AD CHOICES: THE POLICY DEBATE ON

ADVERTISING DATA COLLECTION

Wally Hill

Senior Vice President, Government & Consumer Affairs CMA - Canadian Marketing Association

Toronto ON

Peter B. Kosmala, CIPP/US

Senior Vice President, Government Relations

4As – American Association of Advertising Agencies

Washington DC

1. The Current OBA Landscape

– Market space: Canada, United States & Europe

– Definition and consumer perceptions

– Canadian privacy law context

2. OBA Self Regulation Today

– Global programs currently in operation

– Regulator perspectives

3. Closing Remarks / Q&A

AGENDA

The Current OBA Landscape

THE ONLINE AD ECOSYSTEM

Source: LUMA Partners LLC, 2014

DEFINING “OBA”

Online Behavioural Advertising (“OBA”) means the collection of data from

a particular computer or device regarding Web viewing behaviours over time and across

non-Affiliate Websites for the purpose of using such data to predict user preferences or

interests to deliver advertising to that computer or device based on the preferences or

interests inferred from such Web viewing behaviours. Online Behavioural Advertising

does not include the activities of First Parties, Ad Delivery or Ad Reporting, or contextual

advertising (i.e. advertising based on the content of the Web page being visited, a

consumer’s current visit to a Web page, or a search query).

Source: DAA Self-Regulatory Principles for Online Behavioural Advertising (July 2009)

PUTTING OBA IN PERSPECTIVE GLOBAL CONSUMER PRIVACY CONCERNS

Source: McCann Truth Central, August 2011

PUTTING OBA IN PERSPECTIVE GLOBAL CONSUMER PRIVACY CONCERNS

Source: McCann Truth Central, August 2011

PUTTING OBA IN PERSPECTIVE WHAT CANADIAN CONSUMERS THINK

Source: Phoenix SPI for OPC, December 2012

PUTTING OBA IN PERSPECTIVE WHAT CANADIAN CONSUMERS THINK

Source: Ryerson University Privacy and Cyber Crime Institute, for OPC, 2011

• I feel it is an invasion of privacy for someone to keep track of my online activities -- 68% • Targeted online advertising is creepy when it is based on my online actions -- 57% • Online advertising is necessary for the internet -- 57% • Putting up with online advertising gives me access to sites without having to pay -- 53%

PUTTING OBA IN PERSPECTIVE WHAT CANADIAN CONSUMERS THINK

Source: Source: BrandSpark International, Canadian Shopper Trends Study, Nov-Dec. 2013, n=16,585

55%

54%

33%

31%

30%

22%

16%

I appreciate getting discounts that are tailored to my interests based on thewebsites I visit

I prefer to see fewer ads that are relevant to me when online, than a highernumber of ads of lesser relevance

I am comfortable with retailers tracking my shopping habits through my useof their customer loyalty cards

I appreciate personalized recommendations made by online shopping sitesbased on my past purchases

I know what online behavioural advertising is and I am confident enough todescribe it to others

I am comfortable with an internet business collecting and using my personaldata, if they are transparent about the activity

I am comfortable with an internet business sharing my personal data withother firms, if they are transparent about the activity

Canadian Shopper Attitudes Towards Targeted Online Advertsiing % completely agree/agree

PUTTING OBA IN PERSPECTIVE WHAT CANADIAN CONSUMERS THINK

Source: BrandSpark International, Canadian Shopper Trends Study, Nov-Dec. 2013 Notes: Total (n=16,585); 18-24 (n=627); 25-45 (n=2550); 35-49 (n=5606); 50-64 (n=5914); 65+ (n=1837)

52%

66%

40%

48% 47%

56%

49%

59% 58%

67%

61%

70%

I am comfortable with an internet business collecting and using mypersonal data, if they are transparent about the activity

I am comfortable with an internet business sharing my personal datawith other firms, if the are transparent about the activity

By Age

Comfort with Business Collecting Personal Data % NOT comfortable

Total 18-24 25-34 35-49 50-64 65+

PUTTING OBA IN PERSPECTIVE WHAT CANADIAN CONSUMERS THINK

Source: Phoenix SPI for OPC, December 2012

CANADA’S PRIVACY LANDSCAPE

• Shared responsibility between federal and provincial governments

(focus on PIPEDA)

• PIPEDA enforced by Office of the Privacy Commissioner of Canada

• Applies generally to collection, use, disclosure of personal

information (PI) in the course of commercial activity

• Personal information defined broadly (broader than PII)

• Consent generally required for collection, use, disclosure of PI

• No specific laws for OBA; guidelines issued by OPC

DATA USED FOR TARGETING

• Threshold issue, as PIPEDA only applies to PI

• PI defined very broadly as “any information about an

identifiable individual”

• Definitely includes names, email addresses, etc.

• Also includes non-PII

• Includes IP addresses and cookie data in many instances

even when individual is not identified

• Best to assume that tracking data are PI

OPC POLICY POSITION: OBA

In December 2011

Commissioner

Jennifer Stoddart

issued Guidelines on

Privacy & OBA

www.priv.gc.ca

OPC POLICY POSITION: OBA

• OBA relies on PI even where no PII

• Recognition that OBA is important to generating revenue

• Apparent rejection of the EU model:

“Constant notifications… and blocked access to ad-supported

sites will frustrate users… create fatigue or a backlash”

OPC POLICY POSITION: CONSENT

• Consent cannot be generally required as a condition of using

the Internet

• Form of implied/opt-out consent is acceptable if:

– Clear and understandable information provided through banners,

layered notices and interactive tools

– Cannot be “buried” in a privacy policy

– Can opt-out at or before collection

– Opt out is immediate and persistent

– Limited to non-sensitive information

– Information destroyed or effectively de-identified as soon as possible

OBA Self-regulation Today

A Global Review

US SELF-REGULATION 2009 – DAA FORMS

www.aboutads.info

US SELF-REGULATION 2009 – DAA PUBLISHES OBA PRINCIPLES

• Education

• Transparency

• Consumer Control

• Data Security

• Material Change to

Existing OBA Policy and

Practices

• Sensitive Data

• Accountability

US SELF-REGULATION 2010 – DAA LAUNCHES “AD CHOICES”

US GOVERNMENT RESPONSE

Jon Liebowitz Chairman

US Federal Trade Commission

February 23, 2012

“Today, though it is still a work

in progress, the ad industry

has obtained buy-in from

companies that deliver 90% of

online behavioral

advertisements… They have

established a mechanism with

teeth… It’s important to note

how far they’ve come in a

short time. We are all pulling

in the same direction.”

• Trillions of DAA Icon impressions per month served across the Web

• 120 companies listed on the consumer choice page incl. Top 15 ad networks

• 20+ million cumulative unique visitors:

– 13.5 million to YourAdChoices.com

– 5.2 million to AboutAds.info

• Over one million consumer opt-outs

• Over 25 enforcement cases brought by accountability providers (ASRC, DMA)

US SELF-REGULATION THE DAA PROGRAM TODAY

US GOVERNMENT RESPONSE

“ However it is developed,

consumers should have the

ability to opt-out. The way it

is developed isn’t important –

whether that’s industry, W3C

or other. Just that it is.”

I don’t want to diminish the

serious benefits that some of

these data yield… Privacy is

compatible with

innovation.”

Edith Ramirez

Chairman, Federal Trade Commission

Keynote at IAPP Global Privacy Summit

March 6, 2014

EU SELF-REGULATION

EASA Best Practice Framework

• Requires uniform European-wide icon, which

clicks through to a simple mechanism that,

“provides consumers with transparency and

control, allowing them to exercise their online

choices.”

• Icon links through to European-wide Website

for further information on OBA (in-language)

and mechanism to exercise choice on future

OBA ads

• Consumers may file a complaint about OBA

practices through an advertising self-

regulatory organisation in their home country.

EU SELF-REGULATION

IAB-Europe Framework

• Education for consumers and businesses; consumer control over OBA

• Transparency about data collection and use practices; clear, meaningful and prominent notice through multiple mechanisms

• Appropriate data security for, and limited retention of, data collected and used for OBA purposes

• Limitations on targeting of children

• Limitations on the collection of Sensitive Personal Data collected and used for OBA

• Compliance and enforcement mechanisms to ensure the effectiveness of the framework

THE EUROPEAN DAA

THE EUROPEAN DAA

• 200 signatories

• 80 companies integrated on the Consumer Choice Platform

at youronlinechoices.eu (YOC)

• YOC translated in 24 languages across 29 countries

• Licensing contracts (Icon & YOC) being currently signed

with companies

• Evidon & TRUSTe signed as EU Approved Providers

SELF-REGULATION IN CANADA

SELF-REGULATORY PRINCIPLES - CANADA

• Educate – businesses and consumers

• Transparency – notices by third parties & site publishers • Consumer Control – easy access to opt-out mechanism • Data Security – proper safeguards and retention practices • Sensitive Data – do not collect Children’s or sensitive data • Accountability – Compliance & Complaint handling by ASC

AD CHOICES ROLL-OUT IN CANADA

DAAC formed in April 2013 via icon license from DAA

Phase I – initial program launch – July 2013

- Webinars to explain program to users

- Signing users onto program

Phase II – public launch – September 17, 2013

- Announcement that program and icon use underway

- www.youradchoices.ca goes live

- Continue signing on participants

- Build consumer awareness & opt-out begins

Phase III – program management – January 2014

- Compliance monitoring

- Complaint resolution handling

- Compliance reporting

CANADIAN GOVERNMENT RESPONSE

“Our Office is pleased that the

advertising industry is taking action on

this issue… The use of online

behavioural advertising has grown

dramatically and we are concerned that

Canadians’ privacy rights are not

always being respected.”

- Valerie Lawton, OPC Spokesperson

AD CHOICES IN CANADA

AD CHOICES IN CANADA

AD CHOICES IN CANADA

• Forty-five companies have joined the program • About a third are subscribed to opt-out tool • 200 million ad impressions in awareness campaign • 140,000 visits to www.youradchoices.ca • 15% visit the opt-out page • 5% opt-out of all or some tracking

AD CHOICES COMPLIANCE

Advertising Standards Canada (ASC) manages the accountability component for DAAC’s Self-Regulatory Principles: •ASC’s accountability program includes:

- Monitoring participant compliance - Accepting and managing complaints re OBA

• When concerns are identified, ASC: - Works with Canadian companies to help them become compliant

• ASC’s reporting: - ASC publicly reports findings of non-compliance, the reason for those findings and any actions taken with respect to instances of non-compliance and will only identify those companies that do not bring themselves into compliance.

SUMMARY & RECOMMENDATIONS

• Canadian & EU have leveraged US model – Global Program

• Key elements are Transparency, Choice and Accountability

• OPC:

- Clear that PIPEDA applies

- Generally signals a pragmatic approach

• For time being notice is key:

– Ensure that notice is comprehensive and geared towards audience

– OPC likes “layered notices”

– Explain how to “opt-out”

– Build consumer awareness and understanding

• Use self-regulatory models where available

PRESENTERS

WALLY HILL

Senior Vice President, Government & Consumer Affairs

CMA – Canadian Marketing Association

Toronto ON

+1.416.644.3757

whill@the-cma.org

PETER KOSMALA, CIPP/US

Senior Vice President, Government Relations

4A’s – American Association of Advertising Agencies

Washington DC

+1.202.466-4395

pkosmala@aaaa.org

RESOURCES

• DAA-Canada: www.youronlinechoices.ca

• OPC Policy Position on Online Behavioural Advertising:

http://www.priv.gc.ca/information/guide/2012/bg_ba_1206_e.asp

• OPC Survey of Canadians on Privacy-Related Issues:

http://www.priv.gc.ca/information/por-rop/2013/por_2013_01_e.asp

• Digital Advertising Alliance (US): www.aboutads.info

• European Interactive Digital Advertising Alliance:

www.edaa.eu