Earlier this year, the California State Senate passed an amendment to the California Online Privacy Protection Act (“CalOPPA”). Effective January 1, 2014, website operators are required to disclose through their privacy statements how they respond to Do-Not-Track signals and whether other parties may collect personally identifiable information about a consumer’s online activities over time and across different websites when a consumer uses the operator’s website or service.
On the heels of the foregoing, the Council of Better Business Bureaus (“CBBB”) Online Interest-Based Advertising Accountability Program issued an industry-wide compliance warning to all first-party website operators and publishers regarding the collection of online behavioral advertising (“OBA”) data. The specific requirement at issue concerns “enhanced notice” and transparency.
The purpose of the requirement is to demystify interest-based advertising for consumers. Enforcement of this requirement will also begin on January 1, 2014.
The compliance warning clarifies first-party responsibility to provide enhanced notice in the form of a clear, meaningful and prominent link on each page where data is collected to serve the consumer interest-based advertising (the “Link”).
The Link must link directly to the website’s disclosure of its OBA practices. It must provide an easy-to-use mechanism allowing consumers to control their participation in interest-based advertising, either through an in-ad, industry-developed notice (like the Digital Advertising Alliance’s Consumer Choice page), or provide an accurate, up-to-date and comprehensive list of links to the choice mechanisms of all third-parties engaged in OBA on the website.
If there is not an advertisement on every page, but a page still collects OBA data, then the Link should appear elsewhere on the page (for example, in the website footer). The Link must be distinct from the website’s privacy statement link.
A first-party website operator must provide enhanced notice when a third-party (e.g., an ad network) does not provide enhanced notice, or make arrangements with the first-party to do so. A first-party website operator must also provide enhanced notice if it sells or otherwise transfers data to unaffiliated third-parties for the third-parties’ use in OBA.
The warning explains that first-parties and third-parties share responsibility for providing enhanced notice of third-party data collection.
Industry participants should consult with an advertising law attorney prior to January 1, 2014 to ensure compliance with all OBA Principles, including the enhanced notice requirement, as well as recent amendments to calOPPA.
Information conveyed in this article is provided for informational purposes only and does not constitute, nor should it be relied upon, as legal advice. No person should act or rely on any information in this article without seeking the advice of an attorney.
