The UK’s Interactive Advertising Bureau (IAB) recently issued and then retracted its Code of Practice for Online Behavioural Advertisements, which was intended to provide guidelines to Internet marketers on the use of cookies for tracking and analyzing the browsing habits of website visitors.

Online behavioural advertising (OBA) involves tracking users’ online activity through the use of cookies and other technologies. Tracking cookies are placed into the browsers of users visiting online commercial sites. These post-impression and post-view cookies allow a commercial entity to monitor users’ behaviour and keep track of items they have viewed. The cookies can identify the same users as they browse other sites. Once identified, advertisers use the collected data to individually target users with advertisements of items previously browsed but not purchased: this is known as "behavioural retargeting."

Behavioural retargeting is based on a marketing theory that maintains that an individual who has browsed items in a particular shop (or website), but has not made a purchase, has a higher probability of reacting to that shop’s advertisements and making a future purchase than an individual who views the same advertisements but has never visited the shop. Not surprisingly, the use of tracking technology to monitor and analyze user behaviour for OBA has raised some privacy concerns.

The Information Commissioner’s Office (ICO), the independent authority overseeing information rights and data privacy matters, has examined the privacy issues arising from the use of technology to monitor user behaviour and the subsequent storage and analysis of this information for OBA purposes. The ICO has stated that the use of behavioural ads is not in itself objectionable, provided that the processing of gathered data is done in accordance with the Data Protection Act 1998. However, the ICO has also stated that users should be provided with notice of tracking and the means to disable behavioural monitoring and subsequent targeted advertising.

The IAB Code of Practice for OBA

The Affiliate Marketing Council of the IAB, on mandate from consumer protection authority the Office of Fair Trading, recently published the Code. The Code’s primary aim was to introduce a clear protocol for calculating payments to online adverting companies providing OBA. In the past, online advertisers have relied on a user-click method for assessing payments due to them, but PI/PV cookies used in OBA are ‘impression-based’ rather than ‘click-based,’ meaning that cookies are stored on an impression served instead of a click. The Code set out a new compulsory system for calculating payment, using a ranking of rules on impression and click cookies. The Code also set out non-compulsory guidelines regarding the use of tracking cookies and maintaining user privacy. In particular, the Code recommended a 48-hour limit on the storage of tracking cookies used for behaviour retargeting. It also recommended that websites indicate to users where tracking technology is being used.

A week after publication, the IAB withdrew the Code following member feedback. The IAB has stated that a redrafted edition will be published in the upcoming months following further consultation with members of the advertising industry and regulatory bodies.

IAB Good Practice Principles for OBA

Without the Code in force, the IAB encourages members of the UK advertising community to apply the ‘IAB Good Practice Principles for Online Behavioural Advertising’ published in 2009. These principles recommend that websites notify users where monitoring technology is used. Principle 1.1 states, "Each Member shall provide clear and unambiguous notice to users that it collects data for the purposes of OBA. This notice shall include information about what types of data are collected, how these data are being used and how users can decline OBA with respect to that Member." The IAB has stated that it is currently in discussions with members regarding the creation of a "one-click opt-out."

Some of the largest online advertising businesses have publicly committed to the IAB Good Practice Principles including AOL Advertising, Google UK Ltd, MSN / Microsoft Advertising, Yahoo! SARL, Audience Science Inc, Crimson Tangerine Ltd and Specific Media UK.

Industry Standard OBA Notice

The Office of Fair Trading has gone one step further and has recommended that the IAB develop an industry standard icon to notify users where OBA is being employed, as has been done in the United States.

Recently, US advertising agencies, in conjunction with the Council of Better Business Bureaus, officially launched a self-regulatory program to give users control over their data in relation to OBA. They also introduced an industry standard "Advertising Option Icon" to be posted by participating advertisers, who will display the icon near advertisements and on websites where OBA information is collected and used. Consumers who click on the icon will be presented with information on how the collected data will be used, and will also be given the opportunity to opt out.

The IAB, however, has stated that it will await the development of an EU standard icon, and will not develop a unique UK specific icon.