Online Interest-Based Advertising: The Road Traveled and the Road Ahead

Transcription

1 Online Interest-Based Advertising: The Road Traveled and the Road Ahead Genie Barton VP & Director, Online Interest-Based Advertising Program Advertising Self-Regulatory Council (ASRC)/ Council of Better Business Bureaus (CBBB)

2 Media Make Privacy Hot Button Issue WSJ series: What they know Google, Facebook, Mobile Apps. US Regulators Take Action White House: Privacy Bill of Rights Dept. of Commerce Multi-Stakeholder Process to Create Industry Codes Federal Trade Commission Report Cases and Proposed COPPA Revisions Congress Introduces Legislation White House proposes Bill of Rights FTC supports targeted bill (HR 2221) Bills, such as DNT Kids EU Cookie Directive Goes into Effect May deadline for EU Member States to transpose into National Law Opt-in/Opt-out debate rages Consumers Say Dislike Targeted Ads 2012 Pew study finds 68 percent of consumers don t want to be tracked

3

4

5 Self-Regulatory Program for Online Behavioral Advertising

6 What is Covered by the Program: Online Behavioral Advertising? Online behavioral advertising ( OBA ) is the collection of data from a particular computer or device regarding Web viewing behaviors over time and across non-affiliate Web sites for the purpose of using such data to predict user preferences or interests to deliver advertising to that computer or device based on the preferences or interests inferred from such Web viewing behaviors. OBA does not include: The activities of First Parties on own or affiliated sites Ad delivery using Ad Reporting data and not based on OBA inferences Contextual advertising (i.e., advertising based on the content of the Web page being visited, a consumer s current visit to a Web page, or a search query)

7 Who is Covered by the Program? First Parties: Entities that own a Web site or have Control over the Web site with which the consumer interacts and its Affiliates. Web Site Publishers Web Site Operators Third Parties: Entities that engage in OBA on a non- Affiliate s Web site. Advertising networks Data Companies (Ad Exchanges and Data Aggregators) In some cases, Advertisers Service Providers: Entities that collect / use data from all or substantially all URLs traversed by a web browser across Web sites for OBA. Service Providers may provide: Internet access Search capabilities Web tool bars Internet browsers desktop applications Software, or other similar services

8 Self-Regulatory Principles for Online Behavioral Advertising Education Transparency Consumer Control Data Security Material Changes to Existing OBA Policies and Practices Sensitive Data Accountability Released July 2009

9 Transparency Principle Advertising Option Icon The Advertising Option Icon and accompanying language should be displayed in or near online advertisements or on Web pages where data is collected and used for behavioral advertising. It gives consumers a quick way to recognize a targeted ad and make a choice. The Icon indicates adherence to the Principles. By clicking on the Icon, consumers will be able to link to: a clear disclosure statement regarding the company s OBA data collection and use practices. an easy-to-use opt-out mechanism.

10

11

12

13 Visit

14 Consumer Control Principle Consumer Opt-Out Page The Consumer Opt-Out Page on gives consumers the ability to conveniently opt-out of some or all participating companies online behavioral ads, if they choose. Organizations can register to participate and be listed on the Consumer Opt-Out Page.

15 Company Participation Opt-out page includes nearly 100 ad networks, and continues to grow Participants include all the major advertising networks, providing one stop for consumers to opt out of the majority of OBA collection and use Major brands are serving the icon Consumers are seeing the icon in the wild Yahoo! alone has served trillions of icons

16 Self-Regulatory Principles for Online Behavioral Advertising: Sensitive Data Education Transparency Consumer Control Data Security Material Changes to Existing OBA Policies and Practices Sensitive Data Accountability Released July 2009

17 Children: Sensitive Data Principle Sensitive Data Principle covers Children under 13 Forbids collection of data from websites directed to children and tracking of children known to be under 13 for OBA purposes Solving Implementation Issues: Need to identify when data is being collected or used for OBA purposes on a child-directed web site or to a child under thirteen Need to obtain parental consent and/or Find way to ensure all parties in advertising ecosystem have that knowledge, while protecting privacy of information Advertising placement and delivery takes place in time it takes a site to load We are hard at work with industry to resolve these issues

18 Self-Regulatory Principles for Online Behavioral Advertising: Accountability Education Transparency Consumer Control Data Security Material Changes to Existing OBA Policies and Practices Sensitive Data Accountability Released July 2009

19 Role of Accountability in Self-Regulation The Principles require industry-wide compliance Consumers, legislators, regulators, and competitors demand that all covered businesses be accountable Self-regulation succeeds when there is independent, vigorous enforcement across the entire ecosystem White House Bill of Rights makes Accountability a key The Council of Better Business Bureaus and the Direct Marketing Association are providing accountability for the Self-Regulatory Program We are working cooperatively to avoid duplication

20 Accountability Program Uses Many Sources to Determine Compliance Monitoring Technology provided by Evidon Complaints (consumers, competitors, or privacy advocates) Academic research Staff monitoring and research Goal: help companies to achieve compliance

21 Accountability Review Process Company receives notification of review and request for evidence of compliance Accountability Program reviews submissions and formulates recommendations At the end of the process, Accountability Program issues a public decision, including company s agreement to implement recommendations if non-compliance has been found. Accountability Program may refer company that refuses to participate, to correct non-compliant practices, or to implement recommendations to the Federal Trade Commission

22 The Accountability Program Enforcement Actions: Overview First six decisions published on November 8, 2011 Inaugural inquiries focused on the Consumer Control Principle which requires that companies provide consumers with an easy-to-use mechanism for exercising their choice To comply, a company s choice mechanism must be Clearly disclosed to consumers Easy to use Opt-out mechanism must be fully functional Opt-out must be honored for the industry standard duration of 5 years Monitoring technology platform and Accountability Program staff monitored persistence of opt-out mechanism, duration of opt-out mechanism, and other choice issues

23 Decisions Guidance Overarching guidance to companies: All companies have the obligation to monitor their data collection and advertising practices to ensure compliance with the Principles, including ensuring that their notice and choice mechanisms are fully compliant with the Principles at all times.

24 What you need to do Ensure all contracts reflect each party s obligations License icon from DAA Put on icon on every page where OBA ad is delivered or data collected for OBA purposes or ensure first party does so on your behalf Provide opt-out either through DAA opt-out page or other easy-touse opt-out mechanism Use only DAA compliant companies Display AdChoices or icon to indicate compliance and link it to opt-out located in your privacy policy and from there to DAA optout page Comply with Children s Sensitive Data Principle and ensure those in your advertising chain also adhere

25 Need Compliance Guidance? Read the Principles and Implementation Guidelines at Contact BBB: Genie Barton, Director of the Online Interest-Based Advertising Accountability Program at Contact DMA: Senny Boone, Senior Vice President, Corporate and Social Responsibility at

26 . Road Forward for DAA and Accountability Program

27 Next Frontier: Mobile OBA DAA is working to extend Principles to the complex mobile ecosystem by end of the year. MMA and GSMA have issue its own mobile OBA selfregulatory program, but no enforcement. Recent FTC negative report on apps for kids and mobile enforcement cases under COPPA DOC first multi-stakeholder issue likely: mobile apps

28 Multi-Site Data (MSD) Limitations on the collection of MSD Restriction on the use of MSD for eligibility purposes Special provisions for sensitive data Accountability requirement

29 Do Not Track DAA pledges to implement Principles through a multi-browser technical solutions within 9 months FTC has made implementation of DNT an integral part of their new recommendations

30 The Views from Washington The White House/ Dept. of Commerce Initiative The FTC Privacy Report Congressional Legislation

31 Potential Bumps in the Road Congress could act on Markey/Barton Do Not Track Kids Bill FTC could define OBA tracking as PII (see COPPA revisions and Privacy Report) DOC Multi-stakeholder process could become co-regulation

32 The White House: Consumer Privacy Bill of Rights Individual Control Transparency Respect for Context Security Access and Accuracy Focused Collection Accountability

33 DoC Multi-Stakeholder Process to Implement WH Bill of Rights NTIA will convene multi-stakeholder process to develop voluntary codes of conduct based on the White House Consumer Privacy Bill of Rights Codes will be enforceable by the FTC Stakeholders from broad range of sectors encouraged to participate Initial multi-stakeholder meetings are likely to focus on transparency in mobile device applications

34 FTC Privacy Report Privacy by Design Consumer Choice Transparency

35 FTC Recommends New Privacy Framework The privacy framework applies to commercial entities that collect or use consumer data- whether online or offline- that can be "reasonably linked" to a specific consumer, computer or device, except companies that collect non-sensitive information from less than 5,000 consumers per year and do not share the information with third parties Data is not "reasonably linked" to a consumer, computer or device if the company: (1) takes reasonable measures to ensure that the data is de-identified; (2) publicly commits to not re-identify the data; and (3) contractually prohibits downstream recipients from trying to re-identify the data, but Ed Felton says OBA likely to be PII. Choice is not required to collect and use data for practices consistent with the context of the transaction or the company's relationship with the consumer, or as required or authorized by law

36 New Recommendations Data Brokers Disclosure & Consumer Data Access: Data brokers (those collecting information on consumers where they do not have a consumer-facing relationship) should create a centralized website where they would: (1) identify themselves to consumers and describe how they collect and use consumer data and (2) detail the access rights and data choice they provide with the data that they maintain Large Platform Providers: FTC applying heightened scrutiny of large platform providers, businesses such as ISPs, operating systems, browsers and social media companies that seek to comprehensively track consumers online activities, raise elevated privacy concerns: e.g. multiplatform tracking is best exhibited in the FTC s and state regulators concerns regarding the streamlined Google privacy policy. FTC staff intends to host a public workshop on this topic in Q3 of this year. Commerce s Development of Enforceable Self Regulatory Codes: FTC staff will participate in DOC process of developing sector-specific codes of conduct and will view adherence to such codes favorably when it is reviewing company practices under a Section 5 action

37 Do Not Track What Does it Mean? Do Not Track is a concept, not a technology, but FTC wants both browser and just in time notice that provide: Universal implementation Choice mechanism that is easy to find, understand, and use Choices should be persistent System should be comprehensive, effective, and enforceable System should allow consumers to opt out from collection of behavioral data for all purposes other than commonly accepted practices

38 Congress

39 Hearings, Hearings, Hearings Last Thursday, Mary Bono Mack chaired a hearing on NTIA and FTC Proposals Bono Mack skeptical that this is the time to enact privacy legislation: Before we do any possible harm to the Internet, we need to understand what harm is actually being done to consumers. Where is the public outcry for legislation? Today, I m simply not hearing it. I haven t gotten a single letter from anyone back home urging me to pass a privacy bill. That may change and it probably will if industry doesn t come up with better safeguards for consumers in the future. But right now, we should resist the urge to rush to judgment because we feel a compelling need to do something even if we re not exactly sure what that should be.

40 Legislation Unlikely, But Two Topics to Watch Data Broker and Breach Legislation (HR Rush Privacy Bill) FTC cites this bill in its call for enactment of federal "baseline" privacy legislation, data security and data breach legislation, and legislation governing data brokers, particularly the right to access and dispute data held by data brokers Strict privacy standards in bill Children s Online Privacy Legislation (HR 1895, 2011 Markey/Barton Do Not Track Kids Online)

41 FTC Chairman Supports DAA/BBB Self-Regulation Today, although it is still a work in progress, the ad industry has obtained buy-in from companies that deliver 90 percent of online behavioral advertisements; and, with the Better Business Bureau, it has established a mechanism with teeth to address noncompliance, backed up with FTC enforcement. Jon Leibowitz at White House announcement of the Privacy Bill of Rights