Re: Article: New online advertising guidance sets out restrictions for tracking

Jonathan, Jeff,

Industry has put out SR in Europe to increase transparency and choice in an easy to use manner. The legal situation isn't that simple (with respect to storing technologies), as many EU / EEA countries have not yet transposed the European Directive. General statements on compliance of the SR system cannot be made - the legal requirements vary across Europe.
Compliance with the law is likely to be achieved with a number of measures - industry's SR can be part of such solution.
I'm sorry I cannot give you a black or white response, but the situation is quite complex. As European law aims at storage, consent & browser and other technologies' settings, it is not very clear where and how DNT fits in here legally. We are keen ensuring interop with our SR solution and DNT - in the interest of the user.

Kind regards,
Kimon

----- Reply message -----
From: "Jeffrey Chester" <jeff@democraticmedia.org>
To: "Jonathan Mayer" <jmayer@stanford.edu>
Cc: "Mike Zaneis (IAB US)" <mike@iab.net>, "Shane Wiley (yahoo)" <wileys@yahoo-inc.com>, "<public-tracking@w3.org> (public-tracking@w3.org)" <public-tracking@w3.org>
Subject: Article: New online advertising guidance sets out restrictions for tracking
Date: Thu, Dec 8, 2011 12:09 am



My understanding is that privacy and other NGO groups in Canada and the EU do not believe that the self-regulatory programs satisfy many of the privacy requirements.  Indeed, a letter was just sent by the principal EU consumer group BEUC raising many concerns about the EU IAB plan.
Jeffrey Chester
Center for Digital Democracy
1621 Connecticut Ave, NW, Suite 550
Washington, DC 20009
www.democraticmedia.org<http://www.democraticmedia.org>

On Dec 7, 2011, at 4:43 PM, Jonathan Mayer wrote:

As I understand it, the various online advertising self-regulatory programs (NAI/DAA/IAB Europe) have taken the position that they satisfy the privacy choice requirements imposed by the EU ePrivacy Directive and Canada's PIPEDA.  Many lawmakers, civil society organizations, academics, and consumer advocates do not agree with that position.

Jonathan

On Dec 7, 2011, at 9:03 AM, Mike Zaneis wrote:

The new guidelines are fully compatible with the industry self regulatory program for OBA that we are helping them set up in Canada (a Canadian DAA essentially). The industry presented this program to the PC and has received conceptual buy in. The launch of the Canadian program, the European DAA program, and the success of the DAA in the US is creating a global third party OBA and data collection regime. We would reiterate our support for incorporation of the DAA principles as the basis for any global standards.

Mike Zaneis
SVP & General Counsel, IAB
(202) 253-1466

On Dec 7, 2011, at 11:04 AM, "Shane Wiley" <wileys@yahoo-inc.com<mailto:wileys@yahoo-inc.com>> wrote:

New online advertising guidance sets out restrictions for tracking

Privacy Commissioner of Canada Jennifer Stoddart calls on organizations involved in online behavioural advertising to provide better information about their practices; says the tracking of children and use of tracking technologies that can’t be turned off should be off-limits.
Press Release
Jennifer Jennifer Stoddart
Privacy Commissioner of Canada
December 6, 2011

URL: http://www.priv.gc.ca/media/nr-c/2011/nr-c_111206_e.cfm#contenttop<http://www.priv.gc.ca/media/nr-c/2011/nr-c_111206_e.cfm%23contenttop>


Advertisers who use targeted online ads need to be upfront with Canadians about what they’re doing and must make it easy for people to say No to being tracked, says Privacy Commissioner of Canada Jennifer Stoddart.

The Commissioner today launched new guidelines<http://www.priv.gc.ca/information/guide/2011/gl_ba_1112_e.cfm#contenttop> on online behavioural advertising which also set out restrictions on the tracking of children and tracking technologies that people can’t turn off.  Behavioural advertising involves tracking consumers’ online activities over time, in order to deliver advertisements that are targeted to their inferred interests.

“The use of online behavioural advertising has exploded and we’re concerned that Canadians’ privacy rights aren’t always being respected,” says Commissioner Stoddart, who launched the guidelines in a speech<http://www.priv.gc.ca/speech/2011/sp-d_20111206_e.cfm#contenttop> to the Marketing and the Law conference<http://www.acaweb.ca/en/events/marketing-and-the-law/> in Toronto.

“Many Canadians don’t know how they’re being tracked – and that’s no surprise because, in too many cases, they have to dig down to the bottom of a long and legalistic privacy policy to find out.”

The new guidance document says information about behavioural advertising should be clear, obvious and understandable.  Accepting participation in online behavioural advertising should not be considered a condition for people to use the Internet generally.  People must be able to easily opt out of this practice.

“Some people like receiving ads targeted to their specific interests.  Others are extremely uncomfortable with the notion of their online activities being tracked.  People’s choices must be respected,” says Commissioner Stoddart.

She also flagged some important restrictions when it comes to online behavioural advertising.

“If an individual can’t say no to the technology being used for tracking or targeting, then the industry shouldn’t use that technology for behavioural advertising purposes,” she told the advertising industry conference.  “So, in the current online behavioural advertising environment, that means no use of web bugs or web beacons, no super cookies, no pixel hacks, no device fingerprinting and no to any new covert tracking technique of which the user is unaware and has no reasonable way to decline.”

Another restricted area involves the online tracking of children.  The guidelines state that organizations should avoid knowingly tracking children and tracking on websites aimed at children.

“Children are not likely able to provide the meaningful consent required under our privacy law for the tracking of their online activities.  This is an increasingly important issue as we see the average age of first-time Internet users dropping,” says the Commissioner.

The guidelines also say advertisers should avoid collecting other sensitive information, such as individuals’ health information.

Commissioner Stoddart says her Office developed the guidance document to help organizations involved in online behavioural advertising ensure their practices are fair and transparent and in compliance with Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA.

“The approach we’re taking – as prescribed under Canadian law – is reasonable.  It allows industry to be innovative and to grow while respecting individuals’ right to privacy.”

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada. The Commissioner enforces two federal laws for the protection of personal information: the Privacy Act, which applies to the federal public sector; and the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to commercial activities in the Atlantic provinces, Ontario, Manitoba, Saskatchewan and the Territories. Quebec, Alberta and British Columbia each has its own law covering the private sector. Even in these provinces, PIPEDA continues to apply to the federally regulated private sector and to personal information in interprovincial and international transactions.
A copy of the guidelines are attached.

<Stoddart OBA guidelines.pdf>