Accountability Program: Self-Regulation Keeps Pace with Innovation

Accountability Program Makes Clear that All Technologies Must Comply with Industry Self-Regulatory Standards
BlueCava, Turn, DataXu, and OxaMedia Achieve Voluntary Compliance with Self-Regulatory Principles as Accountability Program Expands Its Enforcement and Compliance Guidance

Arlington, VA – May 30, 2012 – The Online Interest-Based Advertising Accountability Program (Accountability Program) today released the results of formal inquiries into the consumer data-collection and use practices of seven companies in the online advertising industry. All companies reviewed voluntarily agreed to follow the Accountability Program’s recommendations.

“The results are a win for both consumers and industry,” said Genie Barton, CBBB Vice President and Director of the Program. “Consumers benefit with greater information and clearer choices about how their information is used and the advertising industry benefits by building greater consumer trust and engagement in the Internet space.”

The Accountability Program provides objective, independent, and vigorous oversight and enforcement of the Self-Regulatory Principles for Online Behavioral Advertising (OBA Principles), a set of best practices developed by leading advertising trade associations that address consumers’ concerns about interest-based advertising practices.

Today’s decisions provide guidance on specific implementation requirements under the OBA Principles, including clarifying that:

The Transparency and Consumer Control Principles cover all technologies (not just browser “cookies”) in the interest-based advertising space, including device fingerprinting;

• Consumer disclosures should explain the company’s OBA practices and clearly notify consumers that the company adheres to the OBA Principles; and
• Consumer opt-out mechanisms must have a five-year duration, and once a consumer has opted out, this choice must be honored at all times, including during exchanges of information such as cookie synching.

“A great strength of the self regulatory process is that it can adapt to changing conditions and technologies,” said Ms. Barton. “Today’s decisions demonstrate that. We are delighted that each of the companies reviewed have voluntarily modified their practices.”

The  decisions focus on the cornerstones of the OBA Principles — Transparency and Consumer Control.

• Transparency: The Transparency Principle is designed to give consumers knowledge about OBA data collection and use practices that take place invisibly ‘behind the scenes.’   Companies are required to provide clear explanations about how they use consumers’ data for OBA, including providing “just in time” notice where data is collected and interest-based advertising is served. 
•  Consumer Control: The Consumer Control Principle provides consumers with an easy-to-use choice mechanism that allows them to opt out of OBA. 
•  Transparency, choice and accountability are core elements of both the Obama Administration’s proposed Privacy Bill of Rights and the Federal Trade Commission’s recent privacy report and recommendations.

Decisions

BlueCava:  The Accountability Program decision explained that transparency and choice are not limited to traditional “cookie-based” tracking practices but also cover all technologies in the interest-based advertising space, including device fingerprinting.

BlueCava’s privacy policy did not clearly explain to the consumer that its device identification technology gave it the capability to collect and use data for OBA across multiple devices in a household.  Nor did the privacy policy clearly state whether the BlueCava consumer choice mechanism would opt a user out of data collection and use for OBA across devices or whether it was limited to the device on which the opt out was completed.  The privacy policy did not tell consumers what further steps they would have to take to opt out for all other devices they use.  BlueCava implemented the Accountability Program’s recommendations to clarify how the device fingerprinting technology worked and to explain the scope of the consumer opt out provided.

The Accountability Program also noted that the spirit of the OBA Principles is to provide an easy-to-use opt out that is co-extensive with the data collected for OBA purposes and suggested that BlueCava, if technically feasible, provide a multi-device opt out.  BlueCava agreed with the Accountability Program’s reasoning and has pledged to make the development of this multi-device opt-out mechanism part of its product development work.

Turn: Although Turn is an active participant in the OBA Principles, Turn’s privacy policy did not fully comply with all transparency and consumer control requirements. Notably, the Turn website did not clearly state Turn’s adherence to the OBA Principles and provide links to the industry-developed consumer opt-out page where Turn is among the over 100 companies providing an opt out for consumers.  Turn instituted all the Accountability Program’s recommendations to come into full compliance with the Principles. Turn also satisfactorily answered the Accountability Program’s questions about its use of unique identifiers after consumer opt out and provided sufficient information to show how it honors a consumer’s opt out when engaging in cookie synching with third parties. The Accountability Program also commends Turn for requiring requiring its business partners to adhere to the OBA Principles.

DataXu: DataXu’s website consumer choice mechanism set an opt-out cookie that was rendered non-functional by the absence of a domain attribute. As a result, consumers who exercised choice through the DataXu website when using the Chrome, Firefox, Opera or Safari browsers were not opted out of data collection and use for OBA purposes. DataXu promptly remedied the issue with its opt-out cookie and has taken steps to ensure its opt-out cookie will remain functional and compliant with the OBA Principles.

OxaMedia: OxaMedia, based in the United States, with a subsidiary in Verona, Italy, was unaware of the OBA Principles.  As a result, it did not follow a number of these industry best practices.  Its opt-out cookie was set to expire one year from the date a consumer completed the opt-out process; it did not provide enhanced notice and choice to the consumer regarding its OBA practices when it served an interest-based ad. Upon notification by the Accountability Program of the requirements of the self-regulatory program, the company licensed the use of the DAA Advertising Options Icon to provide enhanced notice and choice of its data collection practices for OBA on its interest-based ads and brought all its practices into compliance with the OBA Principles.

Administrative Closures

Based on the representations of the companies below that they are not presently engaged in OBA, the Accountability Program administratively closed the inquiries but will continue to monitor as part of its ongoing work:

Gravity: a provider of personalization tools for publishers, which has followed the Accountability Program’s recommendation and changed its opt-out cookie to the industry standard of five years.

Rovion: an ad management platform for publishers and agencies, which has followed the Accountability Program’s recommendation and changed its opt-out cookie to the industry standard of five years.

Facilitate Digital Holdings: a provider of digital marketing technology and services, which agreed to follow the Accountability Program’s recommendation to change its opt-out cookie to the industry standard of five years but has not yet done so.