Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

core/image

Effective September 1, 2015, the Digital Advertising Alliance (DAA) is now enforcing its Self-Regulatory Principles for <a href="http://www.aboutads.info/obaprinciples">Online Behavioral Advertising</a> and <a href="http://www.aboutads.info/msdprinciples">Multi-Site Data</a> (collectively, the “Principles”) in the mobile ecosystem. The DAA, a cross-industry, self-regulatory group of advertising and media companies, has until now focused its enforcement of the Principles exclusively on the desktop browser environment. The Principles will be applied to mobile in accordance with the DAA’s previously released guidelines, <a href="http://www.aboutads.info/DAA_Mobile_Guidance.pdf">Application of Self-Regulatory Principles to the Mobile Environment</a> (“Mobile Guidelines”), issued in July 2013. The move to begin enforcement follows the DAA’s release earlier this year of two new consumer protection tools for mobile – the “AppChoices” mobile app and the “DAA Consumer Choice Page for Mobile Web.”

core/paragraph

For those unfamiliar with the DAA’s Principles and their role in the online advertising industry, the Principles apply to “interest-based advertising” (IBA), or “the collection of data from a particular computer or device regarding Web viewing behaviors over time and across non-Affiliate Web sites for the purpose of using such data to predict user preferences or interests to deliver advertising to that computer or device based on the preferences or interests inferred from such Web viewing behaviors.” For first and third parties involved in the delivery of IBA (e.g., publishers, advertisers, and ad networks), the Principles require certain levels of “transparency” and “choice.” Transparency must be provided through visible disclosures and “enhanced notice” (often through the AdChoices tag), and choice must be provided to consumers through a meaningful, easy-to-use way to exercise control over collection of data for IBA purposes.

With the DAA commencing enforcement of the Principles on mobile, advertisers, publishers, mobile developers, and ad networks are encouraged to review the Mobile Guidelines and the Principles. As the DAA emphasized in a <a href="https://www.youtube.com/watch?v=GeqHsKdGPwU">webinar</a> earlier this year, all parties working together to conduct IBA share in the responsibility for compliance.

In particular, there are a few key points from the Mobile Guidelines that bear repeating for any party involved in mobile IBA:

Enhanced Notice Visibility: Covered parties must ensure that any “enhanced notice” required by the Principles is appropriate for mobile screen sizes.

core/list-item

Precise Location Data: The Guidelines require clear, prominent, and meaningful notice if a third party intends to collect or use (or a first party intends to share) the “precise location data” of a consumer. Precise location data is defined as “data obtained from a device about the physical location of the device that is sufficiently precise to locate a specific individual or device.”

Personal Directory Data: For “Personal Directory Data” (e.g., a phone’s contact book, calendar, photos, etc.), parties must obtain authorization from the mobile user before any such data can be accessed or shared. This should most likely be obtained through a mobile operating systems’ native controls.

Cross-App Data: Third parties should provide enhanced notice for any collection and use of cross-app data. As defined in the Mobile Guidelines, “cross-app data” is “any data collected from a particular device regarding application use over time and across non-affiliate applications.” Importantly, the use and tracking of unique mobile device IDs for IBA would fall under the DAA’s compliance requirements.

Data Security and Sensitive Data: Companies should maintain appropriate physical, electronic, and administrative safeguards to protect multi-site data, cross-app data, precise location data, and personal directory data. Sensitive data, such as Social Security numbers, medical records, or financial account numbers, should not be collected for IBA purposes without consent from the consumer.

core/list

Also important to note, the DAA has emphasized that Mobile Guidelines not only apply to traditional banner ads but also govern interest-based native advertising on mobile. With the proliferation of new forms of mobile advertising such as native, content advertising, and programmatic, it will be important that parties serving IBA think critically about how they can use these new mediums while maintaining compliance with the Principles. We will cover any further developments from the DAA as it expands its enforcement into the mobile space.

DAA Begins Enforcing Its Guidelines for Mobile Advertising This Month: What You Should Know in Order to Prepare