New CAP rules for online behavioural advertising

New CAP rules on online behavioural advertising (OBA) came into force on 4 February 2013. The new rules affect advertising networks and other third parties who use web browsing activity to deliver customised advertising to web users, based on pages visited, ads clicked and products they have shown an in interest in.

The new rules also cover re-targeting; this is where a product viewed on a retail website, for example, is subsequently advertised on other websites a user visits.

What the new CAP rules say
Ad networks and other third parties must ensure that consumers can exercise choice over the collection and use of information about their browsing activity for the use of OBA. They must:

1. Provide a clear and comprehensive notice about the collection and use of web viewing behaviour data for the purposes of OBA on their own website. The notice must be easy to find and highly visible. It isn’t acceptable for the ad network to place such a notice in the small print of its website or several clicks away from the homepage. The notice should also link to a mechanism that allows web users to opt out of having their online activity tracked for OBA purposes.

2. Give a clear and comprehensive notice that they are collecting and using web viewing behaviour data for the purposes of OBA either in or around each online advertisement delivered using OBA. The notice should link to a relevant mechanism that allows web users to opt out of having their online activity tracked for OBA purposes by this and other ad networks.

In this context ‘notice’ means the placement of an icon, symbol text or similar in or around online paid for advertisements delivered using OBA. The icon, symbol, text or similar must be of a size and colour that can easily seen by a normally sighted web user. It should not be obscured by background text on either the ad network’s website or the online advertisement. See below (New Cap rules: background) for more information on the your online choices icon. www.youronlinechoices.com/uk/

3. Not create interest segments specifically designed for the purpose of targeting OBA to children aged 12 or under. (Interest segments are often created using data from a range of websites.)

4. Ad networks must obtain explicit consent from the web user before utilising technology to collect and use information about websites visited on a particular computer in order to deliver OBA to that computer. This would normally mean that the OBA is carried out at internet service provider (ISP) level. Consent is required because of the wide-ranging nature of data collection.

Exemptions to the new CAP rules

• Contextual advertising
• Web analytics
• Ad reporting or Ad delivery
• The collection and use of information for OBA by website operators on their own websites
• The use of OBA in rich media, in-stream videos online
• Mobile devices and tablets are exempt for now but will be covered by the rules in the future.

Enforcement of new CAP rules
The rules on OBA apply to ad networks rather than advertisers. The Advertising Standards Authority is responsible for monitoring compliance and handling complaints about potential breaches. In the rare event that the ASA is unable to identify the ad network involved, it will contact the advertiser.

The advertiser has an obligation under the CAP code to co-operate with the ASA in good faith. For example, the advertiser may need to obtain details about which ad network carried the campaign or served the online advertisement.

In the case of a complaint under rule no 3 (above) the ASA would expect ad networks to explain how a segment was created and detail why it did not specifically target children aged 12 and below.

In the case of a complaint under rule no 4 (above) the ASA would expect ad networks to explain how they did not breach the rule by collecting data from all or substantially all websites visited by a web-user.

The ASA will try to resolve breaches of the Code quickly and proportionately informally, before moving on to a formal adjudication. If an ad network continues to breach the rules then the ASA and the CAP compliance teams may name and shame the non-compliant network.

New CAP rules: Background
The rules implement a pan-European, self-regulatory standard – the European Advertising Standards Alliance (EASA) Best Practice Recommendation – into the UK self-regulatory framework. Many ad networks have agreed to sign up to this Best Practice Recommendation and agree to its principles.

Once they have signed up, ad networks pay a licence fee to a pan-EU body, the European Interactive Digital Advertising Alliance (EDAA) to use a single icon in or around online display advertisements. The icon enables the ad network to provide notice to web users and a link to youronlinechoices.eu, which enables users to opt out of a range of ad networks’ collection and use of data for OBA purposes. The online activities of ad networks who have signed up to the scheme are monitored by an independent certified provider to ensure that they adhere to the Best Practice Recommendations. The ad network also receives a trading seal if it is complying.

The DMA was fully involved in the development of these rules as it participated in the working group on this issue. The DMA will monitor future developments and keep members informed.

James Milligan, DMA solicitor, 020 7291 3360.