Time was when data protection watchdog the Information Commissioner’s Office laid down a marker requiring prior opt in before “deep packet inspection” online behavioural advertising technology was deployed. Phil Lee wonders whether ICO has now quietly changed its view.
Topic: Privacy
Who: Information Commissioner's Office
When: March 2009
Where: UK
Law stated as at: 27 March 2009
What happened:
The debate about the protection of individual privacy on the Internet could be about to take a new twist with the apparent removal of a statement supporting an opt-in regime for online behavioural advertising ("OBA") from the website of the Information Commissioner's Office ("ICO").
Until recently, ICO has been very clear that advertisers wishing to use OBA platforms must operate on the basis of opt-in consent. However, recent developments – including the unannounced update to ICO's website – have suggested a possible change of heart by ICO, indicating that it may now be prepared to allow advertisers to run OBA on an opt-out.
The story so far
Phorm hit the headlines last year when it announced its "privacy-friendly" OBA platforms, the Open Internet Exchange and Webwise. After press outcry, ICO released a statement in April 2008 (previously available on the Information Commissioner's website) effectively requiring Phorm to operate on the basis of opt-in consent. Even if Phorm was not processing "personal data" about users, ICO said, it still processed users' Internet "traffic data" and required opt-in consent for this.
Latest developments
Three recent developments have suggested a softening in ICO's attitude towards the consent requirements for OBA:
- IAB "Good Practice Principles": On 4 March, the Internet Advertising Bureau produced a set of OBA "Good Practice Principles", endorsed by industry players such as Google, Microsoft and Yahoo! and also by Ofcom. The principles place a strong emphasis on opt-out, although there is ambiguous wording in attached "Guidance" which talks about having to obtain "specific consent" where required by law or "applicable regulatory guidance." ICO has welcomed these Principles, with Assistant Commissioner Phil Jones going on the record to say that ICO is: "pleased that the online advertising industry has come together to produce these guidelines."
- Google AdSense: On 11 March, Google announced its intention to operate an OBA platform on the basis of opt-out (user opt-outs being stored permanently) (see http://news.bbc.co.uk/2/hi/technology/7937201.stm). Despite this, Google appears to have the backing of ICO, with ICO reported as saying: "… we are pleased that [Google's] preference manager feature allows users a high level of control over how their information is used and that the method by which users can choose to opt out is saved permanently."
- Unannounced updating of ICO's website: In a surprise development, ICO now appears to have removed its statement addressing Phorm's OBA technology, requiring it to operate on the basis of opt-in consent, from its website. The statement URL now brings up a "Page Not Found" error. ICO has not made any announcement about the removal of the statement.
Why this matters:
Since its introduction, OBA has been dogged by controversy. On the one hand, marketers see it as having enormous potential to deliver targeted, relevant advertising direct to users. On the other hand, the public and press have expressed alarm at the lack of user transparency and control offered my many OBA platforms – this concern probably best illustrated by this quote taken from the founding father of the modern-day Internet, Sir Tim Berners-Lee:
"We use the Internet without a thought that a third party would know what we have just clicked on… Yet the URLs [webpages] people use reveal a huge amount about their lives, loves, hates and fears. This is extremely sensitive information… There will be a huge commercial pressure to release this data… The principle should be that it is not to be collected in the first place" (quoted in the Guardian 10/3/09).
A requirement for OBA platforms to operate on the basis of opt-in consent could be seen as something of a death knell for the technology. However, if advertisers can operate OBA platforms on an opt-out basis and adhere to the IAB Principles, this may significantly reduce public disquiet about the technology.
For the time being, uncertainty persists as to whether opt-in or opt-out is required, but these latest developments suggest there is hope for the advertising industry on the horizon. We can only hope that ICO clarifies its position soon.
Osborne Clarke's OBA survey
With a view to getting greater clarity on local territorial laws affecting OBA, Osborne Clarke has recently completed a survey across more than 40 jurisdictions (including the UK, EU, US and Canada) on local OBA opt-in and opt-out rules. The results of the survey will be published on Osborne Clarke's Marketing Law website next month (www.marketinglaw.co.uk) – so, be sure to not to miss the April publication of Marketing Law!
An edited version of this article was first published by the Society for Computers and Law on 20 March 2009, and can be accessed at http://www.scl.org/site.aspx?i=ne11257.
