On 26 August, 2011, the Article 29 Working Party, a group of European data protection authorities, published a letter to the Online Behavioural Advertising Industry regarding the proposed industry self-regulatory framework, known as the Best Practice Recommendation on Online Behavioural Advertising (the “Code”). The letter sets out the main data privacy concerns identified by the Working Party arising from the Code. The Working Party takes a strict view regarding the application of the European Data Protection and ePrivacy Directives to the use of cookies for purposes of tracking consumer behaviour online. The main issues discussed in the letter are set out below:

1. Clear Consent. The Working Party emphasizes that European data privacy laws require users’ freely given, specific and informed consent to be obtained before cookies can be placed on their terminal equipment to track their online behaviour. The suggestion in the Code that such consent could be inferred from the inaction of the user is rejected – in the Working Party’s view, not objecting to being tracked for purposes of receiving behavioural advertising is not the same as exercising a real choice. Similarly, the Working Party considers that only browser settings that reject third party cookies by default and require some positive action from users to accept cookies for specific purposes meet the current legal requirements.

2. Streamlined Procedures for Multiple Ad Network Providers. While the Working Party accepts that a large number of ad network providers on a website may result in multiple pop-ups, users should nevertheless be entitled to choose whether to receive or reject specific cookies. Website operators and ad network providers could, for example, consider setting up streamlined procedures whereby users could accept or decline cookies for the various ad network providers in a centralized way.

3. Clear and Comprehensive Information.The Working Party is not convinced that, as suggested in the Code, an icon could act as a notice of behavioural advertising – such an icon is unlikely to convey enough information to most Internet users. Rather, it states that clear and comprehensive language should be used making clear to users that their activities are being tracked and they are being profiled for advertising purposes.

4. Targeted Information. The Working Party also states that information about online behavioural advertising must be given directly to individuals – it is not enough to simply make the information available somewhere online. Therefore, the mechanism suggested in the Code, which requires users to click several times on an icon before receiving additional information about behavioural advertising and being able to opt-out, is considered inadequate by the Working Party.

Annexed to the Working Party letter is a communication from the Federal Trade Commission (“FTC”) to the Working Party, setting out the FTC’s position on online behavioural advertising. The FTC, while not commenting on the Code itself, agrees with the Working Party that consumers should receive clear information about how their data is collected and used and be provided meaningful means to control these behavioural advertising practices.

Tags: behavioral advertising, European Union (EU), Working Party 29
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as the IAPP’s European Advisory Board, Privacy International and the European security agency, ENISA.

Read more about Dan CooperEmail
Show more Show less