity on its site, a description of third-party data collection practices, or a statement of its adherence to the DAA Principles.
PVH added an enhanced notice link on each page of the True&Co website where third parties collect information for IBA that takes users directly to a new section in True&Co’s revised privacy policy, which discloses third-party tracking activity occurring on the site and includes a link to the DAA’s site. The company also updated the websites for its other brands (such as Tommy Hilfiger and Calvin Klein) with a similar notice.
PVH promised the Program that by December 2019, all of its websites will include statements of adherence to the DAA Principles.
To read the decision in the Johnson & Johnson case, click here.
To read the decision in the PVH Corp. case, click here.
Why it matters: These latest DAA decisions continue a “long line” of DAA enforcement actions against apps and website publishers for failing to provide users with enhanced notice about third-party data collection. Companies engaged in IBA should take note of these developments and reassess their compliance program to ensure that their data handling and advertising practices are in line with the expansive self-regulatory framework that governs this space. Companies should keep in mind the various Program principles and guidance requirements and provide enhanced notice and functional opt-outs, which in many circumstances may necessitate consumer consent.
These latest cases continue to emphasize that the DAA Principles impose notice requirements not only on third parties but also on first parties. First-party websites that allow third-party data collection (e.g., when third-party ads are shown) must provide a “clear, meaningful and prominent link” on each “Web page where data is collected for OBA.” The link is meant to “take[] information formerly buried in the privacy policy . . . and make[] it easily accessible to the consumer.” This “enhanced noticed link” should contain a disclosure that “either points to an industry-developed Web page such as the DAA’s Consumer Choice Page or individually lists all of the third parties engaged in online behavioral advertising on its website and provides links to each of the respective choice mechanisms.”
Websites and mobile apps that are uncertain whether they comply (or need to comply) with the DAA’s enhanced notice requirements should, as a first step, perform an audit of third-party tracking occurring on their sites and apps by doing an inventory of tags placed on their sites/apps, reviewing third-party contracts, or (preferably) both. Third parties, in turn, should expect increasingly to be held to an “enhanced notice” standard regardless, given the gaps in first-party compliance that are likely to occur.