In its latest decisions, the Online Interest-Based Advertising (IBA) Accountability Program tackled the issues of privacy disclosures and consumer opt-out tools following inquiries into two advertising technology companies.
As part of its routine monitoring activities, the Accountability Program evaluated Kiip, Inc., a company that collected data through the health and fitness app Sweatcoin, and VRTCAL Markets, Inc., an ad mediation platform in the ad-serving chain for apps including Grindr, for first- and third-party compliance with the Digital Advertising Alliance’s (DAA) Self-Regulatory Principles.
After downloading and installing Sweatcoin, the Accountability Program expressed concern with Kiip’s descriptions of three of the choice mechanisms it provided to users. For example, the Accountability Program found that the single opt-out tool that consumers could use to halt Kiip’s IBA practices was “highly difficult to use,” and that it was also unclear whether the other two opt-out mechanisms applied to Kiip’s IBA or only to other entities’.
Further, Kiip’s cross-device IBA and privacy disclosures fell short, the self-regulatory body said.
To achieve compliance with the DAA Principles, Kiip updated its privacy policies to make clear that it may collect and use data across a consumer’s devices and provided an explanation of how consumers can opt out of each type of device for IBA purposes. The company also revised its disclosures and clarified its description of consumers’ opt-out choices, with clear instructions and an easy-to-use opt-out tool.
As for VRTCAL, the Accountability Program discovered that the company failed to post sufficient disclosures about its IBA practices, failed to provide enhanced notice for consumers on how to withdraw consent for the collection of precise location data and failed to adequately describe its opt-out procedures.
To meet the requirements for transparency and control under the DAA Principles, the company improved its opt-out instructions, making the mechanism easy to use, and updated its contracts to ensure that its digital partners obtained consumer consent before collecting precise location data. In addition, the company described how consumers could withdraw consent for the collection of precise location data.
Why it matters: With the two new decisions, the Accountability Program has carried out a total of 95 public actions. The self-regulatory body emphasized the importance of providing consumers with a clearly described and easy-to-use opt-out mechanism. “It is essential to provide a dedicated means to opt out of cross-app IBA—cookies will not cut it—and to make sure that your implementation is clearly explained and easy for consumers to use,” the Accountability Program wrote in the VRTCAL decision. “If your opt out only makes sense to your developers, you should rethink your approach.”