Internet Advertising Group Seeks Comments On Revised Data Collection Code of Conduct

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

Companies delivering targeted advertising in the online space would be required to provide notice regarding their data collection and use practices “in and around the targeted ads they serve” under the Network Advertising Initiative's draft revised code of conduct, the NAI said in a March 1 statement announcing the draft's release.

The NAI, which is based in Washington, is a self-regulatory organization comprised of almost 100 companies in the online industry, including Google Inc., Microsoft Corp., and Yahoo! Inc. Members pledge to comply with the NAI's code of conduct, which sets forth requirements for the collection and use of data for targeted advertising. The organization last updated the code in 2008 (7 PVLR 1787, 12/22/08).

The organization is accepting public comments on the draft revised code through April 5.

Rebranding Targeted Advertising

In addition to the new “enhanced notice” requirement, the revised code would replace the term “Online Behavioral Advertising” with “Interest-Based Advertising,” add sexual orientation as a category of sensitive data, require companies to disclose the technologies they use for interest-based advertising, and forbid companies from using data for certain eligibility decisions.

The revisions reflect changing third-party business models and important changes in the regulatory and self-regulatory online advertising landscape, the NAI said.

Specifically, the revisions attempt to harmonize the NAI code with the Federal Trade Commission's staff report on online behavioral advertising self-regulatory principles (8 PVLR 267, 2/16/09) and the Digital Advertising Alliance's self-regulatory principles governing online behavioral advertising and the collection of data across multiple websites, the NAI said.

The revised code's flexible, scalable, and contextual approach to notice and choice obligations is also consistent with the approaches of the White House in its 2012 consumer privacy white paper (11 PVLR 355, 2/27/12) and the FTC in its 2012 consumer privacy report (11 PVLR 590, 4/2/12), the NAI remarked.

Enhanced Notice, Revised Definitions

The revised code would require members to provide “enhanced notice” for the first time, according to the NAI's commentary on the draft. Under this requirement, members would have “to provide, or support the provision of, notice of Interest-Based Advertising data collection and use practices and the choices available to users in or around advertisements that are informed by Interest-Based Advertising.”

Members largely already comply with this requirement, the NAI said.

The revised code also modifies the definition of “Personally Identifiable Information” (PII) to exclude data used or intended to be used to determine the precise location of an individual, the NAI explained. The group said it “believes that this language was needlessly confusing and irrelevant, because the definition of 'Sensitive Data' requiring Opt-In Consent includes data used to determine the precise location of an individual or device.”

The revised “Sensitive Data” definition also includes a new category, sexual orientation. “Under this revision, companies would be prohibited from collecting or storing information about a user's sexual behavior or orientation for Interest-Based Advertising or Ad Delivery and Reporting without obtaining Opt-In Consent,” the NAI said.

Prohibited Uses of Data Clarified

Under a new requirement in the revised code, members would be required to disclose the technologies they use for interest-based advertising and ad delivery and reporting. “This provision is intended to bring an additional level of transparency to all technologies members use for those purposes … ,” the NAI explained.

In addition, the revised code clarifies that members cannot use or permit the use of data collected through online behavioral advertising for certain eligibility decisions, such as eligibility for employment, health care, and insurance, according to the NAI.

The revised code also clarifies what it means to “honor” a user's opt-out choice. For example, the code would allow members to continue to collect data for “internal operations” practices even after a user has opted out, the NAI said.

Meanwhile, the NAI announced Feb. 7 that it plans to develop guidelines on the collection and use of data on mobile devices (12 PVLR 232, 2/11/13).

The NAI's “March 2013 Draft Code of Conduct for Public Comment” is available at

Request Bloomberg Law: Privacy & Data Security