In its latest action, the Online Interest-Based Advertising Accountability Program emphasized the importance of enhanced notice for consumers of behavioral targeting.
Pursuant to the Digital Advertising Alliance’s (DAA) Self-Regulatory Principles, companies engaged in interest-based advertising (IBA) must inform website visitors when third parties collect their web browsing data, and provide them with an opportunity to opt out of the IBA.
A consumer filed a complaint with the Accountability Program about Liftopia, a website that sells tickets for ski lifts across the country. When the Accountability Program reviewed the website, it observed that third-party companies known to engage in IBA had collected data.
Although the Accountability Program found that the site included a link to the company’s privacy policy, it lacked a separate link that directed site visitors to a disclosure that Liftopia engaged in third-party IBA activity. Even a manual search of the Liftopia privacy policy failed to turn up a statement that Liftopia adhered to the DAA Principles, the self-regulatory body added.
The Accountability Program sent an inquiry letter to Liftopia, expressing its concerns.
“Most significantly, the OBA Principles require first parties to provide consumers with real-time ‘enhanced notice’ when third parties are collecting or using data for IBA on a first party’s website,” the Accountability Program stated. “This real-time indicator must be in the form of a ‘clear, meaningful, and prominent’ link that directs consumers to the first party’s IBA disclosure, and not just to the top of a privacy policy. In addition, this link must be distinct from the company’s privacy policy link and must appear on every page where data collection or use for IBA occurs on the first party’s website.”
Liftopia responded by adding an enhanced link labeled “Your Ad Choices,” separate from its privacy policy link, on each page of its website through which third parties collect information for IBA, according to the decision. The link takes users directly to the privacy policy section that addresses third-party IBA, which in turn includes a link to the industry -developed consumers’ choice page www.aboutads.info. Liftopia also added a statement of adherence to the DAA Principles.
“These changes brought Liftopia into full compliance with the DAA Principles,” the Accountability Program said.
While either the first or third party can provide the enhanced notice link on a website where third parties are collecting data for IBA, “both parties are independently responsible for ensuring that enhanced notice is, in fact, provided,” the Accountability Program noted.
The group also pointed out that because it began enforcing the enhanced notice provision four years ago, companies cannot plead ignorance of the requirement. “Given the large body of published Accountability Program decisions and the coverage they have received in the press, first parties that allow IBA on their sites should now fully understand their compliance obligations,” according to the decision. “Providing consumers with real-time notice and the opportunity to exercise choice about IBA is now a clear industry standard.”
Why it matters: The Accountability Program made clear that companies “have no excuse for burying notice of IBA deep within their privacy policy,” and warned that consumer complaints about the lack of enhanced notice are on the rise. The self-regulatory body received about 4,000 complaints in 2017, a 21 percent increase over the prior year. “Companies who wish to play the odds in hopes of evading our scrutiny and that of the general public may well find themselves the subject of yet another Accountability Program inquiry.”