Good Practice Guide for Online Behavioural Advertising

In a joint initiative, the Internet Advertising Bureau (“IAB”) and some key players in online behavioural advertising (“OBA”), such as AOL, Google, Phorm and Yahoo, have launched some self-regulatory good practice principles for OBA. Their aim is to provide consumers with greater transparency in the application of OBA and to try to address some of the privacy concerns which have been raised in connection with OBA.

OBA tailors advertising to a user’s internet profile depending on websites visited over a period of time via a specific browser. Data comprised in a user’s internet profile can amount to personal data and, as such, use of this data is governed by the Data Protection Act 1998. Businesses which market via email and other electronic communications, or use cookies to gather information on users, also need to comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003. An overriding principle of both pieces of legislation is transparency i.e. that a “data subject” (in this case an individual browsing a website) is informed of the data which is going to be collected on him and the uses to which that data are going to be put.

The good practice principles have gone some way to meeting the requirement of transparency. There are three core themes in the principles: notice, user choice and education each of which contributes to a consumer’s awareness of OBA.

Under the theme of notice each IAB member agrees to provide clear and unambiguous notice to users that it collects data for OBA purposes, stating what kind of data it collects, how that data will be used and how users can decline OBA with that specific IAB member.

Under the theme of user choice, each member agrees to provide an approved method by which consumers can decline OBA (the guidance notes specify approved mechanisms which may be used to meet the member’s obligations under this principle). If a user declines use of his data for OBA purposes, the member must cease to provide OBA, but may still use the data for other purposes specified in its privacy policy, in accordance with that privacy policy. In addition, each member agrees to provide a statement on its website indicating how users may decline OBA.

Under the theme of user education, each IAB member agrees to inform and educate users about OBA and provide a link to IAB’s information portal. As well as launching the principles, the IAB and its members have established a website (www.youronlinechoices.co.uk), which contains information on OBA, how it works, how it can benefit consumers and how their privacy is protected. It is planned the website will ultimately contain a description of the steps that users need to take to decline OBA.

Signatories to the principles will need to put a statement of adherence to these principles on their websites or in their privacy policies.

OBA has attracted a lot of concern from privacy groups in connection with the potential for misuse of data; these have not gone away despite the launch of the good practice principles which these privacy groups feel have not gone far enough. It remains to be seen whether there is further criticism from non-technically minded individuals who find themselves required to take a number of steps in order to decline OBA. Much will depend on how the principles are implemented in practice and whether the IAB members are flexible in adapting the principles to meet the realities faced by users. However, the principles have the support of the Information Commissioner’s Office and undoubtedly are a step in the right direction.