Retargeting cookies should expire after 48 hours and ads should be labelled, says trade body

Websites should be 'encouraged' to signal that the technology has been used, though neither measure is compulsory, according to a new code of conduct published by the IAB.

The IAB has launched the code to govern ads based on 'behavioural retargeting', where companies advertise to users who have recently viewed their websites but not made a purchase.

Behavioural advertising is becoming increasingly popular. But because it is based on the use of cookies or other technologies to track and analyse web users' behaviour and use that information to choose which adverts to display, it has also raised fears about potential invasions of privacy.

The IAB, whose members must follow its codes of practice, has published guidelines on how best to use the systems behind behavioural targeting.

Behavioural retargeting works by placing a tracking cookie in a user's web browser when they visit a retailer's website but make no purchase. That allows the company to identify that user at other sites and show it ads based on its recent visit.

The systems use post-impression (PI) and post-view (PV) cookies to identify at one site that a user previously visited another.

Parts of the code of conduct relating to the interaction between different cookies and which should trigger a payment for an ad are compulsory, but the rest is voluntary.

The code advised, but did not insist, that sites identify when the technology is being used. "The advertiser/merchant will be encouraged to highlight the programmes where PI/PV is in place, offering extra transparency for affiliates/publishers," it said.

It also said that the cookies underlying behavioural targeting systems should be more controlled than other, more routine cookies and should last for a shorter time.

"PI/PV cookie lengths are usually shorter than click cookie windows, for example 24 or 48 hours. This should be a key consideration," it said.

The code was published by the IAB's Affiliate Marketing Council (AMC) and governs the behaviour of the IAB's member affiliate networks and all companies that advertise through them.

"The growing complexity of the affiliate channel means that new opportunities for both merchants and publishers are consistently presenting themselves," said Dan Redfearn head of the IAB's AMC. "Behavioural retargeting is one such example and an exciting new development within the affiliate industry. The AMC has worked to create a fair and equitable code to ensure that all parties involved in the industry can continue to do so with confidence."

Behavioural retargeting is based on the premise that someone who has been to a site but left without buying anything is more likely to buy from that site in the future than a random viewer of an ad.

Because these cookies are based on a view, or impression, of a web page, and not based on a user's clicks, which are the usual triggers for ad payments. The code, then, sets out a hierarchy of actions that trigger payments.

"Historically very few networks or affiliate programmes have operated PI/PV cookies, the ‘harder’ action of a click being seen as more in line with the CPA [cost per action] and sale function of affiliate marketing," said an IAB statement on the code. "In working with PI/PV cookies the industry needs to set some hierarchy rules involving click and impression cookies and standardising overwriting procedure across all networks."

Behavioural advertising has attracted scrutiny from privacy and consumer protection watchdogs because of its ability to store web users' personal or sensitive data.

Privacy regulator the Information Commissioner's Office (ICO) said in July that there was nothing "intrinsically unfair" about behavioural advertising, but that users should be offered the chance to avoid being tracked.

"[Behavioural advertising] involves the processing of personal data and the [Data Protection Act (DPA)] applies," said ICO guidance. "However, using personal data in this way is not intrinsically unfair or intrusive, and the DPA provides various options for processing this information legitimately."

"Some individuals may want to visit a website without any record of their online behaviour being retained," it said. "Therefore it is good practice to provide a simple means of disabling the targeting of advertising using behavioural data."

Consumer protection watchdog the Office of Fair Trading investigated behavioural advertising earlier this year and said that it would allow self regulation to continue, but would step in if the industry did not apply and extend existing IAB rules on privacy.

It said that ads displayed on the basis of behavioural targeting should be clearly labelled.