In its first ever compliance warning, the Online Interest-Based Advertising Accountability Program Council (“Accountability Program”) noted that many website operators are omitting notices of data collection for online behavioral advertising (“OBA”) on their websites where third parties, such as ad networks, are not able to provide notice without the website operator’s assistance. Such notices are required under the Self-Regulatory Principles for Online Behavioral Advertising (“OBA Principles”).
In an effort to encourage compliance, the Council has delayed enforcement against first parties that fail to provide the required enhanced notice beginning until January 1, 2014.
The Council is authorized by the Digital Advertising Alliance (“DAA”) to enforce the OBA Principles. Both websites operators and third parties must take steps to ensure they are meeting their requirements under the OBA Principles. Per its compliance warning, the transparency mandate of the OBA Principles requires that all covered entities ensure that consumers have “real-time notice and an easy-to-use way to exercise choice” whenever third parties collect browsing activity for OBA purposes. Such enhanced notice must include a “clear, meaningful, and prominent link” provided by the website operator on each page where data is collected. The link should take the consumer directly to the website operator’s disclosure of third-party OBA activity that either points to an industry-developed Web page such as the DAA’s Consumer Choice Page or individually lists all the third parties engaged in OBA on its website and provides links to each of their respective choice mechanisms. This link must be separate and distinct from the website’s privacy policy. If a website operator decides to individually list all the third parties engaged in OBA on its website, then this list must be “accurate, comprehensive, and up-to-date” at any given time. This necessitates that the website operator have sufficient technical and contractual safeguards to prevent unauthorized third parties from engaging in OBA information on its site.
The Accountability Program also reminded website operators not to rely on in-ad notifications, such as the AdChoices Icon, provided by third party data collectors to satisfy their enhanced notice obligations. Per the warning, “[u]nless an ad bearing in-ad notice is served on every Web page of a publisher’s site where third parties are collecting data for OBA and that notice directs a consumer to the choice mechanisms of all third parties collecting on that Web page or to an industry-developed choice mechanism, the Transparency Principle’s enhanced notice requirement for collection is not satisfied.” In other words, the website operator is responsible for providing enhanced notice and choice on every page where they allow third parties to collect data for OBA purposes.
Companies need to act now, and not wait until January 1, 2014. Otherwise, they run the risk of enforcement. If your company needs further explanation or an extension, you should email Genie Barton, Vice President and Director of the Accountability Program, or Jon Brescia, Compliance Coordinator, of the Accountability Program as soon as possible. While the Accountability Program is part of the industry’s self-regulatory infrastructure, it is imperative that industry participants comply to avoid more intrusive and restrictive Congressional legislation or regulation.