Advertising trade body publishes behavioural tracking guidelines

Adverts that track users' behaviour will display an icon, new voluntary regulations set out by the Internet Advertising Bureau Europe (IABE) said.

Publishers and advertising networks use cookies to track user behaviour on websites in order to target adverts to individuals based on that behaviour. A cookie is a small text file that remembers a user's activity on a site.

Businesses that volunteer to follow the IABE's EU Framework for Online Behavioural Advertising (13 pages / 1.1MB PDF) will place an interactive icon in relevant adverts. The icon will link to a website, www.youronlinechoices.eu, giving details of how users can turn off behaviour tracking.

An online education campaign will be conducted to inform users about the icon, the IABE said.

Websites that use or facilitate behavioural advertising will have to install an easy method for users to turn off cookie tracking on their site, according to the new IABE rules. This method should also be available to users via the youronlinechoices site, the IABE rules say.

Operators must make it known to users that they collect data on them for behavioural advertising, the new regulations stipulate.

Websites adhering to the regulations will also have to publish details of how they collect and use data, including whether personal or sensitive personal data is involved. Details of which advertisers or groups of advertisers they make the data available to will also have to be published.

Privacy experts have previously expressed concern about how behavioural advertising systems use personal data . Last year, Europe's privacy watchdog, the Article 29 Working Party, said that companies should have to seek a user's consent before tracking their movements online.

"Consent must be obtained before the cookie is placed and/or information stored in the user's terminal equipment is collected, which is usually referred to as prior consent," the Working Party said. "Informed consent can only be obtained if prior information about the sending and purposes of the cookie has been given to the user."

"Average data subjects are not aware of the tracking of their online behaviour, the purposes of the tracking, etc. They are not always aware of how to use browser settings to reject cookies, even if this is included in privacy policies," the Working Party said. "It is a fallacy to deem that on a general basis data subject inaction (he/she has not set the browser to refuse cookies) provides a clear and unambiguous indication of his/her wishes."

In 2009 the EU announced revisions to the Privacy and Electronic Communications Directive. The alterations change the emphasis on cookie consent and could force businesses to seek user's permission before tracking online activity.

The updated Directive must be written into national laws by 25 May. Before the changes the Directive had said that users can only be tracked if they are given the opportunity to opt out of the tracking.

There is confusion on how the law will be applied. While privacy groups such as the Article 29 Working Party want companies to ask users permission first, the IABE has previously stated they believe companies can assume permission is granted according to browser settings.

This is supported by a section of preamble to the Privacy and Electronic Communications Directive (26 pages / 1.19MB PDF).

"Where it is technically possible and effective, in accordance with the relevant provisions of [the Data Protection Directive], the user's consent to processing may be expressed by using the appropriate settings of a browser or other application," the preamble states.

The UK Government has previously said that it will simply copy the exact wording of the EU Directive, adding no clarification or interpretation of its own when it creates regulations to turn the Directive into UK law.

Technology law news is also available from Bootlaw, a free resource for technology start-ups, with regular events hosted by Pinsent Masons.