European Self-regulation for Online Behavioural Advertising. Transparency and Control for Consumers

Transcription

1 European Sef-reguation for Onine Behavioura Advertising Transparency and Contro for Consumers

2 Onine Behavioura Advertising IAB Europe and its members have worked on a European Framework for Onine Behavioura Advertising that wi increase transparency and contro for Onine Behavioura Advertising. This signatory-based Onine Behavioura Advertising Framework of IAB Europe (herein referred to as the OBA Framework ) is an integra part of the European Advertising Standards Aiance s ( EASA ) comprehensive sef-reguatory Best Practice Recommendation ( BPR ) for Onine Behavioura Advertising. The BPR incorporates and compements the principes incuded in the OBA Framework. OBA Framework): Web sites that have OBA companies on their sites can provide a cear notice in their privacy notice about it and incude a ink to the OBA User Choice Site to faciitate user interaction. The OBA Framework aso carifies that if a company uses technoogies that are intended to coect a or substantiay a URLs (i.e. Websites visited by a consumer) on a PC (or any other device) and uses such data for OBA it wi need the consumer s expicit consent for this. The OBA Framework and the BPR bring new means for the interaction of companies with consumers and estabish new standards for transparency and user contro for Onine Behavioura Advertising ( OBA ). Those standards incorporate a number of principes that wi radicay change the way consumers are informed and empowered to make meaningfu choices about the use of OBA. OBA reates to the coection of onine data in order to faciitate the deivery of advertising based on the potentia preferences or interests of web users or to advertise a product users have shown interest in previousy (socaed re-targeting). Such adverts typicay are more reevant for consumers and enhance their experience by providing adverts taiored to their potentia interests. The OBA Framework and the BPR recognise that when consumers visit a website they wi not necessariy be aware that it is possibe for another company (defined as Third Party under the OBA Framework) to provide advertising and coect web viewing data from the consumers Persona Computer (PC) (or any other device) over time. Such coection aims at improving the reevance of adverts for consumers. The proposed OBA Framework and the BPR wi be impemented in a manner that woud introduce a uniform pictogram ( icon ) across the European countries (EU & EEA). Once cicked on, the icon woud show more information about some or a of companies invoved in providing this advert in simpe ayman s anguage. In addition, consumers wi be given easy access to the OBA User Choice Site ( that provides information about OBA and the possibiity for users to turn off OBA if they desire to do so. In this case, consumers wi sti receive adverts but not ones that have taken into account their potentia interests based on previous web surfing behaviour. This notification mechanism wi be compemented by obigations for web sites (defined as Web Site Operators in the The OBA Framework estabishes a high standard for sensitive segments by requiring a user s expicit consent if sensitive persona data is coected (as defined by European Data Protection aw). Furthermore, it prohibits the creation of OBA segments to specificay target chidren age 12 or under. Through an innovation in sef-reguation, the OBA Framework introduces a new procedure to measure compiance with the commitments and estabishes a system of pan-european enforcement for signatory companies. Compiant companies wi receive a periodicay renewabe B2B sea. Shoud a company fa behind and not remedy a significant breach of its obigations within a imited timeframe, the sea woud be removed. As a consequence, this faiure wi be communicated to the market and the pubic. In the UK, the IASH programme has proven that the remova of such a sea has significant effects on the market and is therefore an effective sanction, strong enough to enforce compiance. Signatories must choose a compiance programme provider that can demonstrate expertise in onine measurement and / or auditing. Compiance providers wi be chosen through a competitive tender carried out by IAB Europe, which wi be pubished in Signatories signing this OBA Framework have to sef-certify their obigations under this Framework and adopt the icon by June The compiance provider wi then conduct an audit to confirm compiance with the obigations under the OBA Framework. Compiant companies wi be granted the B2B sea which wi demonstrate to business partners that the signatory is part of the sef-reguation system. The BPR incorporates a set of requirements which have been estabished under the OBA Framework; these are binding for a signatories of the OBA Framework and wi be compemented by a comprehensive industry wide compiance and enforcement programme. 1 Onine Behavioura Advertising means the coection of data from a particuar computer or device regarding web viewing behaviours over time and across mutipe web domains not under Common Contro for the purpose of using such data to predict web user preferences or interests to deiver onine advertising to that particuar computer or device based on the preferences or interests inferred from such web viewing behaviours. Onine Behavioura Advertising does not incude the activities of Web Site Operators, Ad Deivery or Ad Reporting, or contextua advertising (e.g. advertising based on the content of the web page being visited, a consumer s current visit to a web page, or a search query).

3 Onine Behavioura Advertising This wi ensure that the commitments are met in practice and puts processes in pace to cover the entire advertising ecosystem and to hande consumers compaints, through EASA s Best Practices. This doube-enforcement mechanism ( EASA PLUS ) ensures that compaints of consumers are addressed in an adequate manner and that non-compiant companies are brought into compiance by proven sanction mechanisms. Cose cooperation on compiance with the EASA network of sefreguatory organisations (SROs) wi be crucia. Whereas compaints may be fied by consumers with a variety of bodies (nationa IABs, signatories compiance programmes, consumer groups, authorities), EASA s SROs are a we-known and trusted route for consumers to obtain independent compaints handing and redress. This partnership of compiance programmes brings two primary benefits to the system: About the supporters of the OBA Framework and the BPR The industry-wide effort to deveop consumer-friendy standards for OBA activities across the Internet was activey supported by a coaition of IAB Europe and Europe s key advertising associations and supported by the European Advertising Standards Aiance (EASA) and its network of sef-reguatory organisations. This unprecedented coaboration responds to European Commission Vice President Kroes s ca to the industry to deveop sef-reguatory practices for OBA. i. For non-signatories of the OBA Framework, EASA s recognised sef-reguatory Best Practice Recommendation wi cover companies that are not bound by the compiance and enforcement provisions of the OBA Framework; ii. For signatories of the OBA Framework, EASA SROs wi provide a further and independent recourse for consumers to take their compaints shoud they remain dissatisfied. Administrators of the OBA Framework compiance and enforcement programmes shoud ensure effective coordination with EASA SROs and vice versa as we as with any other organisations receiving consumer compaints. This wi ensure transparency, consistency and coherence of the impementation and enforcement across EU and EEA Member States. 2 IASH was created in the UK to encourage best practice among the onine advertising ecosystem through an effective code of conduct. The Code ensures that dispay ads paced via their networks do not appear on websites which coud jeopardize advertisers' brands. See:

4 Frequenty asked questions What is onine behavioura advertising ( OBA )? OBA is defined in the OBA Framework and the BPR as the the coection of data from a particuar computer or device regarding Web viewing behaviours over time and across mutipe Web domains not under Common Contro for the purpose of using such data to predict consumer preferences or interests to deiver onine advertising to that particuar computer or device based on the preferences or interests inferred from such Web viewing behaviours. That definition aso incudes re-targeting, where users showing an interest in one specific product or product category on one particuar web site, are served advertising for that product or product category on other websites. Behavioura describes the type of data that is coected typicay data such as page views and cicks made by the user. Behavioura advertising therefore reies on users behaviour rather than on their identity. OBA is typicay done by inking a pattern of behaviour to a segment, or interest category. The set of segments to which a user s behavioura data is associated coud be described as a behavioura advertising profie. Such profies do not contain persona data. Does the OBA Framework cover a onine advertising? No. The OBA Framework covers ony those activities that are defined as OBA and does not incude: Activities of Web Site Operators that are imited to their own sites or sites controed by them. Contextua advertising, which is advertising based on the content of the web page being visited, a consumer s current visit to a web page, or a search query. Such advertising does not rey on the use of segments. Why did IAB Europe deveop the OBA Framework? consumer-friendy principes and enforcement standards regarding OBA. OBA has the potentia to generate higher revenues for websites such as e.g. content providers that are necessary to finance the offers users enjoy often for free. According to McKinsey, European consumers used ad funded onine services to a vaue equivaent to 69 biion for The objective of this initiative is to secure the future of this type of business practice by ensuring that consumers can understand and contro it. The OBA Framework principes provide for: Education for consumers and businesses about OBA and the OBA Framework; Transparency about data coection and use practices associated with OBA, providing consumers with cear, meaningfu and prominent notice through mutipe mechanisms; Consumer Contro over OBA; Appropriate Data Security for, and imited retention of, data coected and used for OBA purposes; Limitations on the creation of segments to specificay target chidren; Limitations on the coection of Sensitive Persona Data coected and used for OBA; Compiance and Enforcement mechanisms to ensure the effectiveness of the OBA Framework. How do I know if the activities of my company are covered by the Principes? The OBA Framework appies ony to those entities engaged in OBA. (Not a onine advertising is considered OBA.) Whie the OBA Framework and the BPR are intended to appy broady across a wide range of marketing and media entities, they focus on: Website Operators : such as Web site pubishers / operators; Third Parties : such as advertising networks and data companies (incuding ad exchanges and data aggregators) and in some cases advertisers; IAB Europe together with the eading European trade associations in the advertising ecosystem initiated a comprehensive, sef-reguatory effort to deveop and impement These types of entities work interdependenty to deiver reevant advertising to specific computers or devices in ways that enrich the consumer onine experience. The OBA Framework ase covers 3 Entities or Web sites under Common Contro incude ones which Contro, for exampe parent companies, are controed by, such as subsidiaries, or are under common Contro, such as group companies. They aso incude entities that are under a written agreement to process data for the controing entity or entities, and do such processing ony for and on behaf of that entity or entities and not for their own purposes or on their own behaf. 4 Consumers driving the digita uptake; The economic vaue of onine advertising based services for consumers Sep 2010 IABEurope/Mckinsey.

5 Frequenty asked questions technoogies that are intended to coect a or substantiay a URLs (Websites) that a PC (or any other device) traverses and uses such data for OBA. This coud incude toos and software ike toobars, Internet browsers, desktop appications or simiar technoogies. A company s actions are governed by the reevant OBA Framework and the BPR obigations reated to the particuar roe or roes it fufis in coecting and using data for OBA purposes. For exampe, an entity can be a Web Site Operator through its provision of content or retai products on its web site. It coud aso be a Third Party by virtue of serving advertisements on mutipe Web sites it doesn t contro as an ad-network or data company or in some cases an advertiser. What is the icon? What does it mean? The icon is a specific interactive symbo, which is paced in or around an OBA ad that, together with wording to be deveoped, has to be used by Third Parties to signify their adherence to the OBA Framework. It provides access to information and contros for consumers, and does so powerfuy because it is done contextuay i.e. in a context (the advert) where the consumer wi intuitivey understand it. Third Parties serving behavioura advertising wi use this icon in or around advertisements, or on the web pages where data is coected and used for behavioura advertising. The icon wi ink to user-friendy information regarding the data coection and use practices associated with that advert and an easy-to-use consumer contro too on the OBA User Choice Site Web pages where OBA data is coected can aso use the icon, or another appropriate notice, to ink to the discosures and choice options provided by the OBA Framework and the BPR. The icon shoud not be confused with the B2B sea, which focuses on businesses. The B2B sea confirms that a company s business partners are part of the OBA sef-reguatory system. How wi consumers know about this? IAB Europe, the advertising ecosystem and consumer groups wi carry out an onine educationa campaign to educate users about OBA, what the new icon means, the choices this OBA Framework and the BPR provide and how consumers can exercise their choices. Contact pubicaffairs@iabeurope.eu IAB Europe The Egg Rue Barastraat Brusses Begium

6 IAB Europe EU Framework for Onine Behavioura Advertising

7 Introduction The undersigned companies (the Companies ) have deveoped this European sef-reguatory Framework (the Framework ) for Onine Behavioura Advertising ( OBA ). The Framework ays down a structure for codifying industry good practices and estabishes certain Principes to increase transparency and choice for web users within the EU/EEA which are binding upon the Companies and Associations. The associations isted at the end of this document (the Associations ) have been working jointy on this Framework and support its promotion across the advertising ecosystem. The Principes contained herein are intended to appy consumer friendy standards to Onine Behavioura Advertising and the coection of onine data in order to faciitate the deivery of advertising based on the preferences or interests of web users. It does not seek to reguate the content of onine advertisements nor does it reguate Ad Deivery (as defined beow). The Framework does not appy to web viewing behaviour for a particuar web site or reated web sites under Common Contro. The Framework appies across the Internet ecosystem. The Framework has separate provisions for Web Site Operators, Third Parties and providers of desktop appication software that engage in OBA. The Framework recognises that a Company may conduct a number of different activities, and therefore the Framework recognises that different Principes and types of notice and consent may therefore be appicabe to each different activity. Appication of the Framework and the Principes There are a number of differing aws which may appy to OBA, particuary in cases where the data coected or processed reates to an identified or identifiabe natura persona and thereby comprises persona data. The Principes assist and encourage Companies to design into their systems and contracts a framework for compiance with appicabe aw as we as estabishing protections for areas that are un-reguated. Given that the appicabe aw varies from country to country, compiance with these Principes does not guarantee compiance with any appicabe aw and is not a substitute for such compiance. These Principes provide direct benefits to web users, in particuar by standardising consumer notices on web sites or within advertisements, and by creating simpe mechanisms for accepting or decining OBA, even though persona data is not impicated. Web users may make compaints about incidents of suspected non-compiance with the Principes against the Companies by foowing the procedures set out in the Principes. The Framework appies to OBA focusing on web viewing behaviour over time and across mutipe web domains not under Common Contro in order to create interest segments or to aocate such viewing behaviour against interest segments for the purposes of deivering advertisements to and by that web user s interests and preferences.

8 Definitions Ad Deivery Expicit Consent Ad Deivery is the deivery of onine advertisements or advertising-reated services using Ad Reporting data. Ad Deivery does not incude the coection and use of Ad Reporting data when such data is used to deiver advertisements to a computer or device based on user preferences or interests inferred from information coected over time and across sites not under Common Contro. Ad Reporting Ad Reporting is the ogging of page views on a web site or the coection or use of other information about a browser, operating system, domain name, date and time of the viewing of the web page or advertisement, and reated information for purposes incuding, but not imited to: Statistica reporting in connection with the activity on a web site(s); Web anaytics and anaysis; and Logging the number and type of ads served on a particuar web site(s). Contro Contro of an entity means that another entity (1) hods a majority of the voting rights in it, or (2) is a member of it and has the right to appoint or remove a majority of its board of directors, or (3) is a member of it and contros aone, pursuant to an agreement with other members, a majority of the voting rights in it, or (4) has paced obigations upon or otherwise contros the poicies or activities of it by way of a egay binding contract, or (5) otherwise has the power to exercise a controing infuence over the management, poicies or activities of it, and Controed sha be construed accordingy. Common Contro Entities or web sites under Common Contro incude ones which Contro, for exampe parent companies, are Controed by, such as subsidiaries, or are under common Contro, such as group companies. They aso incude entities that are under a written agreement to process data for the controing entity or entities, and do such processing ony for and on behaf of that entity or entities and not for their own purposes or on their own behaf. Expicit Consent means an individua s freey given specific and informed expicit action in response to a cear and comprehensibe notice regarding the coection and use of data for Onine Behavioura Advertising purposes. Onine Behavioura Advertising (OBA) Onine Behavioura Advertising means the coection of data from a particuar computer or device regarding web viewing behaviours over time and across mutipe web domains not under Common Contro for the purpose of using such data to predict web user preferences or interests to deiver onine advertising to that particuar computer or device based on the preferences or interests inferred from such web viewing behaviours. Onine Behavioura Advertising does not incude the activities of Web Site Operators, Ad Deivery or Ad Reporting, or contextua advertising (e.g. advertising based on the content of the web page being visited, a consumer s current visit to a web page, or a search query). OBA User Choice Site A consumer focussed web site and education porta ( avaiabe in a officia EU and the additiona EEA anguages, that provides a mechanism for web users to exercise their choice with respect to the coection and use of data for Onine Behavioura Advertising purposes by one or more Third Parties or inks to a mechanism permitting user choice over Onine Behavioura Advertising. Third Party An entity is a Third Party to the extent that it engages in Onine Behavioura Advertising on a web site or web sites other than a web site or web sites it or a an entity under Common Contro owns or operates. Web Site Operator A Web Site Operator is the owner, controer or operator of the web site with which the web user interacts. Icon An Icon is a visibe web based object that contains a hyperink to the OBA User Choice Site or to the Third Party Notice described in I.A.1.

9 The Framework Principe I. Notice A. Third Party Notice 1. Third Party Privacy Notice Third Parties shoud give cear and comprehensibe notice on their web sites describing their Onine Behavioura Advertising data coection and use practices. Such notice shoud incude cear descriptions of the foowing: (a) Their identity and contact detais; (b) The types of data coected and used for the purpose of providing OBA, incuding an indication or whether any data is persona data or sensitive persona data as defined by the nationa impementation of Directive 95/46/EC; (c) The purpose or purposes for which OBA data is processed and the recipients or categories of recipient not under Common Contro and to whom such data might be discosed; (d) An easy to use mechanism for exercising choice with regard to the coection and use of the data for OBA purposes and to the transfer of such data to Third Parties for OBA; (e) The fact that the Company adheres to these Principes; and (f) A ink to the OBA User Choice Site. 2. Third Party Enhanced Notice to Consumers (a) In addition to providing notice as described in A.1, Third Parties shoud provide enhanced notice of the coection of data for OBA purposes via the Icon in or around the advertisement; and (b) Third Parties may provide notice via the Icon on the web page where the data for OBA purposes is coected if there is an arrangement with the Web Site Operator for the provision of such notice. B. Web Site Operator Notice In addition to compying with appicabe existing ega obigations, when a Web Site Operator permits data to be coected from and used on a web site for OBA purposes by Third Parties, the Web Site Operator shoud provide adequate discosure of this arrangement. The Web Site Operator does not need to incude such discosure in instances where the Third Party provides notice as described in I.A.2. Principe II. User choice over Onine Behavioura Advertising A. Each Third Party shoud make avaiabe a mechanism for web users to exercise their choice with respect to the coection and use of data for OBA purposes and the transfer of such data to Third Parties for OBA. Such choice shoud be avaiabe from the notice described in I.A.1 and via the OBA User Choice Site. B. To the extent that Companies coect and use data via specific technoogies or practices that are intended to harvest data from a or substantiay a URLs traversed by a particuar computer or device across mutipe web domains and use such data for OBA, they shoud first obtain Expicit Consent. C. Companies that have obtained Expicit Consent pursuant to II.B shoud provide an easy to use mechanism for web users to withdraw their Expicit Consent to the coection and use of such data for OBA. Principe III. Data Security A. Safeguards Companies shoud maintain appropriate physica, eectronic, and administrative safeguards to protect the data coected and used for Onine Behavioura Advertising purposes. B. Data Storage Companies shoud retain data that is coected and used for Onine Behavioura Advertising ony for as ong as necessary to fufi a egitimate business need, or as required by aw. Principe IV. Sensitive Segmentation A. Chidren s segmentation Companies agree not to create segments for OBA purposes that are specificay designed to target chidren. For the purposes of this provision, chidren refers to peope age 12 and under. B. Other Sensitive Segments Any Company seeking to create or use such OBA segments reying on use of sensitive persona data as defined under Artice 8.1 of Directive 95/46/EC wi obtain a web user s Expicit Consent, in accordance with appicabe aw, prior to engaging in OBA using that information.

10 The Framework Principe V. Education Companies that engage in OBA shoud provide information to inform individuas and businesses about OBA, incuding easiy accessibe information about how data for OBA purposes is obtained, how it is used and how web user choice may be exercised. This may incude information in easy-to-understand anguage and user-friendy format (such as onine video). Companies and Associations are encouraged to use a consistent or common resource for such educationa information. Principe VI. Compiance and Enforcement Programmes A. Appicabiity and Eigibiity This Framework is sef-reguatory in nature and creates obigations for any signatory Company that sef-certifies compiance with the Principes and obigations contained herein. Foowing the adoption of this Framework and the Icon each Company shoud compy and sef certify by 30 June Companies adopting the Framework ater than 1 January 2012 shoud compy and sef certify within 6 months of adopting the Framework and the Icon. B. Compiance and Sef-certification Sef-certification of compiance sha be imited to those requirements appicabe to each Company s business mode. In the event that a singe Company may be subject to mutipe obigations, sef-certification must cover a such appicabe provisions. Sef-certification of compiance with this Framework does not exempt Companies from fufiing their obigations under appicabe nationa aws. C. Auditing of Sef-certification Companies that are subject to Principe II sha submit to independent audits of their sef-certification. Audits shoud be of sufficient scope to review compiance of Companies engaging in OBA in the EU and EEA Member States. Such independent audits must demonstrate, at a minimum, the foowing attributes: a) Processes for individua and independent review of Company web sites for the purpose of vaidating compiance with obigations under this Framework; b) Processes for automated or individuaised periodic monitoring of a statisticay significant number of web sites where objective evidence of compiance with Principes I and II in this Framework can be verified; c) Processes for resoving identified areas of noncompiance directy with the signatory Company in a transparent manner and within a reasonabe period of time; d) Pubication of decisions in case of un-rectified noncompiance with any commitments made under this Framework, as we as the findings of genera good compiance, for one or mutipe Companies that have sefcertified under this Framework. D. Consumer Compaints Handing Programmes under this Framework for compaints handing sha incude the foowing eements: a) Easiy accessibe mechanisms for compaints to be fied directy to Companies; b) Transparent, easiy recognisabe and accessibe mechanisms for handing compaints through independent, aternative dispute resoution mechanisms such as advertising sef-reguatory bodies; c) Coordination between Companies and aternative dispute resoution mechanisms, incuding advertising sefreguatory bodies, to ensure that Companies engaged in OBA are not unreasonaby subject to mutipe enforcement mechanisms regarding compiance with the obigations of the Framework; d) Consumers fiing compaints to a compaints handing body, incuding advertising sef-reguatory organisations sha have access to a simpe compaint handing mechanisms in their oca anguage; e) Pubication of decisions in case of non-compiance with the commitments under this Framework, incuding in the anguage of the country where the compaint was first aunched. In addition, Companies that are subject to this Principe sha coaborate to make avaiabe the OBA User Choice Site. E. Reationship between Compiance Programmes: Administrators of reevant auditing and compiance programmes, incuding existing advertising sef-reguatory systems in the context of processing consumer compaints, shoud ensure effective coordination, incuding promoting a common audit form within the EU and EEA Member States and with other regions or countries such as the USA. Administrators of reevant compiance programmes shoud aso coordinate to ensure transparency, consistency and coherence of the impementation and enforcement across EU and EEA Member States.

11 The Framework Principe VII. Review The undersigning Companies and Associations sha reguary review this Framework at east every 3 years in response to the deveopment of OBA and business practices, and modify or add to the Framework as appropriate. Stephan Noer CEO Rowena Toguchi Senior Director of Marketing Communications Brian Fitzpatrick Managing Director, UK Media DeWayne Martin Senior Vice President, Ad Soutions Matthew Hunt Managing Director Rob Rasko President and Chief Operating Officer Guy Sneersby Managing Director Pau Goad Managing Director Timothy Anderson Fink VP Goba Data Operations Estee Werth Lega Counse Europe Brandon Keenen Saes Director UK Arnaud Capier Cofounder Cain Rotarus Genera Manager John Patten Director Stuart Coman Managing Director, Europe Eamonn Faon CEO Tom Bowman VP Strategy & Operations, Goba Advertsing Saes Fred Karsson Fred Karsson CEO CEO

12 The Framework Rob Grimshaw Managing Director Vincent Karachira CEO Luc Tran-Thang VP Orange Advertising Bi Kinay Chief Executive, Group M Ireand Nataia Martos Goba Chief Privacy Officer Ross Jenkins Managing Director, Profero Eieen Rudi Group Onine Saes Director Justin Cuen Managing Director Cristian Petriceanu Nationa Saes Manager Joris van Heukeom Director Digita Pubishing & Pubisher News Adam Lehman Chief Operating Officer Jane Lorigan Managing Director, Ireand Aisha Outaw Director of Finance Ian Dowds Vice President, UK Laurent Deaporte VP Microsoft Advertising Europe Antony Mures Commercia Director David Kiashek Managing Director, UK Donad Hamiton COO

13 The Framework Patrick Dowing COO Aain Levy CEO Chris Peekanou Advertising Saes Director Warren Cray_Head Kieran of Digita Harte Head of Digita Chris Brake Director Warren Cray Senior VP, Ad Soutions Tim Brown Managing Director Stephen Grant Director of Onine Saes, TV3 David Neson IT Director Matthias Ehrich CEO Martin Forbes Senior VP, Corporate Operations

14 Supporting Associations Asociácia internetových médií Contact IAB Europe The Egg Rue Barastraat Brusses Begium