The Online Internet-Based Advertising Accountability Program ("OIBAAP") released a new set of decisions applying the Digital Advertising Alliance ("DAA") Self-Regulatory Principles on mobile app developer, which illustrated once again (see our report about the previous decisions) the strength of the DAA Principles as not being just limited to “members” or “participants,” but rather covers all companies engaged in interest-based advertising that target users in the United States. The recent decisions involved the popular app publishers Spinrilla, Top Free Games, and Bearbit Studios.
The OIBAAP identified Spinrilla, a mobile app that streams hip-hop music, as a company that did not have the enhanced notice links that are required when third parties collect cross-app and precise location data for use in interest-based advertising. In the decision, the OIBAAP examined Spinrilla’s mobile application data collection practices for cross-app and precise location data, as well as the data collection practices for an affiliated website. The decision also explored Spinrilla’s responsibility to provide enhanced notice and achieve consent as both a first-party mobile app publisher and a first- party website operator. The principles underlined by the OIBAAP in this decision can be summarized as follows:
- Enhanced notice is required for cross-app data collection by third parties for the purpose of interest-based advertising;
- Notice and prior consent are required for collection of location data by third party; and
- Websites affiliated with mobile apps must also comply with Online Behavioral Advertising Principles.
The OIBAAP decisions regarding Bearbit Studios and Top Free Games defined the heightened obligations of apps that appeal, among others, to an audience of children of less than 13 in age. The OIBAAP found a number of indications that Bearbit Studios' app and Top Free Games' app would likely appeal to children under the age of 13, including the apps’ cartoon characters and settings, the simplicity of initial levels of play, and comments in user reviews. According to the decision, third parties were collecting persistent identifiers used for advertising on these apps, in breach of the Children’s Online Privacy Protection Act and the DAA's Sensitive Data Principle which forbid the collection and use of personal information of children for interest-based advertising without obtaining parental consent.
These decisions demonstrate once again the importance of complying with the industry's privacy and disclosure codes with respect to delivering online behavioral advertising, and in particular, in the mobile sphere. We encourage our clients and friends to consider the implementation of these requirements and to contact us with any questions concerning this issue.