By Katie W. Johnson
The Network Advertising Initiative May 16 released a final, revised code of conduct that requires member companies that deliver online interest-based advertising to provide enhanced notice concerning their data collection and use practices, or notices “in or around advertisements.”
The NAI, which is based in Washington, is a self-regulatory organization comprised of almost 100 companies in the online industry, including Google Inc., Microsoft Corp., and Yahoo! Inc. Members pledge to comply with the NAI's code of conduct, which sets forth notice, choice, transparency, and security requirements for the collection and use of data for targeted online advertising. The organization last updated the code in 2008 (7 PVLR 1787, 12/22/08).
The organization announced March 1 that it was accepting comments on a draft revised code of conduct (12 PVLR 428, 3/11/13). The comment period closed April 5.
There are “no significant substantive changes” between the March draft and the final code, NAI Executive Director and General Counsel Marc Groman told BNA May 16. The changes in the final version generally clarify language or explain a limiting principle, he said.
Groman also highlighted a new document outlining the NAI's compliance and enforcement procedures. The NAI took its “disparate policies and procedures” and consolidated them into “one uniform document,” he explained.
The NAI said in a May 16 statement that it will start “formally enforcing” the latest version of the code in 2014.
The final code of conduct incorporates the major revisions included in the draft revised code released in March, such as the new “enhanced notice” requirement.
The final code also replaces the term “Online Behavioral Advertising” with “Interest-Based Advertising,” adds sexual orientation as a category of sensitive data, and forbids companies from using data for certain eligibility decisions.
Groman called a new transparency requirement around health information the “real strength of the NAI code.” The final code requires member companies to disclose standard interest segments that are based on health-related information or interests.
The new code also modifies the definition of “Personally Identifiable Information” (PII) to exclude data used or intended to be used to determine the precise location of an individual, and it removes geolocation information from the “Sensitive Data” definition. The new code of conduct now includes “Precise Geolocation Data” as its own definition but still requires opt-in consent for the use of such data for interest-based advertising.
Groman pointed to the final code's commentary on the addition of sexual orientation to the definition of “Sensitive Data” as an example of a difference between the March draft and the final code. If the March draft had been read literally, a member company would not have been able to conduct interest-based advertising on a wedding website, Groman said.
In the final code, the NAI clarifies in the commentary how sexual orientation applies in the context of interest-based advertising. According to the new commentary, “[t]he NAI does not intend to prohibit retargeting based on visits to dating websites, wedding registries, services for couples (such as travel), or similar content.”
The use of sensitive data for ad delivery and reporting no longer requires a user's opt-in consent, according to the final code. Only the use of such data for interest-based advertising requires opt-in consent.
In addition, instead of having to post “[a] statement of the fact that data collection for Interest-Based Advertising is occurring,” under the final code member companies must post “[a] statement of the fact that data may be collected for Interest-Based Advertising.”
The 2013 code reflects policy developments since 2008 such as the Federal Trade Commission's staff report on online behavioral advertising self-regulatory principles (8 PVLR 267, 2/16/09), the FTC's 2012 consumer privacy report (11 PVLR 590, 4/2/12), the White House's 2012 consumer privacy white paper (11 PVLR 355, 2/27/12), and other self-regulatory initiatives, the NAI said.
The “2013 NAI Code of Conduct” is available at http://www.networkadvertising.org/2013_Principles.pdf.
The “NAI Compliance and Enforcement Procedures” document is available at http://www.networkadvertising.org/pdfs/NAI_Compliance_and_Enforcement%20Procedures.pdf.
To view additional stories from Privacy & Data Security Law Resource Center™ register for a free trial now