Targeting and Transparency: Killing the Black Box Around User Data

Trust and Transparency

Lewis BarrBrad Cohen (@supnah)

DISRUPTION

Technology Explosion

Expanding Exposure and

Legal Response

People and companies are learning to watch for their

data leaks.

EXPANDING LEGAL EXPOSURE

Ad Age, Jan 28, 2014

SLEEP APNEA NIGHTMARE

CTV News, Jan 15, 2014

“While so-called behavioural ads are not illegal, Canada’s privacy law prohibits advertising that targets consumers based on ‘sensitive personal information,’ including health information.”

OM NOM NOM (COOKIES)

“C” IS NOT FOR COOKIES

GROWTH OF DATA COLLECTION POINTS

iab Advertising Ecosystem(https://www.iab.net/data/ecosystem.html)

THE ADVERTISING SUPPLY CHAIN

• Increased handoffs = increased risk• Personal Information reduction = risk reduction

• What are you collecting?• Who is allowed to access it?• Why are you collecting it?• Are third parties able to collect from your site?

COLLECT ONLY WHAT YOU NEED

• Loss of trust

• Reputation

• Direct business impacts

• Litigation & enforcement

TRUST IN THE BALANCE

Personal Data Collection

• What personal information your org is collecting• How it is being collected• Purpose for the collection • Whom it is being shared with and purpose of

sharing

NOTICE & CHOICE

Does your privacy statement reflect reality?

Brightest Flashlight App• Collected personal information

• Location info• Device ID from phones

• Passed info to advertisers• Without clear indications to

users

SETTLED with FTC

• Expansion of data orbit under recent COPPA rule changes

• Different rules regarding sensitive data in different jurisdictions• Canada

• Sensitive PI at issue in Google investigation

• Germany• New guidelines on personal data used in advertising

DANGER ZONE DATA

Data now considered as protected information for covered children:• Geolocation information• Photographs and videos • Audio files that contain a child’s image or voice• Any information that would permit direct contact with a child

online, • Email address• Instant message user identifier• VOIP identifier• Video chat

• Persistent identifiers• IP addresses• Mobile user IDs

• If they are used to track children over time or across websites

RECENT COPPA RULE CHANGES

AGREEMENT THE NEED FOR TRANSPARENCY

AGREEMENT ACROSS THE INDUSTRY

17

• White House• FTC• NTIA• Ad Industry

stakeholders• Attorneys General

• California’s Kamela Harris

• National Advertising Initiative (NAI)• Voluntary, applies to members only• Mobile Application Code applies to NAI members who

engage in cross-app data collection

• Digital Advertising Alliance (DAA)• Intended to apply to all industry players • Broader data focus on cross-app data, geolocation

data, and personal directory data• Transparency principle for real-time, enhanced notice

of OBA data collection and use practices • Ad Choices program

INDUSTRY INITIATIVES FOR TRANSPARENCY

EU - Consent required

US - Notice of practice required on privacy statements

DIFFERENT APPROACHES TO COOKIES

• CalOPPA Amendment by AB 370• Now in effect – requires businesses to disclose how

they respond to web browser Do Not Track signals if operator engages in collection - tracking

• Requires disclosure related to 3rd party tracking too

• CalOPPA Amendment• Takes effect Jan 1, 2015• Restrictions on online “adult” product ads to minors• “Delete button” - Ability for minors to delete or obtain

removal of content he or she has posted

NEW TRANSPARENCY REQUIREMENTS

• U.S. Congressional scrutiny and likely legislation • Background

• Snowden effect• Big Data scrutiny• Conversation shift from opt out to opt in and notice

and choice to use restriction

National breach legislation

COPPA expansion

EU Privacy Regulation

LOOKING AHEAD

SMART BRAND APPROACH

Channel 4

Channel 4

Questions?