Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="size-medium wp-image-5202 alignright" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2018/03/iStock-533837429-online-shopping-300x200.jpg" alt="" width="300" height="200" />

Liftopia, an e-commerce platform that enables ski resorts to sell advance-purchase tickets online, was cited in a recent <a href="https://www.bbb.org/globalassets/local-bbbs/council-113/media/behavioral-advertising/liftopia-decision.pdf">decision</a> by the Better Business Bureau’s Online Interest-Based Advertising Accountability Program (OIBAAP) for failing to provide consumers with sufficient notice and choice relating to the collection of data for targeted ads and the serving of interest-based advertising (IBA), including ad retargeting, as required by the Digital Advertising Alliance (DAA) Principles.



Online merchants frequently use IBA to follow up with consumers who have visited their sites by “retargeting” them with ads on other sites they later visit. Maybe you have seen ads on multiples sites for a product you abandoned in a shopping cart for a few days, and perhaps you even completed the purchase as a result of those ads. Under the ad industry’s IBA self-regulatory program, managed by the DAA and enforced by the OIBAAP, consumers have the right to opt out of that kind of targeting, and publishers and advertisers have an obligation to inform consumers of that right and to honor consumer choices.

The OIBAAP polices the internet to make sure publishers and advertisers are meeting their transparency and consumer choice obligations. With the OIBAAP’s history of enforcement actions involving both digital advertisers and publishers, this recent action reiterates the principles that publishers of websites must follow relating to any IBA taking place on their websites.

A Link to “Enhanced Notice” Must Be Provided on Every Webpage of a Publisher’s Website Where Third Parties Collect IBA Info

“Enhanced Noticed” is required when third parties are collecting or using data for IBA on a publisher’s website. This must be in the form of a “clear, meaningful, and prominent” link that directs parties to the publisher’s IBA disclosure. The requirement for enhanced notice is often satisfied by a third-party advertiser placing a link to the disclosure in an advertisement served to the publisher’s website. However, there are instances in which the advertiser is unable to place the disclosure link or certain pages of the publisher’s website do not contain ads.

In the Liftopia case, the OIBAAP found that the e-commerce provider, in the footer of each page, provided a link to the top of its privacy policy, which contained the enhanced notice further down in the document. Consistent with prior decisions (and as we reported <a href="https://www.dataprivacymonitor.com/behavioral-advertising/ad-industry-enforcer-issues-reminder-that-notice-and-choice-are-musts-for-companies-engaged-in-interest-based-advertising-and-native-advertising/">here</a>), the OIBAAP found that such a practice was not consistent with the Self-Regulatory Principles.

The takeaway from the Liftopia case, consistent with this and prior decisions, is that each page of a website where third parties are collecting data for IBA must contain a link that is separate and distinct from the privacy policy link, and such link must either be (1) a deep link to the enhanced notice within the website’s privacy policy or (2) to a separate page containing the enhanced notice. This will ensure website publishers’ compliance with the Self-Regulatory Principles if there are noncompliant ads, or no ads, on a particular webpage of its website.

Also, the Enhanced Disclosure Must Include a Statement of Adherence to the DAA Principles

The Self-Regulatory Principles also require that the publisher include a statement of adherence to the DAA Principles on its website. While this is a simple statement to include in the enhanced disclosure, website publishers should take care to ensure it is present. In Liftopia, the OIBAAP gave a not insignificant amount of attention to the fact that the website operator omitted the statement of adherence to DAA principles. This is an indication that meeting all of the requirements of the Self-Regulatory Principles, including this one-sentence statement, is a priority to the OIBAAP.

Publishers that enable IBA in connection with their websites or mobile apps should make sure they are providing consumers with notice of the DAA’s consumer choice program in the manner the DAA prescribes, and that they and their ad servers are honoring opt-outs by consumers. For more information, contact the authors.

Online Merchant Cited for Inadequate Interest-Based Advertising Disclosures