Online behavioural advertising industry good practice and user educationvacy concerns

Nick Stringer, Head of regulatory affairs, Internet Advertising Bureau

The Government’s blueprint for our digital future, the Digital Britain report, specifically referred to the importance of behavioural advertising as one of several business models to help convert “creativity into value.” It also specifically stated that the development of behavioural advertising needed to be “handled carefully” with respect to internet user privacy.

The IAB agrees. As stated previously, privacy needs to become ‘business as usual’ for organisations – both public and private - that collect and use information online. We acknowledge the privacy concerns surrounding behavioural advertising and the need to balance its importance as a growing business model with the need to protect user privacy. As an industry body dedicated to ensuring that online is a responsible marketing medium, the IAB and its members are committed to providing internet users with transparency and choice. Our aim is to ensure advertisers and publishers have confidence in the practice and internet users themselves have the trust to continue to enjoy a wealth of content, services and applications for little or no cost, underpinned by more relevant advertising.

So how is the IAB (and its members) addressing these privacy concerns?

Our earlier chapter on consumer attitudes discussed privacy concerns and illustrates that they want notice and choice, but they don’t want their online experience to be ‘invaded’ by advertising. It is important to be very clear that our work will always be informed and guided by ongoing research about what users actually think and want.

In May 2008 the IAB established a working group made up of the leading players in this field – providers of behavioural advertising, publishers and agencies – to spearhead the development of industry good practice. It was also agreed that this should be supplemented with clear and easily-understandable information for internet users about how behavioural advertising works and how they could exert greater control over the collection and use of data. The goals of building trust and offering transparency guided thinking every step of the way.

Good Practice

In March 2009 the IAB published a set of self-regulatory Good Practice Principles for behavioural advertising, a clear set of commitments that providers who collect and use online information to deliver behavioural advertising would sign up to and implement. Signatory companies included major advertising networks (eg Google, Yahoo!, Microsoft and AOL Advertising), technology companies (eg Audience Science) and also new business models such as providers of targeting using ISPs (eg Phorm).

The Principles complement and, in some cases, supplement the UK legal framework. They address a broader scope than required under existing law, by covering the use of all information used for behavioural advertising – both anonymous information and personal data (in the UK this is primarily addressed by the Data Protection Act 1998 and the Privacy and Electronic Communications Regulations 2003). They are a UK and European ‘first’, establishing new standards and setting the benchmark for other countries to follow.

There are three core Principles that companies have committed to:

1. Notice:

A company collecting and using online information for behavioural advertising must give clear and unambiguous notice to users that information is being collected for this purpose. This notice will need to include details on what type of information is collected and how the information is used.

In practice, this means that a web publisher will need to provide this notice prominently on its site(s). The Principles offer the option of doing this in a privacy policy or signposted to the privacy policy from a link alongside the advertisement. For web publishers using a third party (eg an advertising network) to collect and use information for behavioural advertising, the third party will, via its contract, require the web publisher to provide this notice. The Principles provide some sample language for illustrative purposes. The provider of behavioural advertising itself will also need to meet this commitment.

2. User choice:

A company collecting and using online information for behavioural advertising must provide a mechanism for users to decline or opt out of behavioural advertising. Where personally identifiable information (ie information that can actually identify a person, such as a name, street address, email address or telephone number) is obtained, informed consent must be obtained, as is required by data protection law. In addition to this, there may be occasions – as required by law or regulatory guidance - where businesses will need to obtain specific consent (eg information collected at an ISP level) and provide a clear and unavoidable statement to the internet user about the product and ask the user to exercise a choice whether or not to be involved.

Internet users can also opt out by visiting the IAB’s information website – www.youronlinechoices.co.uk – dedicated to help inform users about behavioural advertising.

3. Education:

A company collecting and using online information for behavioural advertising must provide users with clear and simple information (such as an educational online video) about their use of information for this purpose and how users can opt-out. Many businesses already provide this type of information and examples include MSN (( https://choice.live.com/advertisementchoice/Default.aspx) and Yahoo!
(( http://info.yahoo.com/privacy/uk/yahoo/opt_out/targeting/details.html).

In addition to these, the Good Practice Principles also include a specific commitment relating to children: no business that collects and uses information for behavioural advertising will create an ‘interest segment’ intended for the sole purpose of targeting children under the age of 13 years of age. The IAB recognises that there are other areas that people may consider to be sensitive and this is an area that we are committed to discuss with wider stakeholders and keep under review.

Compliance

Developing good practice in this area is the first step in our work and we will need to keep this under review as commercial practices change and as technology changes. Companies that sign up to the Principles have six months to comply and will self-certify this compliance to the IAB. In addition to this each company’s self-certiication is independently verified by a third party to provide additional assurance to the industry and internet users that companies are adhering to the Principles.

User complaints about behavioural advertising in relation to those companies complying with the GPPs can address their queries directly with the company concerned. In some cases the user may not know who this is and there exists a specific page on www.youronlinechoices.co.uk to point users in the right direction, along with means for users to escalate a complaint in relation to the principles for resolution by an industry board.

Clear information for internet users – www.youronlinechoices.co.uk

Behavioural advertising is a complex practice that many internet users may not understand. It has therefore been essential for the IAB to embark upon a programme to inform and educate users on how it works and the steps they can take to exert greater control over their online privacy.

Ongoing consumer research will help identify the areas and topics that users most want help with, with www.youronlinechoices.co.uk is just the first step in providing users with clear and easily-understandable information. The website has a wide range of information including some basic information about how behavioural advertising works, some top tips on how users can manage their online privacy (such as getting more familiar with web browser privacy settings), a easy ‘quick facts’ download, and a ‘jargon buster’ explaining the terms we in the industry use every day but that others may not know. A good example is the word ‘cookie’.

Significantly, the website hosts a central place for UK internet users to opt out of behavioural advertising by those companies complying with the Good Practice Principles.

Next steps:

The Good Practice Principles have been supported by the Information Commissioner’s Office (ICO), Ofcom, the Government (it highlighted the IAB’s work in its final Digital Britain report) as well as other industry groups. And the IAB maintains an ongoing dialogue with consumer and privacy groups to help us fine-tune our thinking.

As mentioned earlier, the working group will keep the Principles under review and we have a process in place to do this. We will also be further engaging with others in the behavioural advertising value chain, such as publishers, Internet Service Providers (ISPs), advertisers and agencies to build upon the existing work and help develop additional guidance where appropriate. By doing so, we can ensure that – as an industry – we’re doing our upmost to protect user privacy in this area and placing it at the heart of the future of the internet. In this way we can meet the goals of informing users, offering transparency and providing them with a choice to ensure they have trust in the practice.

Next page