The Online Internet-Based Advertising Accountability Program issued five decisions in November enforcing the Digital Advertising Alliance’s Self-Regulatory Principles for Online Behavioral Advertising.  The Accountability Program’s first two decisions, issued November 18 against BMW of North America and Scottrade, addressed those companies’ failure to provide notice of third-party data collection on their websites.  On November 20, the Accountability Program issued three more decisions stemming from a recent online behavioral advertising campaign by personal genomics and biotechnology company 23andMe.

BMW and Scottrade Decisions

The Accountability Program launched formal reviews of BMW of North America and Scottrade after discovering that both companies allowed third parties to collect consumer data on their websites for behavioral advertising purposes without providing notice of this practice as required by the Principles.

The Principles require real-time notice when an ad is based on interests inferred from a prior website visit, as well as “clear, meaningful and prominent” notice on the relevant website that data for online behavioral advertising is being collected by a third party.  The Accountability Program found that BMW and Scottrade had failed to provide appropriate website notices concerning third-party data collection.  According to the decisions, BMW’s and Scottrade’s websites were deficient in the following areas:

  • Both websites lacked language notifying consumers that the company allowed third-party data collection for online behavioral advertising on its website.  According to the decisions, in addition to describing the data collection that takes place, the disclosure must contain a link either to an industry-developed consumer choice page or another opt-out mechanism listing every third party conducting online behavioral advertising activity on the website.
  • The websites failed to provide an enhanced notice link on every webpage where third-party data collection was taking place.  According to the decision, this link must direct visitors to the website’s online behavioral advertising disclosure. 
  • Neither website included a statement of adherence to the Principles.  According to the decisions, this requirement can be satisfied by a written statement indicating adherence to the Principles in a privacy policy or online behavioral advertising disclosure, or by using either the AdChoices Icon or DAA-approved wording in the enhanced notice link.  (DAA-approved phrases are “Ad Choices,” “Interest Based Ads,” or “Why did I get this ad?”)

The decisions against BMW and Scottrade come on the heels of the Accountability Program’s warning that it would begin taking action against “First Parties”–i.e., website operators–for failing to provide “enhanced notice” of third-party data collection and use for OBA.    

23andMe Decisions

The Accountability Program began reviewing 23andMe’s online behavioral advertising practices after discovering that the company was retargeting ads to consumers who had previously visited the company’s website without providing  the “enhanced notice” required by the Principles

In its decision, the Accountability Program determined that 23andMe’s retargeted ads violated the Transparency principle by failing to include enhanced notice.  The Principles require that such ads “carry real-time notice, usually provided through the AdChoices Icon, which when clicked, takes the consumer to a location where the consumer can learn about [online behavioral advertising] and make an informed choice about participating in interest-based advertising.”  The Accountability Program also determined that, like BMW and Scottrade, 23andMe’s website failed to provide notice that data was being collected by a third party for online behavioral advertising purposes.  The Accountability Program also determined, however, that 23andMe failed to provide real-time notice that its ads were based on consumers’ prior website visits. 

The Accountability Program issued related decisions against 3Q Digital, the digital marketing agency that managed 23andMe’s online behavioral advertising campaign, and MediaMath, which provided the demand-side platform used by 3Q Digital.  These companies also were found to have violated the Transparency principle by failing to ensure that 23andMe’s retargeted ads provided enhanced notice. 

In enforcing the Principles against the advertiser, the ad agency, and the platform provider, the Accountability Program emphasized that “all parties in the advertising ecosystem must work together to ensure that consumers receive the benefits” of the Principles.