New rules have been introduced setting higher standards of transparency and choice for consumers around Online Behavioural Advertising (OBA). These rules are derived from the European Online Advertising Industry Framework for self-regulation and are administered by the Advertising Standards Authority (ASA) and Committee of Advertising Practice (CAP). The rules specifically target third party cookies because a publishers’ own cookies are already addressed by existing law.
What is Online Behavioural Advertising?
Online Behavioural Advertising is the process of tracking consumers’ online behaviour in order to deliver individually targeted advertising.
What is a third party?
The rules define a third party as “an organisation that engages in OBA (i.e. collects and uses web viewing behaviour data for the purposes of OBA) via websites other than those that it or an entity with which it is under common control owns or operates”.
The Key Rules
- Third parties must provide “clear and comprehensive notice” about OBA activity on their own websites as well as on any advert published by the third party to other sites.
- Third parties must obtain “explicit consent” before using technology that collects all, or substantial amounts of data on web activity for the purpose of targeted advertising.
- Third parties must provide an opt-out on any OBA data collection for consumers not wishing to receive targeted advertising.
- Advertisers must cooperate with the ASA, CAP or the Information Commissioner’s Office to identify any offending third party.
- Third parties must not specifically target OBA at children aged 12 or under.
- Any data gleaned from consumer web activity must be held using appropriate security measures.
Exclusions
The following activities are exempt from the new rules:
- Tracking by a publisher across its own website domains.
- Tracking performance and effectiveness of ad campaigns.
- Contextual advertising whereby the text on a website is scanned and targeted advertising applied to that site.
- Web analytics – analysing web traffic and page views.
- The use of OBA in interactive media, online video streaming or mobile phones.
However, the ‘CAP help note’ on OBA indicates that comparable rules will soon be applied to mobile devices.
Implementation
Third parties will need to give notice that they are tracking site visits, giving consumers the choice to allow the targeted adverts and tracking, or not. It is believed that most third parties will offer a link through to an EU industry wide “opt out” option on the screen to allow consumers to reject OBA tracking.
Sanctions
For the most part it is likely the majority of OBA rule breaches will be dealt with by remedial action. Where further action is required, although the ASA cannot impose financial sanctions it can instigate investigations which can be expensive, time consuming and potentially humiliating if adverse findings are published in the press.
It is likely most breaches will still be dealt with by ‘naming and shaming’, however the CAP compliance team also have 2 new sanctions:
- Revocation of the EU self-regulation Framework’s trading seal of approval signifying best practice; and
- Revocation of the licence to use the EU link offering the obligatory OBA opt-out
Questions remain over the extent to which CAP will use its new powers and what impact they will have on offending companies.
The new rules regulating OBAs significantly extend ASA’s enforcement remit beyond regulating the substance of advertisements into regulating the technology used to collect and analyze data, and deliver targeted adverts. This is a completely new field for the ASA and how it applies and enforces its new found powers will set far reaching precedents.