“Flawed and inefficient” was how CNIL, France’s equivalent to the ICO, described the opt-out mechanisms offered to consumers by many online behavioural advertising businesses in a recently published report. Claire Bouchenard writes from Paris on the recommendations in the report for improving transparency and choice.
Topic: On-line advertising
Who: The French Data Protection Authority ("CNIL")
Where: France
When: February 5, 2009
Law stated as at: 30 June 2009
What happened:
The French Data Protection Authority (CNIL) has published a report on on-line targeted advertising detailing recent developments in this sphere, the threats to the online privacy of individuals and the potential remedies.
It might be said that there are three kinds of on-line targeted advertising: personalized advertising which is a function of the features divulged by the individual himself, contextual advertising which is a function of the literal content of the webpages viewed by the individual and behavioural advertising which is a function of observing an individual’s online behaviour through time.
Broadly there are two ways in which online advertising companies build user profiles: either the profiles are based on information given by the user when for instance he subscribes to a service (explicit profiles with personal data) or they are based on observing users at a given moment or over time using cookies and generating predictive profiles using anonymous data.
The CNIL report identifies a market tendency towards convergence between the different online advertising stakeholders, especially between the advertising suppliers (media owners/ publishers) and the content or services suppliers, as for instance the recent acquisition of DoubleClick by Google. So now, the advertising stakeholders can exchange explicit and predictive profiles and benefit from a pool of precise data, in order to better target advertising messages.
Why this matters:
The CNIL report identifies the following threats which these practices present to the online privacy of individuals:
– advertisers are going to be very interested in buying such precise data profiles which can be used to select prospective customers or applicants (loan, health insurance, etc.), to recruit employees or to modulate prices,
– more and more data and notably sensitive data (health, political opinions, sexuality, etc.) are stored and there is a risk that computer systems can be hacked and the data stolen,
– the lack of information supplied to individuals about the data about them which are collected and about the profiling mechanisms deployed. Usually, they do not know that they can opt-out of receiving targeted advertising. Furthermore, this opt-out cookie has to be reinstalled each time the individual clears his browser’s cookies, and only deals with the use of the data for marketing purposes, not with their collection. In this respect, if the individual chooses to block cookies, he will have access to almost none of the Web services.
To find remedies to this problematic situation, the CNIL recommends:
– the adoption of a wide definition of what is a "personal data" including the IP address of a computer terminal on the basis that since the content of an ad is targeted as a result of being based on a pre-defined profile, personal data protection law should apply,
– clearly and fully informing Internet users of the installation of cookies even if the collected data are not personal but anonymous, of the purposes of such an installation and of the way how they can prevent it,
– encouraging the adoption of codes of conduct and of good practice by marketing professionals and the application of the opt-in rule,
– increasing Internet users' awareness of how to control and delete the tracking of their Internet usage,
– bringing into line websites and all other online advertising stakeholders to improve their compliance with data protection laws,
– distinguishing tracking cookies from other types of cookies in order to facilitate their control.
Targeted and behavioural advertising is booming. The trick now will be to find the means by which individuals should be informed and the tools by which the protection of their rights can be assured.
Claire Bouchenard
Avocat a la Cour
Paris
Claire.bouchenard@cb-avocat.fr
