Arlington, VA – August 1, 2017 – The Online Interest-Based Advertising Accountability Program, the independent enforcement agent of the Digital Advertising Alliance, released the results of two cases focused on the elements of third party compliance under the DAA Self-Regulatory Principles: transparency and consumer control of interest-based advertising (IBA). The companies—Adbrain and Exponential—both changed their privacy practices to ensure that consumers receive real-time notice of IBA and user-friendly choice as required by these industry standards.

“Transparency and consumer control are at the heart of the DAA Principles, and we work to ensure that industry provides these core protections,” said Jon Brescia, Director of Adjudications and Technology for the Accountability Program. “The digital advertising industry has pledged to honor these basic fair information practices, and we are pleased to see companies honor that pledge.”

Adbrain: Consumer Control of IBA

Adbrain came to the Accountability Program’s attention when a consumer complained that the company’s website allowed unaffiliated third parties to collect data for IBA without giving consumers notice and choice. The company demonstrated that the third parties collecting data on its website were not doing so for IBA purposes. Even so, Adbrain added a link to educational information about IBA which provides them with a link to an IBA opt out.

As is its practice when responding to consumer complaints, the Accountability Program reviewed Adbrain’s own IBA activities. As a third party, Adbrain collects and uses data for IBA across unaffiliated mobile apps, which requires it to, among other things, provide an easy-to-use means for consumers to opt out of this activity. However, Adbrain’s opt out form required that users find, type in, and submit their “device ID” for it to work, all without telling users what the device ID was or how to obtain it. The Accountability Program determined that this process was so difficult for the average consumer to operate successfully that Adbrain had not provided an easy-to-use opt out.

Working with Adbrain, the Accountability Program provided examples of a number of compliant mobile opt-out mechanisms, such as the DAA’s AppChoices app. Adbrain crafted an interim opt-out solution that provided users with instructions on obtaining their device ID and committed to implementing a compliant mobile opt-out tool within a commercially reasonable time period.

Exponential: Enhanced Notice

As part of its routine monitoring of companies engaged in IBA, the Accountability Program examined third-party data collection occurring on health care insurance websites. On one of these sites, Covered California, the Accountability Program discovered Exponential collecting data for IBA without providing the requisite real-time notice of this collection, or enhanced notice, required under the DAA Principles.

Based on these facts, the Accountability Program immediately opened an inquiry into Exponential’s IBA practices. Exponential confirmed that it was collecting data for IBA on the health insurance website. Because Exponential had no direct means to supply the usual enhanced notice of this collection (often designated by the AdChoices Icon ), it had an obligation to either obtain access from the first party website operator or ask the website operator to provide enhanced notice on its behalf. However, Exponential had not taken either route to achieve compliance when operating on the health insurance website.

Exponential did provide educational materials on some privacy rules—for example, EU cookie consent law compliance—to a subset of its clientele and was very willing to work with the Accountability Program to expand this training to address compliance under the DAA Principles. Exponential now also provides this training documentation to all pertinent clients. Exponential also modified its contractual terms to require clients to follow DAA Principles in addition to relevant laws and regulations.

“The Accountability Program is in its sixth year. We are proud to publish decisions that demonstrate that industry-wide, independently enforced self-regulation works,” said Genie Barton, CBBB VP of Digital Advertising. “Companies respond positively to our inquiries and commit to making the changes we suggest. This is the right way to build trust between consumers and businesses.”

The Accountability Program notes that it has administratively closed three inquiries into other third parties observed collecting data on similar health care insurance websites because it found that the companies were not engaged in IBA in those instances.

Today’s releases bring to 80 the public actions taken by the Accountability Program.