UK IAB Retracts Code of Practice for Online Behavioural Advertisements
Behavioural retargeting is based on a marketing theory that maintains that an individual who has browsed items in a particular shop (or website), but has not made a purchase, has a higher probability of reacting to that shop’s advertisements and making a future purchase than an individual who views the same advertisements but has never visited the shop. Not surprisingly, the use of tracking technology to monitor and analyze user behaviour for OBA has raised some privacy concerns.
The Information Commissioner’s Office (ICO), the independent authority overseeing information rights and data privacy matters, has examined the privacy issues arising from the use of technology to monitor user behaviour and the subsequent storage and analysis of this information for OBA purposes. The ICO has stated that the use of behavioural ads is not in itself objectionable, provided that the processing of gathered data is done in accordance with the Data Protection Act 1998. However, the ICO has also stated that users should be provided with notice of tracking and the means to disable behavioural monitoring and subsequent targeted advertising.
The IAB Code of Practice for OBA
The Affiliate Marketing Council of the IAB, on mandate from consumer protection authority the Office of Fair Trading, recently published the Code. The Code’s primary aim was to introduce a clear protocol for calculating payments to online adverting companies providing OBA. In the past, online advertisers have relied on a user-click method for assessing payments due to them, but PI/PV cookies used in OBA are ‘impression-based’ rather than ‘click-based,’ meaning that cookies are stored on an impression served instead of a click. The Code set out a new compulsory system for calculating payment, using a ranking of rules on impression and click cookies. The Code also set out non-compulsory guidelines regarding the use of tracking cookies and maintaining user privacy. In particular, the Code recommended a 48-hour limit on the storage of tracking cookies used for behaviour retargeting. It also recommended that websites indicate to users where tracking technology is being used.
A week after publication, the IAB withdrew the Code following member feedback. The IAB has stated that a redrafted edition will be published in the upcoming months following further consultation with members of the advertising industry and regulatory bodies.
IAB Good Practice Principles for OBA
Without the Code in force, the IAB encourages members of the UK advertising community to apply the ‘IAB Good Practice Principles for Online Behavioural Advertising’ published in 2009. These principles recommend that websites notify users where monitoring technology is used. Principle 1.1 states, "Each Member shall provide clear and unambiguous notice to users that it collects data for the purposes of OBA. This notice shall include information about what types of data are collected, how these data are being used and how users can decline OBA with respect to that Member." The IAB has stated that it is currently in discussions with members regarding the creation of a "one-click opt-out."
Some of the largest online advertising businesses have publicly committed to the IAB Good Practice Principles including AOL Advertising, Google UK Ltd, MSN / Microsoft Advertising, Yahoo! SARL, Audience Science Inc, Crimson Tangerine Ltd and Specific Media UK.
Industry Standard OBA Notice
The Office of Fair Trading has gone one step further and has recommended that the IAB develop an industry standard icon to notify users where OBA is being employed, as has been done in the United States.
Recently, US advertising agencies, in conjunction with the Council of Better Business Bureaus, officially launched a self-regulatory program to give users control over their data in relation to OBA. They also introduced an industry standard "Advertising Option Icon" to be posted by participating advertisers, who will display the icon near advertisements and on websites where OBA information is collected and used. Consumers who click on the icon will be presented with information on how the collected data will be used, and will also be given the opportunity to opt out.
The IAB, however, has stated that it will await the development of an EU standard icon, and will not develop a unique UK specific icon.
McCarthy Tétrault Notes
Until the Code is re-introduced, the UK’s current legal position regarding OBA will remain largely a matter of self-regulation by advertising agencies.