As described by the FTC, Turn used a variety of methods to track consumers online and in mobile apps including cookies, web beacons, Apple’s IDFA, Google’s Ad ID, and unique identifier tracking headers generated by Verizon Wireless and added to its users’ mobile traffic (X-UIDH headers). (In March 2016, Verizon agreed to pay $1.35 million to settle FCC charges over these unique identifiers.)
More specifically, the FTC alleged that Turn used the X-UIDH header to sync with IDFA, Ad ID and other identifiers and to revive cookies even after users deleted their cookies. (The FTC also pointed out that Apple and Google contractually prohibit developers from syncing or correlating IDFA or the Advertising ID with other identifiers, which is intended to make sure that users can effectively express their choice not to be tracked by changing their identifier through each platform’s OS settings.)
The proposed Consent Order (1) bars Turn from misrepresenting the extent of its online tracking or users’ ability to limit or control the company’s use of their data, (2) requires Turn to provide an effective opt-out for consumers who do not want their information used for targeted advertising, and (3) requires Turn to place a prominent hyperlink on its home page that takes consumers to a disclosure explaining what information the company collects and uses for targeted advertising.
The key message from the settlement is that the basic requirement to provide consumers with clear and accurate notice of privacy practices and the ability to make choices about how their data is used to target advertising will continue to be a critical area of regulatory attention.