Accountability Program Makes Clear that All Technologies Must Comply with Industry Self-Regulatory Standards
BlueCava, Turn, DataXu, and OxaMedia Achieve Voluntary Compliance with Self-Regulatory Principles as Accountability Program Expands Its Enforcement and Compliance Guidance
Arlington, VA – May 30, 2012 – The Online Interest-Based Advertising Accountability Program (Accountability Program) today released the results of formal inquiries into the consumer data-collection and use practices of seven companies in the online advertising industry. All companies reviewed voluntarily agreed to follow the Accountability Program’s recommendations.
“The results are a win for both consumers and industry,” said Genie Barton, CBBB Vice President and Director of the Program. “Consumers benefit with greater information and clearer choices about how their information is used and the advertising industry benefits by building greater consumer trust and engagement in the Internet space.”
The Accountability Program provides objective, independent, and vigorous oversight and enforcement of the Self-Regulatory Principles for Online Behavioral Advertising (OBA Principles), a set of best practices developed by leading advertising trade associations that address consumers’ concerns about interest-based advertising practices.
Today’s decisions provide guidance on specific implementation requirements under the OBA Principles, including clarifying that:
The Transparency and Consumer Control Principles cover all technologies (not just browser “cookies”) in the interest-based advertising space, including device fingerprinting;
- Consumer disclosures should explain the company’s OBA practices and clearly notify consumers that the company adheres to the OBA Principles; and
- Consumer opt-out mechanisms must have a five-year duration, and once a consumer has opted out, this choice must be honored at all times, including during exchanges of information such as cookie synching.
“A great strength of the self regulatory process is that it can adapt to changing conditions and technologies,” said Ms. Barton. “Today’s decisions demonstrate that. We are delighted that each of the companies reviewed have voluntarily modified their practices.”
The decisions focus on the cornerstones of the OBA Principles — Transparency and Consumer Control.
- Transparency: The Transparency Principle is designed to give consumers knowledge about OBA data collection and use practices that take place invisibly ‘behind the scenes.’ Companies are required to provide clear explanations about how they use consumers’ data for OBA, including providing “just in time” notice where data is collected and interest-based advertising is served.
- Consumer Control: The Consumer Control Principle provides consumers with an easy-to-use choice mechanism that allows them to opt out of OBA.
- Transparency, choice and accountability are core elements of both the Obama Administration’s proposed Privacy Bill of Rights and the Federal Trade Commission’s recent privacy report and recommendations.
BlueCava: The Accountability Program decision explained that transparency and choice are not limited to traditional “cookie-based” tracking practices but also cover all technologies in the interest-based advertising space, including device fingerprinting.
The Accountability Program also noted that the spirit of the OBA Principles is to provide an easy-to-use opt out that is co-extensive with the data collected for OBA purposes and suggested that BlueCava, if technically feasible, provide a multi-device opt out. BlueCava agreed with the Accountability Program’s reasoning and has pledged to make the development of this multi-device opt-out mechanism part of its product development work.
DataXu: DataXu’s website consumer choice mechanism set an opt-out cookie that was rendered non-functional by the absence of a domain attribute. As a result, consumers who exercised choice through the DataXu website when using the Chrome, Firefox, Opera or Safari browsers were not opted out of data collection and use for OBA purposes. DataXu promptly remedied the issue with its opt-out cookie and has taken steps to ensure its opt-out cookie will remain functional and compliant with the OBA Principles.
OxaMedia: OxaMedia ,based in the United States, with a subsidiary in Verona, Italy, was unaware of the OBA Principles. As a result, it did not follow a number of these industry best practices. Its opt-out cookie was set to expire one year from the date a consumer completed the opt-out process; it did not provide enhanced notice and choice to the consumer regarding its OBA practices when it served an interest-based ad. Upon notification by the Accountability Program of the requirements of the self-regulatory program, the company licensed the use of the DAA Advertising Options Icon to provide enhanced notice and choice of its data collection practices for OBA on its interest-based ads and brought all its practices into compliance with the OBA Principles.
Based on the representations of the companies below that they are not presently engaged in OBA, the Accountability Program administratively closed the inquiries but will continue to monitor as part of its ongoing work:
Gravity: a provider of personalization tools for publishers, which has followed the Accountability Program’s recommendation and changed its opt-out cookie to the industry standard of five years.
Rovion: an ad management platform for publishers and agencies, which has followed the Accountability Program’s recommendation and changed its opt-out cookie to the industry standard of five years.
Facilitate Digital Holdings: a provider of digital marketing technology and services, which agreed to follow the Accountability Program’s recommendation to change its opt-out cookie to the industry standard of five years but has not yet done so.
The Accountability Program’s inquiries were conducted under Online Interest-Based Advertising Accountability Program Procedures which are available here.