The Article 29 Working Party (WP) released an open letter, dated August 3, 2011, to the Internet Advertising Bureau (IAB) Europe and the European Advertising Standards Alliance (EASA) on the draft self-regulatory Framework for Online Behavioral Advertising put forth by both organizations (the code). The letter—preceding a meeting with industry on September 14—underscores the WP’s main concerns with the code and includes a letter from the U.S. Federal Trade Commission (FTC) on its perspective on online behavioral advertising. The WP will use the organizations’ responses to its open letter when drafting an official opinion on the code, which is anticipated by the end of this year.
The WP’s concern centers on the concept of consent under the e-Privacy Directive. The WP highlights that the standard to determine if consent is valid under the e-Privacy Directive is the same as under the Data Protection Directive; thus, the standard should be applied consistently for both directives. For online behavioral advertising, consent requires ad networks to provide sufficient information prior to setting a cookie and rely on a user’s active acceptance to manifest an agreement to accept tracking. The WP touches on several areas where the code falls short on consent: a user’s clear indication of his/her wishes, the possibility of utilizing streamlined procedures and browser settings and the clarity and availability of information provided to users.
The WP disagrees with the code’s proposed method for ad providers and web applications to get consent. The WP notes that the code proposes to track for behavioral advertising unless individuals object, which falls short of the consent requirement. In order to be valid, individuals must give clear indications of their wishes—without, consent cannot be presumed. This issue is compounded by the fact that most users have limited knowledge and understanding of online behavioral advertising methods.
The online advertising industry indicated that, due to the number of ad network providers potentially present on a specific website, mechanisms that would require user consent would imply multiple pop-ups. The WP notes that each ad network that sets a cookie is separately engaging in profiling and later sending specific ads. Thus, the legal requirement that the user provide consent prior to setting the cookie applies to each ad network provider. However, consent is not required prior to the setting of each individual cookie, access or transmission by a website—once users have agreed to specific ad network transmissions and accessing cookies, this ad provider does not have to ask again for access and transmission of cookies. Still, users should still be provided the possibility to subsequently “opt-out” (i.e. revoke their consent to being tracked).
The main focus of a streamlining procedure for the acquisition of user consent is via browser settings. Consent obtained via browser settings may be valid if “technically possible and effective and in accordance with the relevant provisions” of the Data Protection Directive. The WP states that data subjects’ consent cannot be valid via the use of browsers or other applications that have default settings to collect and process user information. This concern is high due to the limited knowledge of users surrounding cookies and the significance of tracking. For browsers and other applications to deliver valid consent, the default settings must reject third-party cookies and require the data subject to take “affirmative action to accept cookies from specific websites for a specific purpose.” Additionally, browsers should communicate the necessary information about the purpose of the cookies and possible further processing.
The WP also notes that clarity and availability of information about online behavioral advertisements is necessary for valid consent. For consent to be valid, it must be granted after the user has been given clear and comprehensive information, which includes the purposes of processing. The precise information requirements vary by country and circumstance, so this will likely be an additional burden for ad providers and web application providers when drafting such information language. The WP notes that in practice clarity of information will likely depend on the method or means through which the information is passed. The code conceives that information notices will be conveyed via a special icon displayed on websites. An icon could develop into a method of transferring certain information in the future. However, at the moment an icon signifies little to users, as they are not familiar with it. Thus the use of an icon does not comply with the information requirement because the icon has no significance and it does not transmit the necessary information. The information needs to be clear and properly explain that user browsing activity is tracked and that they will be profiled for the purpose of displaying ads. Additionally, information must be provided to the individuals, and it is not sufficient to have the information merely available somewhere (e.g. the code suggests a website with the required information). Information must be given directly to the users in order to allow informed consent. Information that is essential for users to take informed actions (confirm or deny consent) should be directly visible.
Finally, the communication also includes a letter from the FTC in response the WP’s solicitation on the FTC’s staff views on transparency and consumer choice in connection with online behavioral advertising. The FTC chair outlines that they have advocated for greater transparency and consumer control and reference
. This report does not specify whether choice should be opt-in or opt-out, but it does highlight the FTC’s support of a Do Not Track system. The FTC notes that such mechanisms are gaining momentum and that several efforts are underway to promote self-regulatory efforts surrounding Do Not Track.
The meeting occurred on September 14, 2011, where the WP’s Chairman, Jacob Kohnstamm, and its delegates met with the representatives from IAB Europe and EASA. At the meeting the chairman reiterated the concerns highlighted in the letter and emphasized that the code does not fully comply with European and national requirements. The chairman invited the IAB Europe and EASA to address the concerns outlined in the letter and announced that the WP will release an opinion on the code by the end of 2011, which will take any answers from industry into account.
The full text of the letter is available
and the press release regarding the September 14th meeting is available
.
Coauthored by
Katherine Woodcock of Lorenz Brussels. She can be reached at
.
