The Digital Advertising Alliance (DAA), the self-regulatory program for online behavioral advertising (OBA), was busy last week, releasing four formal review decisions.
The cases discussed below highlight DAA’s commitment to spreading consumer awareness about OBA, educating consumers on OBA activities, and providing consumers with options regarding the collection of their data. The cases were initiated by DAA itself, and not by competitors or consumers. OBA activity is a relatively unregulated area, and consumer protection authorities have largely relied on businesses self-regulating to protect consumers. To avoid heavier regulation, it is important that businesses make concerted efforts to be aware of and comply with DAA’s Self-Regulatory Principles for Online Behavioral Advertising (OBA Principles).
Scottrade
In a case involving Scottrade, Inc., DAA held that when third-party data collection for OBA occurs on a first-party website, companies must meet the notice and choice obligations of its OBA Principles. The OBA Principles have four main requirements for disclosing data collection used for OBA. First, the website must contain a disclosure explaining that OBA activity may be occurring on the site. Second, the disclosure must either link to an industry-developed consumer choice page or must individually list all of the third parties conducting OBA activity on the website. Third, the website must ensure that an enhanced notice link is present on every page of its website where data collection or OBA takes place. This notice should direct users to the website’s OBA disclosure. Finally, the website must state its adherence to the OBA Principles either by an enhanced notice link using DAA’s AdChoices logo, or by directly stating so in its OBA disclosure.
DAA found that Scottrade allowed third parties to collect OBA information on its website, but that it did not comply with any of the above OBA Principles. The company made immediate efforts to bring its website into compliance with the OBA Principles. DAA commended Scottrade for its quick compliance in implementing an enhanced notice link that stated its adherence to the OBA Principles, and that sufficiently explained the OBA activity on its site.
23andMe and 3Q Digital
In a set of related cases, DAA investigated an advertiser and the digital advertising agency it had hired to serve ads on its behalf. The advertiser, 23andMe, Inc., allowed third parties to collect data for OBA on its website, but did not provide enhanced notice on any of its web pages about such data collection. Additionally, 23andMe, through its hired digital agency 3Q Digital, engaged in its own OBA and served its own ads on third-party websites to users who had previously visited the 23andMe website. 23andMe did not provide a statement of adherence to the OBA Principles, but did provide an extensive discussion of its use of cookies in its privacy policy, along with the URL of an industry-developed website where consumers could exercise choice.
Regarding the collection of data by third parties for OBA on the 23andMe website, DAA found that 23andMe, despite its privacy policy, did not provide “clear, meaningful, and prominent” notice to signal to a user that data was being collected by third parties. DAA recommended that OBA provide an enhanced notice link directing users to a location where users could make choices regarding data collection and OBA.
Regarding serving its own ads on third-party websites, DAA found that the ads did not comply with the OBA Principles requiring an OBA ad to carry a real-time notice that the ad was a result of OBA. Such real-time notice is usually included in the form of the DAA AdChoices logo, which, when clicked, takes the consumer to a location where he/she can make an informed decision about participating in OBA activity.
Both 23andMe and 3Q digital took immediate steps to implement the recommendations of DAA, and bring their sites and practices into compliance with the OBA Principles.