Online behavioural advertising transparency and opt out requirements to be set out in UK advertising rules

The Committee of Advertising Practice (CAP) said that new rules (2-page / 85KB PDF) governing the practice of online behavioural advertising (OBA) will come into effect on 4 February 2013. The rules set standards of transparency for advertising networks and other 'third parties' around their use of OBA, whilst they also require that organisations to provide users with an element of control so as to "opt out" from having their online activity tracked for OBA purposes.

The rules will apply to advertising networks that deliver targeted adverts to internet users based on information collected about those users' online activity. Publishers and advertising networks use 'cookies' to track user behaviour on websites and use the information they glean to serve adverts targeted towards the apparent interests of those users.

A third party is defined, under the new rules, as "an organisation that engages in OBA (i.e. collects and uses web viewing behaviour data for the purposes of OBA) via websites other than those that it or an entity with which it is under common control owns or operates".

The Advertising Standards Authority (ASA) will be responsible for monitoring compliance and for handling complaints about potential breaches of the rules.

Under new rules third parties must publish "a clear and comprehensive notice" on their website that explains the "collection and use of web viewing behaviour data for the purposes of OBA". The notice must also explain to internet users that they have the right to "opt out" from being tracked for OBA purposes. The notice should also contain a link to the "relevant mechanism" through which users can exercise their right to opt out.

In addition, the third party organisations are required to publish a similar notice outlining that they are involved in "collecting and using web viewing behaviour data for the purposes of OBA, either in or around" in the OBA-delivered ad itself. That notice should also contain a link through to where individuals can opt out.

The rules also prohibit third parties from creating "interest segments" that are "specifically designed for the purpose of targeting OBA to children aged 12 or under".

In addition, if third parties use "technology to collect and use information about all or substantially all websites that are visited by web users on a particular computer in order to deliver OBA to that computer" they must obtain the "explicit consent" of web users "before doing so".

CAP said that the rules build on a self-regulatory framework that has already been established in Europe by the advertising industry.

The Internet Advertising Bureau (IAB) Europe set up a voluntary code that requires businesses sign up to display an icon if they use adverts that track users' behaviour. If users click on the icon they are taken to a website that will enable them to switch off behavioural adverts delivered by companies that use the icon.

Under the voluntary code website operators must also give users access to an easy method for turning off cookie tracking on their own site, and must make it known to users that they collect data on them for behavioural advertising. Websites adhering to the rules also have to publish details of how they collect and use data, including whether personal or sensitive personal data is involved. Details of which advertisers or groups of advertisers they make the data available to also have to be published.

Nick Stringer, director of regulatory affairs at the Internet Advertising Bureau in the UK (IAB UK) welcomed the new OBA rules.

"The new CAP Code rules for behavioural advertising in the UK will complement existing EU-wide good practice, supported by the UK Government and the European Commission," Stringer said. "Together these are an innovation in self-regulation, helping deliver greater transparency and user control, whilst allowing relevant advertising to continue to underpin quality content and services. From February 2013, consumers in the UK will have independent redress via the ASA, backed by a robust pan-European enforcement regime."

Third parties that breach the new OBA rules are subject to a number of enforcement measures, according to CAP.

"In the anticipated rare cases where the third party continues to breach the rules on OBA, the CAP Compliance teams may pursue measures to encourage the third party to fall in line with the Code," CAP said in a regulatory statement (5-page / 138KB PDF) about the new rules. "This could involve bringing to the attention of the third parties’ potential clients and partners, the non-compliance of the third party."

"In addition, for third party signatories of the EU Industry Framework, which comprise the vast majority of UK operating third parties, the CAP Compliance teams will have two additional sanctions at their disposal: the ability to remove the trading seal of approval that signifies their compliance with the Framework, and the removal of the licence to use the single European icon to provide notice. Both additional sanctions are likely to have a significant impact if invoked and CAP would take a progressive approach when using these sanctions with the intent that third parties will agree to comply before such action is necessary," it said.

CAP chairman, James Best, said: "The ASA’s regulation of OBA will bolster consumers’ on-going trust in how data around their web viewing behaviour is collected by notifying and then enabling them to exercise choice over receiving such ads."

The new OBA rules do not apply to "contextual advertising; web analytics; ad reporting or ad delivery; the collection and use of information for behavioural advertising by web site operators on their own website(s) or the use of OBA in rich media, in-stream videos online or on mobile devices," according to CAP.