Privacy group brings app publisher and website of health treatment centers into compliance with best practices

For Immediate Release

Arlington, VA – April 23, 2020 – Today, the Digital Advertising Accountability Program (DAAP) released new actions detailing its efforts to provide consumers with control over how their data is used in personalized digital advertising. The privacy watchdog brought the app developer Mammoth Media into full compliance with the Digital Advertising Alliance’s self-regulatory principles (DAA Principles), which are best practices for privacy and interest-based advertising (IBA). Separately, the program alerted Recovery Centers of America, a company that operates addiction treatment facilities, to IBA on its website which the company immediately addressed.

Mammoth’s Wishbone and Yarn apps are widely used social polling and storytelling apps. DAAP initiated reviews of these apps as part of its general monitoring activities. Technical analysis revealed the collection of user data – including precise location data – by third parties for advertising purposes. Yet the apps neither provided clear, up-front notice of IBA nor requested consent for the collection of precise location data, as required by the DAA Principles.

After DAAP contacted Mammoth, the publisher quickly modified its app and privacy policy to reach compliance with the DAA Principles. These changes include:

1. Incorporating an up-front “enhanced notice” jump link at the top of each app’s privacy policy; this leads directly to disclosures that describe how user data is collected and used for third-party advertising;
2. Providing a link to and a description of the DAA’s AppChoices tool, which can be used to opt out of personalized advertising on mobile apps;
3. Disabling the collection of precise location data by third parties on the Wishbone app
4. Adding a statement of adherence to the DAA Principles to the company’s privacy policy.

Today’s second case concerns the website of Recovery Centers of America. During its regular monitoring of websites, DAAP detected signs of data collection for targeted advertising on the company’s website. DAAP reached out to Recovery Centers with an inquiry letter recommending an enhanced notice link to a privacy disclosure describing interest-based advertising. The company quickly updated its website to provide a link in its footer that takes users to a disclosure about third-party data collection for IBA occurring on its website.

“Enhanced notice is a major component of the DAA Principles’ self-regulatory regime,” said Jon Brescia, DAAP VP. “We appreciate the swift efforts these companies took to meet their obligations to app and website users.”

Today’s case releases bring the total number of public actions taken by DAAP to 115.