BBB National Programs’ Privacy Watchdog Issues Compliance Warning for “Fingerprinting” Cross-App Data Collection Practices

703.247.9330 / press@bbbnp.org

McLean, VA – February 8, 2022 – BBB National Programs’ data privacy watchdog, the Digital Advertising Accountability Program (DAAP), has issued a new compliance warning targeting “fingerprinting” of users or devices in connection with the collection or use of cross-app data. 

DAAP monitors online and mobile advertising, enforcing industry self-regulation principles for data privacy and holding companies accountable to the Digital Advertising Alliance (DAA) Self-Regulatory Principles, a set of industry best practices for online and mobile interest-based advertising (IBA). 

In enforcing the DAA Principles, DAAP issued this compliance warning to put companies on notice that its enforcement approach will treat any combined information used to uniquely identify a device or user for IBA as equivalent to an advertising ID in evaluating whether an entity is collecting or using cross-app data. 

Under the DAA Principles, cross-app data is data collected from a particular device regarding application use over time. If a company collects this type of data and uses it for IBA, or allows another entity to do so, that company may need to provide notice, enhanced notice, or consent to the user. 

Cross-app data is typically associated with a particular device by a unique advertising ID. “Fingerprinting” techniques, on the other hand, use a set of measurable characteristics – such as volume, battery level, and IP address – to identify a device. Though “fingerprinting” has been used for years, the techniques are increasingly relevant in the wake of recent platform updates that restrict or narrow an advertiser’s access to the phone’s advertising ID.

In this compliance warning, DAAP reminds companies that the DAA Principles are applicable and will continue to be enforced irrespective of the technology employed to collect and use consumer activity data to serve interest-based ads. Companies engaged in IBA must adhere to the DAA Principles, which include providing the appropriate level of transparency and choice to consumers.

The DAA Principles can be found here. The full compliance warning can be found here. Summaries of all DAAP and other BBB National Programs case decisions can be found in the case decision library. 

###

About BBB National Programs:  BBB National Programs is where businesses turn to enhance consumer trust and consumers are heard. The non-profit organization creates a fairer playing field for businesses and a better experience for consumers through the development and delivery of effective third-party accountability and dispute resolution programs. Embracing its role as an independent organization since the restructuring of the Council of Better Business Bureaus in June 2019, BBB National Programs today oversees more than a dozen leading national industry self-regulation programs, and continues to evolve its work and grow its impact by providing business guidance and fostering best practices in arenas such as advertising, child-directed marketing, and privacy. To learn more, visit bbbprograms.org.

About the Digital Advertising Accountability Program: The Digital Advertising Accountability Program (DAAP), a division of BBB National Programs, was developed by the Digital Advertising Alliance (DAA) to enforce industry self-regulation principles for data privacy in online and mobile advertising, holding companies accountable to the DAA Privacy Principles. DAAP provides guidance to companies looking to comply with industry principles and responds to complaints filed by consumers about online privacy.