Interest-based advertising (IBA), also known as behavioral advertising, creates profiles of consumers based on their online activities over time and across services, and uses them to send consumers relevant, targeted ads. To try to prevent the kind of opt-in legal requirements imposed in other countries on this kind of Internet user tracking and targeting, the U.S. advertising industry’s leading trade organizations came together, through the Digital Advertising Alliance (DAA), to develop self-regulatory requirements that include transparent notice to consumers when IBA is occurring (both for data collection and ad targeting) and choice through an opt-out option. The ad networks and exchanges that serve IBA have been actively policed by the DAA for years through its enforcement vehicle, the Online Interest-Based Advertising Accountability Program (OIBAAP). The OIBAAP has recently issued decisions in four cases that it initiated against web sites, and regarding nine consumer-generated complaints. This brings the number of actions concluded regarding web site publisher compliance since the OIBAAP’s 2013 compliance warning to approximately 30. In that warning, the OIBAAP announced that beginning in 2014 it would start a campaign to educate web site publishers on their obligation to give certain enhanced notice on every page of a web site that (1) serves IBA ads; (2) collects information for IBA (e.g., through third-party cookies associated with the site); and/or (3) enables retargeting of the user after the user leaves the publisher’s service (e.g., dropping a cookie that other publishers, or their ad servers, will recognize when the user goes to another site, for the purposes of serving the user an ad related to something they may have looked at on the original site.) The enhanced notice must link to a disclosure that explains IBA, states that the publisher supports the DAA’s self-regulatory principles, and provides either a list of all third parties engaged in IBA in connection with the publisher’s service and links to their opt-out programs, or directly link to the DAA’s master consumer control mechanism at www.aboutads.info/choices. The link can be a deep link to a part of the publisher’s privacy policy, but it cannot be simply a privacy policy link; it must be self-identifying as related to advertising choices (e.g., “About Ads” or “Ad Choices”). Click for a copy of the OIBAAP’s press release and the recent decisions.

Publishers should note that while the DAA’s principles apply also to mobile apps, a different opt-out mechanism applies to mobile apps because they are not browser-based; the cookie-based opt-out used in browser-dependent web site navigation is not effective for mobile apps. Instead, the DAA earlier this year launched an app-based opt-out mechanism. For more information on that, see http://www.aboutads.info/appchoices. (A future blog post will further explain this new program in detail.)

Web site and mobile publishers should determine what third-party tracking devices and IBA activities are associated with their services. Many times publishers are not even aware that their vendors and others have associated IBA with them and their services. Beyond complying with the notice obligations of the DAA’s self-regulatory programs for web sites and mobile apps, publishers need to take care in how they describe these programs, and tracking and targeting more generally (e.g., for analytics). Failure to do so can result not only in their privacy policies being inaccurate and even deceptive, but also in breach of contractual obligations they may have made to their analytics and advertising vendors and partners, some of which may have been made on their behalf by contractors assisting with their site and app operations. It is also a common mistake of publishers to suggest that third-party opt-out programs, when they are described, do more than they in fact do. That is a misrepresentation, however unintentional, that could subject the publisher to claims by state or federal authorities that they have engaged in illegal, deceptive practices. In addition, publishers should disclaim responsibility for the accuracy or effectiveness of third-party opt-out notices, programs, and tools. Accordingly, publishers’ sites and apps should be accessed to determine what IBA and tracking activities are occurring, and notices and privacy policies should be drafted by legal counsel familiar with digital advertising and its self-regulatory programs, and their limitations, to accurately and meaningfully provide transparent notice and explanation of choice.