Who: Digital Advertising Alliance and the Better Business Bureau
Where: USA
When: November 2013
Law stated as at: 9 December 2013
What happened:
The Digital Advertising Alliance (DAA) has recently released a formal review decision by the Better Business Bureau Advertising Accountability Program concerning an online ad campaign for 23andMe, a genetic testing company. The allegation was that there had been failure to comply with the Self-Regulatory Principles for Online Behavioural Advertising (the “Principles”).
In addition the Better Business Bureau or “BBB” (a sort of US equivalent of the UK’s Advertising Standards Authority) issued a compliance warning noting that many website operators are failing to include data collection notices for Online Behavioural Advertising (OBA) where third party ad networks are not able to provide notice without the assistance of the website operator.
The BBB is authorised by The Digital Advertising Alliance (DAA), the American self-regulatory body for Online Behavioural Advertising (OBA), to enforce the Principles. The BBB has delayed enforcement action until 1 January 2014.
Background:
The 23andMe case concerned the obligation to provide enhanced notice on websites both when interest-based adverts appear and also in relation to third party OBA collection, thus offering consumers choice on the collection and use of their data by Advertisers. This notice should be provided on the website on each page where the data is collected at the time of data collection. Entities that collect OBA data from their own website and use OBA data to generate interest-based ads will need to provide two separate notices to consumers; the first on its own website and the second on the advert itself.
The OBA Principles have four main requirements for disclosing data collection as follows:
• The website must contain a disclosure that OBA activity may occur on the site;
• The disclosure should list all the third parties conducting OBA activity on the site or link to an to an industry developed web page such as the DAA Consumer Choice Page;
• An enhanced notice link should be present (directing users to the website OBA disclosure) on every page where OBA takes place or there is data collection. This should be separate from the Privacy Policy;
• The website must state its adherence to the Principles either in the link using the DAA Adchoices logo or by a statement in its OBA disclosure.
The DAA investigated the advertiser (23andMe),its digital advertising agency (3Q Digital) and Media Math, which provided the demand side platform.
23andMe were found to have allowed a third party to collect the data from its website without providing an enhanced notice about this collection. The DAA found that 23andMe did not provide a “clear, meaningful and prominent” notice on their website to indicate to consumers that their data was being collected.
In addition 23andMe, through the agency Q3 Digital, implemented its own OBA to serve its own adverts on third party websites to users who had already visited the 23andMe website. In this instance, although 23andMe did have extensive coverage of its use of cookies in its privacy policy, it did not display the necessary statement of adherence to OBA Principles. Also, the adverts did not comply with the requirement that they carry a real-time notice that the advert is shown as a result of OBA. 23andMe, 3Q Digital and Media Math all stated that each had expected the other party to provide this information. After the BBB determination they took action to implement the DAA’s recommendations.
Why this matters:
These cases indicate the DAA’s aim of increasing consumer awareness of OBA in the US and giving consumers choice and transparency in relation to the collection of their data.
This is surely further indication that various authorities are increasing their regulation of OBA in order to increase transparency on the process for consumers and there is a potential for increased regulatory action after 1 January 2014.
It will be interesting to see if these developments spur the UK’s Advertising Standards Authority to take further enforcement action in respect of the equivalent rules in the UK (as contained in amendments to the CAP Code) and publish their first determination in a specific case.
