Online Behavioral Advertising (OBA) Legal & Regulatory Compliance

ONLINE BEHAVIORAL ADVERTISING:Trends in Privacy & Risk

what is online behavioral advertising?overview

most internet users would like to be anonymous*

perceptions of personalization

have taken steps online to remove or mask their digital footprints

have taken steps to avoid observation

have had email or social networking account compromised

*Pew Internet & American Life Project, September 2013

Technological innovation comes with Massive Risk

Many believe person info has been stolen or used improperly

perceptions of personalization

have been stalked or harassed

have had personal information stolen

have been the victim of an online scam

have had their reputation damaged

have been led into physical danger

regulatory response

February 2012:• Obama releases Report: Consumer Data Privacy in a

Networked World✴ Consumer Privacy Bill of Rights✴ Control, Transparency, Context, Security Access/Accuracy,

Collection & Accountability

June 2013:• FTC: Julie Brill “FTC is ramping up enforcement” against

those who break federal privacy laws, especially in the expanding new world of smartphones and mobile apps

Georgia Congressman Hank Johnson introduced the bipartisan Application Privacy, Protection andSecurity (APPS) Act of 2013 (H.R. 1913)

• Notice + Consent• Self-Regulation• Opt Out• Security• Enforcement: FTC

federal legislative response

state legislative response

California: “Do not Track”" law effective January 1, 2014

• Who: Any operator of a website, online service, or mobile app

• How: If personally-identifiable info about CA residents is collected

• What: Must include do-not-track disclosures in its privacy policy

• Implications: Applies to ANY online business

state legislative response

California: S.B. 568 enacts two new statutes under the title “Privacy Rights for California Minors in the Digital World.”

• Business & Professions Code section 22580, prohibits advertising certain products to minors online

• Business & Professional Code section 22581, requires business to provide an online “eraser button” for remorseful minors

• Implications: Applies to ANY online business

industry response

Who 1) BBB-ASRC, 2) DAA, 3) PMA, 4) MMA

• Self-regulatory principles:http://www.iab.net/media/file/ven-principles-07-

01-09.pdf

• January 1, 2014: deadline ot provide notice and choice to consumers about collection and use of data for (OBA)

industry enforcement

Scottrade and BMW : Companies were in compliance with the in-ad notice requirements but not with Transparency and Consumer Control Principles.

1. Did not include an OBA describing the OBA activity occurring2. Did not include either a link to an industry-developed consumer choice

page or list of every third party conducting OBA activity

3. Did not include ensure that an enhanced notice link was present on every page of its website where data collection or use for OBA occurred

4. Did not indicate its adherence to the OBA Principles on its website

industry enforcement cont.

• Volkswagen: complied with the in-ad notice requirements,but not with the Transparency and Consumer Control Principles.

• 23andMe, 3Q Digital, and MediaMath: Campaign managed by 23andMe’s digital marketing agency (3Q Digital) used demand-side platform provided by MediaMath (self-serve)

• Each company assumed one of the others was in charge of complying with the Self-Regulatory Principles, but none actually did.

FTC enforcement

• FTC tasked with safeguarding Consumers & Markets• Broad authority• Focus on Uses/Abuses of “Big Data”

★ Fair credit Reporting Act✴ Transparency✴ Notice + Choice

• Privacy By Design★ HTC

FTC enforcement cont.

• 2013: FTC Staff Revises Online Advertising Disclosure Guidelines• July 1, 2013: FTC releases updated COPPA Rule• CAN-SPAM Act• Civil Litigation: Google/Double Click

★ Violated state consumer protection placing advertising tracking cookies

★ FTC fined Google $22.5 million in 2012 over similar practices

that violated an earlier settlement

best practices1. Review collection practices

best practices2. Review marketing partners

best practices3. Privacy Policy Tune-up | DNT, Online Eraser

best practices4. Put systems in place

best practices5. Data, Collection, Storage, Use

Thank You!David M. AdlerLeavens, Strand, Glover & Adler

866.734.2568www.ecommerceattorney.comDavid@adler-law.comadlerlaw.wordpress.com@adlerlaw