In a pair of new decisions, the Online Interest-Based Advertising Accountability Program addressed targeted advertising with Publishers Clearing House (PCH) and Fontem, the company behind e-cigarette brand Blu.
Following up on consumer complaints that the PCH website allowed third parties to collect users’ data for use in interest-based advertising (IBA) without providing enhanced notice, the Accountability Program investigated the site and observed that at least 50 third-party companies known to engage in IBA engaged in data collection.
This finding led to a full review of both PCH’s website and its mobile app offerings, which revealed additional deficiencies. On the website, the Accountability Program found no enhanced notice link or statement of adherence to the Digital Advertising Alliance’s Self-Regulatory Principles (DAA Principles).
The website did have a page that listed eight companies engaging in IBA and offered consumers the ability to opt out, but the list represented only a small fraction of the companies engaging in IBA on the PCH website, the Accountability Program noted, stating, “The difference between the number of companies listed on the [opt-out] page and the much larger number of companies that appeared to be collecting data on the PCH website raised compliance concerns.”
As for the inquiry into PCH’s mobile app offerings, the Accountability Program found similar problems. Again, third parties known to engage in IBA were found collecting data, but the apps lacked enhanced notice to users. At least one company appeared to be gathering precise location data, but no notice of geolocation data collection was provided.
To achieve compliance with the DAA Principles, PCH worked with the Accountability Program to provide enhanced notice to ensure that its opt-out page included “a reasonably comprehensive” list of the third parties engaged in IBA on its website, and to add a statement of adherence to the DAA Principles.
PCH also resolved its issues with regard to mobile apps by updating its privacy disclosures, by adding an IBA disclosure with enhanced notice, and by taking steps to prevent third parties from accessing and using precise location data.
Turning to Fontem, the Accountability Program found that the company’s website failed to provide consumers with the required enhanced notice of data collection for IBA. It also expressed concern about a section of the company’s privacy policy that was unclear regarding whether future material changes to the policy would apply retroactively to data collected under earlier versions of the policy.
Fontem revised its disclosures by adding an enhanced notice link leading consumers directly to information about IBA and an opt-out tool. The company also clarified its privacy policy to confirm that material changes to its IBA practices will not apply retroactively to data previously collected.
Why it matters: The decisions remind brands with consumer-facing websites and apps to provide enhanced notice to their customers about data collection for IBA occurring on their digital properties. The Accountability Program also emphasized that compliance is not a “one-and-done” concern. “[C]ompliance with the DAA Principles is an ongoing effort that requires companies to regularly monitor their internal operations and agreements with third parties,” the self-regulatory body explained. “When a company chooses to utilize an approved service provider for a website’s opt-out mechanism, it must monitor this opt-out tool to make sure it remains up to date and free from technical errors.”