Who: Network Advertising Initiative (NAI)
Where: USA
When: 18 May 2015
Law stated as at: 12 June 2015
What happened:
The Network Advertising Initiative (NAI) has released “Guidance for NAI Members: Use of Non-Cookie Technologies for Interest-Based Advertising Consistent with the NAI Code of Conduct”. The guidance explains how the NAI’s Code – originally conceived at a time when online behavioural advertising was predominantly cookie-enabled – should be applied in the context of non-cookie technologies such as digital fingerprinting or statistical identifiers.
It makes it clear that the Code of Conduct, with its requirements to give users notice and choice regarding online behavioural advertising, is intended to be technology-neutral and applies equally whether or not cookies are used. This means the following requirements (amongst others) still apply where non-cookie technologies are used:
General description of technologies used. The provider must describe in a readily accessible privacy notice the technologies used for interest-based advertising. If non-cookie technologies are used, the guidance says this fact must be specifically called out.
Third party websites: Where data for interest-based advertising is collected through third-party websites that the provider has a contract with, it is obliged to use reasonable efforts to get the website operator to post clear and conspicuous disclosures, including of the fact that non-cookie technologies may be used by third parties.
Opt-out mechanism: Providers are also obliged to make available a link to an easy-to-use opt-out mechanism allowing users to exercise choice to disallow interest-based advertising with respect to a particular browser or device (and to use reasonable endeavours to get website operators to include a similar conspicuous link).
However the NAI’s centralised opt-out mechanism has to date only been designed to work for cookie-enabled interest-based advertising. This is now being redesigned to allow users additionally to learn whether particular NAI members are using non-cookie technologies to collect data for interest-based advertising, and to enable an opt-out. The guidance suggests that an icon will also be made available to be used as an indicator that a non-cookie technology is being used.
Some example wording is provided in an Addendum to the guidance, showing what non-cookie disclosures might look like in a privacy notice.
Why this matters:
With nearly 100 members, including the likes of Google, Yahoo! and Microsoft, the NAI represents a substantial proportion of the adtech eco-system. These developments therefore mark a significant step-change in market practice.
Advertisers and others wishing to keep aligned with market practice may wish to:
investigate what non-cookie technologies are used by or on behalf of their business for ad targeting;
review whether entities in their ad targeting supply chain are falling into line with the requirements of the NAI Code; and
consider updating cookie policies and privacy notices to include information about non-cookie technologies.
In fact, have we reached the point where it’s time to rename and re-cast the “Cookie Policy” to be something less focused on one specific technology (ie cookies)? Sure, article 5(3) of the Privacy and Electronic Communications Directive has meant that targeting using cookies (or other information stored on the user’s device) requires special treatment in Europe whether or not “personal data” is processed. However, with the direction of travel of the draft Data Protection Regulation and cases such as Vidal-Hall v Google being seemingly towards a wider range of “online identifiers” being treated as personal data, the enhanced transparency and choice mechanisms provided for in the new NAI guidance may prove to be important compliance tools for the online advertising sector.
See here for the full guidance document.
