BBB National Programs’ Privacy Watchdog Issues Compliance Warning Regarding Consent for Interest-Based Advertising

703.247.9330 / press@bbbnp.org

Note: This press release was updated in December 2022 to change the enforcement date of this compliance warning from January 2023 to April 2023. With questions, please contact programs@bbbnp.org. 

McLean, VA – June 21, 2022 – BBB National Programs’ data privacy watchdog, the Digital Advertising Accountability Program (DAAP), has issued a new compliance warning against the practice of inferring consent from a consumer’s passive use of a product or service following a notice of interest-based advertising (IBA). In this warning, DAAP reminds companies that in situations where consent is required for IBA, both a notice from the company and an active response to that notice by consumers are necessary. 

DAAP monitors online and mobile advertising, enforcing the Digital Advertising Alliance’s (DAA) Self-Regulatory Principles, which provide a baseline for consumer data privacy regarding digital ads.

Under the DAA Principles, consumers must have transparency about and control over IBA. Commonly, the DAA Principles work on an “opt-out” basis, in which consumers should be given up-front indications of IBA activity linked to fuller disclosures and a means to choose not to participate in a company’s IBA practices.

In other cases, however, the DAA Principles require companies to obtain consumers’ consent before engaging in IBA. The DAA Principles define consent as “an individual’s action in response to a clear, meaningful, and prominent notice regarding the collection and use of data for a specific purpose.” The DAA Principles specify that consent is required in situations calling for a heightened degree of consumer choice, such as the collection of precise location data or particularly sensitive data, making a material change in the use of prior-collected data, or the collection and use of data by a service provider for IBA.

Put simply, today’s compliance warning underscores the fact that inaction is not action. Companies may use notice and enhanced notice to point to a mechanism for providing consent, but such notices cannot themselves stand in for a consumer’s consent. This is because consent requires an individual’s action in response to a notice. A company’s provision of notice, without a corresponding action in response by the relevant consumer, does not pass this test. Practically speaking, then, companies should not consider a consumer’s mere continued use of a product or service after receiving notice to constitute consent.

Companies seeking guidance on developing and deploying Principles-compliant consent flows are encouraged to reach out to DAAP proactively for a free, confidential consultation.

Enforcement pursuant to this compliance warning will begin on Monday, April 3, 2023.

The full compliance warning can be found here. The DAA Principles can be found here. 

###

About BBB National Programs:  BBB National Programs is where businesses turn to enhance consumer trust and consumers are heard. The non-profit organization creates a fairer playing field for businesses and a better experience for consumers through the development and delivery of effective third-party accountability and dispute resolution programs. Embracing its role as an independent organization since the restructuring of the Council of Better Business Bureaus in June 2019, BBB National Programs today oversees more than a dozen leading national industry self-regulation programs, and continues to evolve its work and grow its impact by providing business guidance and fostering best practices in arenas such as advertising, child-directed marketing, and privacy. To learn more, visit bbbprograms.org.

About the Digital Advertising Accountability Program: The Digital Advertising Accountability Program (DAAP), a division of BBB National Programs, was developed by the Digital Advertising Alliance (DAA) to enforce industry self-regulation principles for data privacy in online and mobile advertising, holding companies accountable to the DAA Privacy Principles. DAAP provides guidance to companies looking to comply with industry principles and responds to complaints filed by consumers about online privacy.