The Committee of Advertising Practice (CAP) has introduced new rules to its UK Code of Nonbroadcast Advertising, Sales Promotion and Direct Marketing (CAP Code) that will have effect from 4 February 2013. These rules will regulate how organisations collect and use web user's data for the purposes of Online Behavioural Advertising (OBA). The new rules will have an impact on how brands use OBA to target their potential consumers.

What is OBA?

OBA is a form of targeted advertising that allows brands to publish online advertisements that reflect web users' interests. Third parties partner with websites that collect data on users' web browsing activity, in order to serve those users advertisements based on their interests. Due to the targeted nature of the advertising, it has become popular with brands in recent years and accordingly more prevalent on the web.

Despite being anonymous, web surfers have become wary of the practice, arguably due to a lack of understanding as to how it works. CAP have responded to that concern with the new rules, which have been designed to complement the pan-European standard (the EASA's Best Practice Recommendation) and the Interactive Advertising Bureau Europe's (IAB) self-regulating framework.

New Rules

CAPs's new rules will be included in the updated CAP Code to be published on 4 February 2013, in a new Appendix 3. The rules will require third parties to:

  • include a notice in or around an advertisement provided through OBA;
  • provide a link to an opt out mechanism, whereby web users can opt out of receiving OBA;
  • publish a notice on their own website which makes clear that they collect and use data for OBA purposes and provide a mechanism whereby users can opt out;
  • refrain from collecting data to produce OBA targeted at children aged 12 or under; and
  • gain explicit consent from web users before using forms of OBA that collect all or substantially all data on a web user's viewing activity for the purposes of targeted advertising.

A new rule 1.8.1 will also be inserted in the compliance section of the CAP Code that will require advertisers to co-operate with the Advertising Standards Authority (ASA), in good faith, to help determine the identity of third parties where the ASA is unable to do so.

A "third party" for the purposes of the new rules is an organisation that engages in OBA using data collected from websites, where the collecting website is not owned by the third party or a sister company of that third party.

The new rules in Appendix 3 will not apply to the collection and use of information for behavioural advertising by website operators on their own websites, web analytics, ad reporting or ad delivery, contextual advertising or the use of OBA in rich media, in-stream videos online or on mobile devices. CAP has envisaged however that the rules will be extended to cover mobile devices in the near future.


CAP have indicated that breaches of the new rules will be dealt with in line with their current approach. The ASA and the CAP Compliance teams will strive to resolve breaches on an informal basis. If that is not possible the ASA may initiate a full investigation leading to an adjudication, which is published on the ASA website. As a last resort the CAP Compliance team may pursue measures to encourage third parties to fall in line with the rules, such as bringing the non-compliance of the third party to the attention of its clients and partners.

Where third parties are signatories to the IAB's self-regulating framework, which, according to CAP, is the majority of third parties, then the CAP Compliance teams have further sanctions. These are the ability to remove the trading seal that signifies the third party's compliance with IAB's framework and the removal of the single European icon used to provide notice of OBA.


The introduction of the new rules marks an unusual step for the ASA, which has until now been generally concerned with regulating the content of advertisements; not the gathering of information for marketing purposes.

If endorsed and followed by third parties, the new rules appear likely to have a large impact on the use of OBA on the web in the UK. Ofcom research conducted in March 2012 found that nearly half of web users were not comfortable with OBA. Even allowing for inaccuracy in Ofcom's findings, it is conceivable that a significant proportion of web users will opt out of receiving OBA when given the option to do so. This would have a knock-on effect on brands that use OBA for targeted advertisements. Brands that spend a large amount of their marketing budgets on OBA could be hit especially hard and they should be prepared for a strategy rethink.

In its regulatory statement, CAP has attempted to balance Ofcom's findings with those of IAB UK, which found that web users were more likely to want targeted advertising when OBA was explained to them. It remains to be seen whether the notices that third parties will be obliged to publish when OBA is used will encourage web users to receive OBA, or whether they will exercise their discretion to opt out.

Owing to the existing IAB self-regulatory framework, compliance by third parties should be relatively straightforward. Signatories to the framework can pay a license fee to the European Interactive Digital Alliance (EDAA). This license fee allows third parties to use a single icon in or around display advertisement in order to provide notice to web users, and to link to a website called whereby web users can opt out of a range of third parties' collection and use of data for OBA purposes.

Websites and third parties should note that compliance with the new CAP rules and IAB/EASA's recommendations does not ensure compliance with UK and EU data protection law. Websites and third parties need to be aware of the additional requirements of the E-Privacy Directive in respect of cookies and similar technologies and seek legal advice where necessary to ensure compliance.