ISSUE-49: Third party as first party - is a third party that collects data on behalf of the first party treated the same way as the first party?


A Third-Party MAY operate as a First Party if the following conditions are met:

*         Data collected is separated for each First Party by technical means and organizational process, AND

*         The Third Party has no independent rights to the collected information outside of Permitted Uses (see Section X.Y), AND

*         A contractual relationship exists between the Third Party and the First Party that outlines and mandates these requirements.

A Third-Party acting on the behalf of a First Party is subject to all of the same restrictions of a First Party.


Third Parties that act purely as vendors for their customers (First Parties in this context) are not the intended target for the Tracking Preference Expression but it's important there are no unintended activities that are extended to a Third Party through this allowance.  In all cases, its expected a Third Party acting on the part of a First Party follows all of the same restrictions placed on a First Party.

For the data separation requirement, Third Parties have technical options to achieve appropriate separation but in each the critical element is that data is never reconstituted for users that have shared a Tracking Preference.  On possible approach would be to leverage a per partner hash against a common cookie identifier, ensuring the resulting identifier is consistent for a specific First Party but is unable to be linked with another First Party's identifier.

Contractual requirements that enforce data rights and responsibilities for separation are a critical element of establishing a Third Party as acting on a First Party's behalf.  Contracts may occur directly through parties (for example, a Publisher in an Ad Network) or between intermediaries (for example, an Ad Network acting through an Ad Exchange).  In either case, data separation and removal of independent rights are necessary elements that must survive intermediary contractual constructs.

Received on Wednesday, 25 April 2012 05:04:04 UTC