The five main advertising associations in the USA, backed by a number of leading multinational companies, have published Self-Regulatory Principles for Online Behavioural Advertising. Andy James from Osborne Clarke’s Silicon Valley office guides us through the principles.
Topic: Online advertising
Who: US advertising industry associations
When: July 2009
Where: USA
Law stated as at: 31 July 2009
What happened:
Online behavioural advertising ("OBA") is advertising targeted at specific users based on data regarding that user's activity across the internet, most commonly tracked using cookies. It is now an area of increasing sophistication and complexity as new technologies emerge to enable greater information to be obtained and stored by websites about how individuals view and use them. It is considered very different to the more traditional forms of internet advertising, such as banner adverts and contextual advertising, due to the level of detail collected about specific users which is then utilised in the targeting of advertising. But it is for this very reason that it is so attractive to advertisers – a user is much more likely to respond to an advert which is directly within his or her interests and habits.
OBA has been the subject of much press hype and therefore regulatory attention in the USA recently, with the implications for individuals' privacy causing growing unrest amongst both consumer groups and at the political level. The Federal Trade Commission ("FTC") has been stepping up its enforcement action in the area following the publication of its proposals on industry guidelines in February 2009 (see http://marketinglaw.co.uk/articles/2008/9720.asp).
In response to the FTC's proposals, the five main US advertising associations (the American Association of Advertising Agencies; the Association of National Advertisers; the Council of Better Business Bureaus; the Direct Marketing Association; and the Interactive Advertising Bureau), backed by a number of leading multinational companies such as Google, Microsoft, and Coca Cola, published the Self-Regulatory Principles for Online Behavioural Advertising (the "Principles") at the beginning of July. The Principles establish recommended practices for providing consumers with greater control over how data about their web-based activities is collected, stored and used by all parties in the advertising lifecycle, so not just advertisers themselves, but also advertising networks, publishers, and perhaps most interestingly, service providers (including ISPs).
In summary (the full document can be found at http://www.iab.net/media/file/ven-principles-07-01-09.pdf), the proposed requirements are:
- Education of the public through the provision of several industry-run websites providing educational information about OBA and users' choices.
- Transparency about how an entity will collect and use data about website users, including new links and disclosures on the web page wherever OBA takes place.
- Consumer Control – providing mechanisms to allow users to choose whether data is collected, used or transferred to non-affiliated companies for OBA.
- Ensuring Data Security for data collected and used for OBA, as well as limited retention of such data.
- Obtaining prior consent for any material changes to the data collection and use policy making it less restrictive.
- Applying greater protection for sensitive data, such as children's data, financial information and medical information.
- Accountability of the advertising bodies who are party to the Principles to set up policing mechanisms for their members.
Many of these will look very familiar to anyone used to the European approach to privacy as a whole, and in particular look comfortingly similar to the UK's Internet Advertising Bureau's OBA guidelines which were released in March this year.
Why this matters:
As Osborne Clarke's survey of 42 countries conducted in March this year showed, online behavioural advertising is one of the hot topics across the world this year, with many significant developments even over the past few months. These developments include the rise and fall of Phorm in the UK and the associated EU case against the UK government (as reported in the May edition of marketinglaw.co.uk: http://marketinglaw.co.uk/articles/2009/11757.asp).
The application of these guidelines goes far beyond the traditional "advertising industry", applying to pretty much any company with a website which wishes to monetise its website traffic through targeted advertising. In particular, the application to ISPs and internet browser (including toolbar) providers of the transparency and consumer control principles will be one of the most eye-catching changes: users should see prominent wording and links to a disclosure page including lists of all the entities that collect data on a given website, as well as a choice to opt in or opt out of such collection and use of the data.
The development of self-regulatory guidelines of this type shows that the industry on both sides of the Atlantic is keen to avoid the heavy hand of legislative regulation. But this type of regulation also has the potential to avoid the problem of unwieldy legislation which will fast become outdated as the technological capabilities, and individuals' willingness to sacrifice their privacy for the sake of convenience, shift with the times and the emergence of a generation which has never known life without the internet. This careful balancing act is brought into sharp relief by OBA, which will continue to be at the forefront of the privacy debate for some time to come. Of one thing you can be sure – this won't be the last you will hear about OBA this year!
