New Accountability Program Cases Highlight Websites’ Privacy Responsibilities

Arlington, VA – June 7, 2018 – The Online Interest-Based Advertising Accountability Program released two new decisions today, once again bringing increased transparency about online advertising practices to consumer-facing websites. The companies in these cases, Purple Innovation LLC and x19 Limited, adopted the Accountability Program’s recommendations to add real-time “enhanced notice” links on their websites where data is collected for interest-based advertising, or “IBA.”

Purple, an online mattress retailer, came to the Accountability Program’s attention from a consumer complaint alleging that Purple’s website was allowing third parties to collect data for IBA without providing notice. Since no interest-based ads were being served on the site, consumers would have no indication that the collection was occurring unless Purple placed the link itself. Upon review of the company’s privacy disclosures, the Accountability Program also found they lacked descriptions of the IBA activity taking place, a link to a mechanism for opting out of IBA, and a statement of adherence to the DAA Principles.

Purple fully cooperated with the Accountability Program’s recommendations and quickly updated its privacy disclosures to include a full description of the IBA activity on its site as well as the other missing elements. It also added an enhanced notice link entitled “Interest-based Ads” to the footer of its website, separate from its privacy policy link, which takes consumers directly to the new IBA disclosure in its privacy policy.

Today’s second case resolves an inquiry into the practices of x19 Limited, a company that hosts a URL shortening service known as Adf.ly. This case arose during routine monitoring of websites that engage in canvas fingerprinting and other methods of non-cookie identification related to interest-based advertising. This inquiry was conducted under the Accountability Program’s 2014 compliance warning on alternative identification technologies. In that document, the Accountability Program explained that non-cookie IDs were equivalent to cookie-based IDs for purposes of compliance with the DAA Principles.

The Accountability Program’s dialogue with x19 revealed that the company used canvas fingerprinting for fraud prevention rather than for IBA purposes. Though this allayed the Accountability Program’s concerns about x19’s practices as a third party, the Accountability Program’s was concerned that—like Purple—x19 was not providing enhanced notice on pages where third parties were collecting data for IBA from visitors.

x19 addressed these concerns by adding a new section to its privacy policy describing the IBA activity occurring on its site, complete with a link to the DAA’s WebChoices page and a statement of adherence to the DAA Principles. This disclosure is now easily accessed directly from a floating enhanced notice link labeled “AdChoices” on all pages on which data is collected for IBA.

“We appreciate Purple and x19’s prompt efforts to come into compliance,” said Jon Brescia, Director of Adjudications and Technology for the Accountability Program. “It is vital that consumers be given up-front notice of this background data collection for IBA. We take this opportunity to again entreat website owners and operators to ensure that consumers are given the notice and choice owed them under the DAA Principles.”

Today’s cases mark the 89th formal action taken by the Accountability program.