DAA Mobile Guidance Enforcement Preparation: September 1, June 23, 2015

Transcription

1 DAA Mobile Guidance Enforcement Preparation: September 1, 2015 June 23, 2015

2 DAA Mobile Accountability September 1, 2015 U.S. enforcement date for DAA Mobile Guidance Council of Better Business Bureaus and the Direct Marketing Association Active monitoring Complaint based system Independent of DAA Take aways (What you should do when you get back to your office)

3 TODAY S PRESENTERS Lou Mastria, CIPP, CISSP, Executive Director, Digital Advertising Alliance Michael Signorelli, Partner, Venable LLP & Counsel, Digital Advertising Alliance

4 DAA Principles cover interest-based advertising and multi-site data collection Self-Regulatory Principles for Online Behavioral Advertising Self-Regulatory Principles for Multi-Site Data: Principles.pdf Enforcement provided by CBBB and DMA

5 DAA Principles for Interest-based Advertising Self-Regulatory Principles for Online Behavioral Advertising 1. Education Principle 2. Transparency Principle 3. Consumer Control Principle 4. Data Security Principle 5. Material Changes Principle 6. Sensitive Data Principle 7. Accountability Principle

6 Accountability Principle These Principles are self-regulatory in nature and entities engaged in the collection of Cross-Site Data, Cross-App Data, Precise Location Data, and Personal Directory Data are within the scope of the DAA s accountability programs. Elements of DAA Accountability: Independence Monitoring Transparency & Reporting Compliance

7 Accountability Snapshot: CBBB & DMA 50+ Public Decisions and Compliance Advisories Processed more than 10,000 consumer inquiries Issued compliance guidance on a full range of advertising issues Directly counseled hundreds of companies

8 FTC Bureau of Consumer Protection Director Jessica Rich Over the years, the FTC has emphasized that when implemented in tandem, self-regulation and government oversight provide valuable efficiencies and benefits. In fact, well-constructed industry programs with certain hallmarks (1) clear requirements, (2) widespread industry participation, (3) active monitoring, (4) effective enforcement, (5) procedures to resolve conflicts, (6) transparent and independent processes, and (7) responsiveness to changing markets and consumers offer some clear advantages over government regulation alone. They can be more prompt, flexible, and responsive than when we only enforce through statutes and regulations. They also can be better tailored to reach to particular categories of marketing or particular categories of businesses.

9 FTC Commissioner Maureen Ohlhausen

10 DAA Principles for Multi-Site Data Collection Self-Regulatory Principles for Multi-Site Data: Data-Principles.pdf The cross-industry Self-Regulatory Principles for Multi-Site Data augment the IBA Principles by covering the prospective collection of Web site data beyond that collected for advertising allowing for other permissible business purposes.

11 DAA s mobile journey Mobile Guidance Released July 2013 Creative Ad Specification for DAA Icon in Mobile April 2014 Consumer Choice Page for Mobile Web February 2015 AppChoices February 2015 Accountability September 1 Enforcement!

12 DAA offers specific mobile guidance for application of its Principles Application of Self-Regulatory Principles to the Mobile Environment, This guidance explains how the existing IBA Principles and MSD Principles (the DAA Principles) apply to certain types of data in the mobile Website and application environment.

13 Guidance for four specific mobile data types This guidance responds to the fact both First Parties and Third Parties operate across a variety of channels, including mobile. As marketers, we are multi-screen. Addresses First- and Third-Party obligations with respect to the following data practices: (1) Multi-Site Data (2) Cross-App Data (3) Precise Location Data (4) Personal Directory Data

14 Who may be covered by the Guidance in mobile environments? First Party: An entity that is the owner of an application, or has control over the application, with which the consumer interacts, and its Affiliates. Third Party: An entity is a Third Party to the extent that it collects Cross-App Data or Precise Location Data from or through a non-affiliate s application, or collects Personal Directory Data from a device.

15 Are there limited purposes for mobile data collection & use not covered by the Guidance? Consistent with Multi-Site Data Principles, transparency and control should be provided for Cross-App Data, Precise Location Data or Personal Directory Data except: For operations and system management purposes: o o o o o Intellectual property protection compliance, public purpose and consumer safety; authentication, verification, fraud prevention and security billing or product or service fulfillment Reporting or Delivery (as defined in existing Principles) For Market Research or Product Development; or Where the data has or will within a reasonable period of time from collection go through a De-Identification process.

16 Multi-Site Data from Mobile Web Data Collection across Mobile Web Pages Already Covered by IBA & MSD Principles and Enforced by DMA & CBBB

17 Cross-App Data Cross-App Data Cross-App Data: Data collected on a particular device regarding application use over time and across non-affiliate applications Principles: First-party collection and use not covered Third party provides the enhanced notice, choice

18 Location and Directory Data Precise Location Data & Personal Directory Data Precise Location Data: Data about the physical location of a device that is sufficiently precise to locate a specific individual or device Personal Directory Data: Certain data (e.g. calendar, address book) created by a consumer that is stored on or accessed through a device

19 Mobile Specifications for Use of the DAA Icon How to Deploy the DAA Icon in Mobile Creative: Example 1: In-App, In-Ad Example 2: In-App in settings More examples and use cases in DAA Creative Ad Spec for Mobile

20 Mobile Web Guidance from the DAA Creative Ad Spec

21 DAA Choice In Mobile LIVE! AppChoices Consumer Choice Page for Mobile Web + = User Choice in Multi- Screen Platforms

22 How These New Mobile Choice Tools Developed In 2013, the DAA self-regulatory program proposed an industry-wide mobile "opt-out" mechanism that provides consumers with transparency and choice under the DAA Principles. The DAA had already successfully established a crossindustry opt-out tool for Web users back in 2010 ( focusing on desktop. In February 2015, we rolled out 2 new tools for Mobile: Consumer Choice Page for Mobile Web & AppChoices

23 Mobile Privacy Enforcement Comes September 1, 2015

24 DMA Accountability Program: Enforcement Compliance enforced against DAA Participants and non- Participants Complaints from consumers, companies, consumer protection agencies. Casework is prepared by the DMA Accountability Staff and reviewed by the DMA Ethics Operating Committee. Process is confidential to ensure due process and to help get the company into compliance. In the event that a company (regardless of DMA membership status) fails to come into compliance, serious actions can be taken: Suspension or revocation of DMA membership Public reporting of non-compliance Referral to state or local regulatory authorities

25 DMA Accountability Program: Metrics 13,500 consumer and company complaints received 85% resolved in initial stages by DMA Accountability Staff 1,100 incidents of DMA Guidelines violations, including DAA-related Queries cases opened 96% resolved by DMA Accountability Staff through correspondence with company 48 cases referred to DMA Ethics Operating Committee 11 cases of continued non-compliance made public 11 non-members Referrals to FTC, FCC, State Attorneys General (NY, OR) 1 case of DAA non-compliance

26 ASRC Self-Regulation: Components Created by the leading Advertising Trade Associations to Promote Truthful and Ethical Advertising Practices Independently administered by the Better Business Bureau, under ASRC Board s policy guidance National Advertising Division (1971) Children s Advertising Review Unit (1974) Electronic Retailing Self-Regulatory Program (2004) Online Interest-Based Advertising Accountability Program (2011)

27 ASRC Accountability Program Compliance Investigations Staff monitoring of companies in the cross-industry interestbased advertising ecosystem Privacy Dashboard generated weekly Confidential complaints from multiple sources Expert consultants on specific compliance issues

28 ASRC Accountability Program: Metrics Over 2,000 companies reviewed for compliance issues Over 100 companies provided with confidential compliance counseling More than 50 formal inquiries where compliance issues found, resulting in companies achieving compliance Three industry-wide compliance warnings issued Only 1 referral to government agency necessary for company that would not participate in compliance process

29 Accountability Program Quick Compliance Review for Mobile Enforcement: This Isn t New Accountability Program decisions and compliance warnings applicable in the mobile environment All parties in the ad chain must communicate and work together to ensure enhanced notice and choice are provided Transparency and Consumer Control must be provided no matter what technology is used for IBA (2012 case and 2014 Compliance Warning) Native or not, if its IBA, the rules apply

30 Wrap Up: Your Mobile To Do List Mark your calendar! DAA Mobile Guidance Enforcement will take effect September 1, 2015 Get familiar with DAA Mobile Guidance Assess and document your mobile ad supply chain Audit your own mobile data collection and use throughout the supply chain, and know what is cross-site, cross-app data Understand your role and obligations as a first and/or third Party Watch closely categories of sensitive information

31 Ask Now Ask Now Ask Now Lou Mastria, CIPP, CISP DAA Michael A. Signorelli Venable LLP