The Council of Better Business Bureaus (“CBBB”) has issued a Compliance Warning letter announcing that, beginning January 1, 2014, the CBBB will commence enforcement actions against website publishers, operators, and other first parties that do not provide transparency with respect to data collected from visitors to their site and used by third parties for online behavioral advertising (“OBA”) purposes. The CBBB operates an accountability program for enforcing the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Principles governing the collection and use of web viewing data.

WHO IS COVERED. A first party, which is an entity that is the owner of a website or has control over a website with which a consumer interacts where data is collected or used by a third party (e.g., ad network) for OBA purposes.

COMPLIANCE WARNING. As part of its compliance monitoring activities for the DAA, the CBBB found that some website operators are not providing on their websites notice of data collection for OBA in cases where the third parties have not provided real-time notice on the operator’s website (i.e., in ad notice using the DAA Icon).

Where a third party does not provide notice in accordance with DAA Principle II.A.(2)(a), DAA Principle II.B. requires a first party operator of a website to include a clear, meaningful, and prominent link on the Web page where data is collected. In response to this finding, the CBBB issued a Compliance Warning reminding first parties of the requirement for first parties to provide enhanced notice on every page on which third parties collect information for OBA or when the first parties themselves transfer web viewing data to unrelated third parties. The CBBB’s enforcement against first parties that fail to provide adequate notice under the OBA Principles will begin on January 1, 2014.

REVIEW PRIVACY POLICIES. On November 18, 2013, the CBBB’s Online Interest-Based Advertising Accountability Program (“Program”) issued a decision involving an inquiry  into  the  practices  of  a first party after observing third-party OBA data collection on the first party’s website without the website providing transparency or a means to exercise choice as  required  by  the  DAA Principles. In its decision, the Program set forth four requirements for first parties that allow data collection for use for OBA on their websites, or who transfer information to third parties for OBA:

  • The first requirement is for the first party to provide a website disclosure explaining OBA activity on its site.
  • Second, the disclosure should link to the DAA’s choice page or the first party should individually list all of the third parties  conducting OBA activity on  its website, including separate requirements for individual listing linkages.
  • Third, a first party should ensure that an enhanced notice link is present on every page of its website where data collection or use for OBA occurs, and must ensure that the link directs visitors to the website’s OBA disclosure.
  • Fourth, first parties should state their adherence to the DAA Principles on the website.