ONLINE INTEREST-BASED ADVERTISING ACCOUNTABILITY PROGRAM
FORMAL REVIEW
Case Number: 06-2011

COMPANY:
Forbes Media Extension
CHALLENGER:
Online Interest-Based
Advertising Accountability Program
DECISION
DATE: November 8, 2011
SYNOPSIS
Under the Consumer Control Principle, a company is required to set an opt-out cookie with a minimum expiration date of five years from the date on which a consumer exercises choice.
COMPANY STATUS
Forbes Media Extension (FMX or the company) uses audience segmentation targeting to provide advertisers with specific Forbes’ audiences and content. As such, FMX engages in the collection and use of data for online behavioral advertising (OBA) purposes as defined in the cross-industry Self-Regulatory Principles for Online Behavioral Advertising (Principles):
Online Behavioral Advertising means the collection of data from a particular computer or device regarding Web viewing behaviors over time and across non-Affiliate Web sites for the purpose of using such data to predict user preferences or interests to deliver advertising to that computer
or device based on the preferences or interests inferred from such Web viewing behaviors. (Principles at 9-10, Definition G.).
OBA PRACTICE AT ISSUE
One of the cornerstones of the Principles is “consumer control.” (Principles at 14, Principle III.). A third party must provide the consumer with an easy-to-use mechanism that allows the consumer to exercise choice regarding the collection and use of data from his or her device for OBA purposes. The practice at issue is whether the company was providing consumers with choice as required under the Consumer Control Principle.
The obligation of a third party to enable a consumer to exercise choice is explained in the Principles as follows:
A Third Party should provide consumers with the ability to exercise choice with respect to the collection and use of data for Online Behavioral Advertising purposes or the transfer of such data to a non-Affiliate for such purpose. Such choice should be available from the notice described in II.A.(2)(a); from the industry-developed Web page(s) as set forth in II.A.2.(b)(i); or from the Third Party’s disclosure linked to from the page where the Third Party is individually listed as set forth in II.A.2.(b)(ii). (Principles at 14, III.A.).
BASIS OF INQUIRY
On August 8, 2011 and August 30, 2011, the Online Interest-Based Advertising Accountability Program (Accountability Program) tested the functionality of the consumer choice mechanism provided in the company’s privacy policy using five Internet browsers: Chrome, Firefox, Internet Explorer, Opera and Safari. While the opt-out request was successfully processed in each test, the opt-out cookie delivered to each browser was set to expire in less than three months from the date of the test. This expiration date failed to meet the industry standard minimum of five years.
The Principles are built on consensus standards: “The cross-industry Self-Regulatory Program for Online Behavioral Advertising was developed by leading industry associations to apply consumer-friendly standards to online behavioral advertising across the Internet.” (Principles at 1). The industry standard for the duration of an opt-out cookie is five years from the date of the request.1
1 As the Aboutads.info web site explains to consumers who wish to exercise choice, “Opt out cookies storing such preferences that are placed by companies participating in the Program have a minimum five-year lifespan, and remain in effect for the user’s browser unless these opt out cookies are deleted (as can happen if users deletes all of their cookies using browser tools).” See also Chitika, Inc., FTC Docket No. C-4324 (June 7, 2011) (requiring Chitika to provide a five-year opt out).
Additionally, tests with the Internet Explorer browser found the process to take between three-and-a-half minutes and four minutes. This latency issue rendered the process potentially difficult for users of Internet Explorer. Repeated tests of the choice mechanism continued to find the short expiration date and latency issues, demonstrating that the problems were persistent and were not corrected by the company during the month that testing was repeated.
COMPANY’S POSITION
In response to the Accountability Program’s inquiry, the company acknowledged that the opt-out cookie delivered to the consumer’s browser contained an expiration date of less than three months from the date of the opt-out request. The company stated that it had changed the opt-out cookie’s expiration date to the five-year time frame that is the industry standard. It also stated that it had determined what was causing the latency issue. The company further set forward the steps it had taken to ensure these problems would not recur.
DECISION
All companies have the obligation to monitor their data collection and advertising practices to ensure compliance with the Principles, including ensuring that their notice and choice mechanisms are fully functional and compliant with the Principles at all times. The Accountability Program finds that FMX was not compliant with the Consumer Control Principle because it failed to ensure that its consumer choice mechanism contained an expiration date consistent with the industry standard minimum of five years. Moreover, the latency problem rendered the choice mechanism difficult for consumers to use.
Upon notification by the Accountability Program, the company changed the opt-out cookie’s expiration date to five years from the date of the request. The Accountability Program has conducted subsequent tests on the opt-out mechanism on all browsers previously tested and found the expiration date for the opt-out cookie to meet the five-year minimum as required by the industry standard. Similarly, the Accountability Program’s testing demonstrated that the latency issue has been resolved.
CONCLUSION
The Accountability Program’s goal is to ensure that companies engaged in OBA comply with the Self-Regulatory Principles. The Accountability Program’s monitoring and complaint processes are designed to identify areas of possible non-compliance, to make companies aware of potential non-compliance and to work with companies to rectify non-compliance. FMX has implemented the Accountability Program’s recommendations and the practice at issue has been resolved.
COMPANY’S STATEMENT
Upon receipt of the Notice of Inquiry, FMX took immediate action. With respect to the Opt-Out expiration time, the cookie expiration was promptly changed from the reported three (3) months to a new value of six (6) years to comply with industry standards of five (5) years. Regarding the Opt-Out latency problem occurring on August 30, 2011, which was directly a result of a service outage, enhancements were made to the monitoring processes of the Opt-Out service and checks were implemented that now send alerts if an Opt-Out processing time exceeds ten (10) seconds. The above modifications will ensure that any future diminishing of an end users’ ability to quickly complete the Opt-Out process will be resolved expediently and with the highest priority.
DISPOSITION OF DECISION
Practice voluntarily corrected.