HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

Speakers:

Jason Bier: Chief Privacy Officer, Conversant

Jeanette Fitzgerald: General Counsel and Chief Privacy Officer, Epsilon

Genie Barton: Vice President and Director, Online Interest-Based Advertising Program and Mobile Marketing

Initiatives, Council of Better Business Bureaus

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

The Internet Advertising Bureau UK created this video and it is used with their permission.

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

Global overview

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

Global overview (by country)

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

Future growth of mobile advertising in the US:

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

How is an ad served to the end user? Types of ads served

online−

• Search words entered into an online search

• Social media sites

• Content-based

Targeted ads served to the consumer – based on:

• Past behavior

• Previous websites visited

• Past purchase history and/or inferred interests

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

Advertiser knowledge of end-user

• What personal identifying information (PII) does the advertiser possess or obtain?

• Benefits to consumers?

Future innovation

• Alternative methods – cookie-less society

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

Privacy Vulnerabilities

• Key vulnerability

• Lack of consumer knowledge

• Common misconceptions about type of data collected by cookies

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

Privacy Vulnerabilities

• Key vulnerability

• Legislative action adds to confusion

• CA “Do Not Track”

HOW THE ONLINE ADVERTISING ECOSYSTEM WORKS AND WHERE THE PRIVACY VULNERABILITIES EXIST

Action items – online marketing industry

• Increase awareness of cookie practices

• Beyond the privacy policy?

• Showcase online practices using already available consumer privacy measures

• Digital Advertising Alliance’s AdChoices

• Support self-regulation

• Get involved

THE ADCHOICES ICON

• On or around every interest-based ad: over 1 trillion

each month

DIGITAL ADVERTISING ALLIANCE’S SELF-REGULATORY PRINCIPLES

• DAA Principles – Self-Regulatory Principles for Online

Behavioral Advertising (OBA Principles)

– Self-Regulatory Principles for Multi-Site Data (MSD Principles)

– Mobile Guidance (MG)

• Focus on two Principles – Transparency (notice)

– Consumer Control (choice)

• Forbid use of consumer data for making eligibility decisions such as – Healthcare

– Employment

– Insurance

WHAT IS THE ACCOUNTABILITY PROGRAM?

• The Council of Better Business Bureaus, through the Advertising Self-Regulatory Council (ASRC), which it administers, was asked to create an independent accountability program to enforce the Principles

• The result was the creation of the Online Interest-Based Advertising Accountability Program in Jan. 2011

• The Accountability Program’s mission is to build trust in the digital marketplace by enforcing compliance with the Principles

• Enforcement not limited to DAA “Participants” because DAA is not a membership organization

• Instead, Accountability Program enforces

• Internet-wide

• Cross-industry

• Against anyone engaged in activity covered by Principles

WHAT IS “ONLINE BEHAVIORAL ADVERTISING?”

Online behavioral advertising (“OBA”): • The collection of data about a consumer’s visits across websites over time

(browsing activity) to predict the consumer’s interests and to deliver advertising based on the consumer’s likely interests; this includes retargeting!

• OBA is also known as targeted advertising or tracking, all of which terms have a negative feel

• More neutral or positive terms are interest-based advertising, personalized advertising, and tailored advertising

OBA does not include: • The activities of First Parties (website owners or operators) on their own Web

sites or the Web sites of their affiliates (example: Amazon ad saying “based on your purchase history or Amazon, you may also like this….”

• Contextual advertising (i.e., advertising based on the content of the Web page being visited, a consumer’s current visit to a Web page, or a search query)

WHO IS COVERED BY THE PROGRAM?

First Parties: Entities that own a Web site

or have “Control” over the Web site with which the consumer interacts and its Affiliates.

– Web Site Publishers

– Web Site Operators

Third Parties: Entities that engage in OBA

on a non-Affiliate’s Web site.

– Advertising networks

– Data Companies (Ad Exchanges, Demand-Side Platforms, Data Aggregators)

– In some cases, Advertisers or Advertising Agencies

Service Providers: Entities that collect

/ use data from all or substantially all URLs traversed by a web browser across Web sites for OBA. Service Providers may provide:

– Internet access

– Search capabilities

– Web tool bars

– Internet browsers

– Desktop applications

– Software, or other similar services

THIRD PARTIES’ RESPONSIBILITIES

• Third parties such as ad networks have primary responsibility for transparency and choice when an OBA ad is served

• They must ensure that all interest-based ads contain real-time notice, typically provided by the Digital Advertising Alliance’s Advertising Option Icon (AdChoices Icon )

• When the consumer clicks on the AdChoices Icon, s/he should be provided with information about who served the interest-based ad and a link to an easy-to-use consumer choice mechanism

• Third parties who collect data for OBA must have a working opt out, must provide users with information about their data collection and use practices relating to OBA, and must indicate their adherence to the Principles

• Sometimes the brand chooses to serve the AdChoices Icon to promote customer engagement and therefore steps into the shoes of the third party

• Advertisers can ensure compliance for their ads by many methods, including employing a compliant ad network or other third-party service, or using a preferred provider

FIRST PARTIES’ RESPONSIBILITIES

The Transparency Principle sets forth first-party requirements in section II.B.:

– Website Disclosure of third-party OBA activity

– Links to opt outs of all third parties collecting data on the site or to Industry-Developed Opt-Out (e.g., www.aboutads.info/choices)

– Statement of adherence to the DAA’s Principles

– Enhanced Notice

ACCOUNTABILITY PROGRAM CASES AND MAJOR THEMES The Accountability Program has published 43 formal actions to date

Cases often follow specific compliance themes

• Entire ad ecosystem shares responsibility for ad compliance: Every party in the ad serving chain must communicate to ensure icon is served

• Survey your own site: Web publishers have an independent set of requirements under the IBA Principles, triggered by third party collection and use for IBA

• Make sure it works: Opt-out links must not be broken and must correctly set an opt-out cookie that expires five+ years from date set

Out of all its cases, only one has resulted in a referral to government agency for non-participation

LOOKING AHEAD

• Accountability Program will reiterate core compliance themes while expanding enforcement to new platforms and technology

• Issues on the horizon

– Mobile enforcement in 2015 – applying Principles to mobile environment, including new cross-app, location, and user-generated content privacy standards

– Cross-device and alternative ID technologies – following up on 2014 Compliance Warning by keeping tabs on new tech

– Interest-based native advertising – conducting review of companies engaged in interest-based native ads in keeping with Native Ads Compliance Warning

QUESTIONS?