The self-regulatory group, Network Advertising Initiative (“NAI”), has issued new guidance, in which it mandates that its members obtain opt-in consent from consumers before collecting or using “sensitive” data for ad delivery and reporting, as well as for ad targeting.

Specifically, the guidance states that a member must obtain a user’s opt-in consent for the use of precise location information, sensitive data such as sexuality and certain health-related data, sensor data, and personal directory data for tailored advertising or ad delivery and reporting (ADR). Opt-in consent requires “clear and conspicuous notice” that should take the form of a detailed just-in-time notice that is provided prior to the use of platform-provided consent mechanisms. The guidance describes the NAI’s goal in instituting this notice requirement as “ensur[ing] that a user is presented detailed notice of the uses of data prior to, not after, making a choice.”

Further, the guidance requires members that collect raw data and then convert it into a segment must now provide a detailed notice and acquire opt-in consent.

Because many NAI members do not themselves interact directly with users, they will need to implement the guidance through contracts with their publishers or app developers.

The guidance, which was issued as part of the NAI’s 2020 Code of Conduct, will go into effect on January 1, 2020.

Takeaway: The NAI’s guidance marks a significant change from previously allowing its members to rely on a platform for opt-in permission to now requiring just-in-time notice where consumers are provided clear, detailed information about the collection and use of their data before the give consent.