Centers of Excellence: Behavioral Advertising

As I recently reported, in an effort to give greater assistance to companies that engage in online behavioral advertising (”OBA”), many trade groups in the industry were working on creating a set of standards to help companies understand how to provide clear notice, and how to allow consumers a choice about whether their information is used for OBA purposes. Those industry self-regulatory principles have now been released, and provide different levels of notice and choice requirements depending on whether a company

1. allows data to be collected on its website for OBA purposes,
2. allows ads to be served based on information collected for OBA purposes,
3. collects data for behavioral advertising purposes on one site, and passes it to another (unaffiliated) website in order to serve targeted ads, or
4. is engaging in OBA and acting as a “Service Provider” (namely if it is a provider of Internet access, toolbars, browsers, or provides other desktop application or software).

Companies in the first group – those that allow data to be collected from users on their site, which data will be used for OBA purposes – must have on the pages where information is collected for OBA purposes a link that takes users to a disclosure about the OBA practices occurring at the site. This link would be separate from the link to the company’s privacy policy.

Companies in the second and third groups – those that allow ads to be served that are based on OBA data, or that pass data from one site to an unaffiliated site for OBA purposes – must provide prominent notice about the OBA activities on the site where the ad is served. This notice can be in a link that is included in or near the advertisement, and can be either a link to a page created by the website where the ad appears, or a link to a page created by the company that has passed data from one site to another. Additionally, for companies in the third group – those that are passing the data – they must have a prominent disclosure on their own websites that they engage in OBA activities. The notice provided by companies in both groups two and three must include information about how consumers can opt out of having their information used for OBA purposes, as well as the types of data collected, the use of such data, and whether data is transferred to any third parties for OBA purposes. The notice needs to be on a link on the both companies in group two and three’s web sites (a link separate from the privacy policy link), as well as in or near the advertisement that is delivered as a result of the OBA activities. The link near the ad that is being served is not necessary, however, if there was a link to the company’s notice on the web page where data was first collected. The principles anticipate that this might happen in instances where the website on which the ad is served has a relationship with the original website where information was collected.

Unlike companies in the first three groups, Service Providers are held to a higher standard, and must get consumers consent before they can engage in behavioral advertising. Service Providers also must have a notice – linked from their web sites – that describes their OBA activities, including information about how a consumer can opt out of having his or her information used for OBA purposes, as well as the types of data collected, the use of such data, and whether data is transferred to any third parties for OBA purposes.

Under the industry self-regulatory principles, different “accountability programs” will be developed, through which additional direction about how to provide notice and choice will presumably be given. Those programs are intended to go into effect in the beginning of next year.

These materials have been prepared by Winston & Strawn for informational purposes only. These materials do not constitute legal advice and cannot be relied upon by any taxpayer for the purpose of avoiding penalties imposed under the Internal Revenue Code.