Online interest-based advertising, sometimes called behavioral advertising, is big business. Advertisers—and the technology companies that make this business possible—use information collected from a particular computer or device, over time and across others’ websites, to predict preferences and target and display advertising that is most likely to interest the user.

With encouragement from the Federal Trade Commission,¹ online advertising industry organizations adopted a set of “Self-Regulatory Principles for Online Behavioral Advertising (OBA Principles),”² which apply to members of those organizations: the ad networks, advertising agencies, service providers, and web publishers that engage in or facilitate the collection of online user data across websites for purposes of interest-based advertising. The Better Business Bureau (BBB) enforces the OBA Principles through its Online Interest-Based Advertising Accountability Program (Accountability Program). Recent action by the BBB reflects its commitment to vigorously enforce the OBA Principles.

The cross-industry self-regulatory program is based on seven OBA Principles developed by the Digital Advertising Alliance, the Networking Advertising Initiative, the Direct Marketing Association, the Interactive Advertising Bureau, the Better Business Bureau, the American Association of Advertising Agencies, and the Association of National Agencies, and first released in July 2009. The hallmarks of the principles are transparency and consumer choice, to provide consumers with notice about what information is being collected about them for purposes of serving interest-based ads, and to allow consumers more control over whether advertisers can collect and use this information for these same purposes.

On October 14, 2013, the Accountability Program issued its first ever compliance warning³—its first formal industry advisory on compliance with the OBA Principles. In it, the BBB made clear that a “first-party,” that is a web content publisher, is responsible for providing “enhanced notice” of “third-party” data collection on their sites for OBA, through “clear, meaningful, and prominent” links (i.e., transparency) on all web pages where third parties collect user data in order to serve targeted advertising. These “enhanced notice” links provide information about the collection of consumer data by third parties, and allow consumers to opt out (i.e., consumer control). The October 14, 2013, compliance warning focused on resolving confusion among first parties (i.e., website publishers or operators) about their responsibilities for providing “enhanced notice” when they allow third parties to collect data for interest-based advertising. The compliance warning reported that, although most web publishers complied with most of the OBA Principles, a large minority of web publishers were not providing the required “enhanced notice” links.

This compliance warning was followed in November 20, 2013, by three cases concerning websites that were not in compliance with any of the first-party transparency and control requirements.⁴ In these three cases, the Accountability Program set out the compliance issues it had found on each website and provided compliance recommendations that each website publisher implemented to bring its website into full compliance. Taken together, the October 14, 2013, compliance warning and the three November 2013 cases provided detailed explanations of first parties’ obligations under the Accountability Program’s principles.

In January 2014 and starting with high traffic publishers, the Accountability Program began a comprehensive review of websites to ensure first-party compliance. (A second compliance warning⁵ was issued in August 2014 clarifying that the principles are applicable irrespective of the technology used to collect data and serve advertisements.) It was determined that while many websites were compliant with the principles, some popular sites were still not entirely complaint. True to its promise of “vigorous enforcement,” the Accountability Program brought enforcement actions against five first-parties found to be non-compliant with the “enhanced notice” requirements: Best Buy, Answers Corp. (Answers.com), Buzzfeed, Go.com, and Yelp. Decisions in all five cases were issued October 28, 2014.⁶ These actions were the first time the Accountability Program has moved to enforce a compliance warning.

In response to the Accountability Program’s recent actions, all five companies have agreed to revise their websites in order to comply with the “enhanced notice” transparency and consumer control requirements. In these decisions, the Accountability Program referred to “enhanced notice” as the “most innovative of the Transparency Principle’s requirements. Beyond merely alerting users that some third-party data collection is occurring, the enhanced notice link puts consumers one click from communication about OBA precisely when they may be curious about why they received the ad they are looking at or what information is being collected on the web page they are visiting.” The BBB made clear that it is the obligation of first-parties to provide “enhanced notice” not just in a privacy policy, but on every page whether a third-party is collecting data for use in OBA. The BBB further clarified that this obligation is in addition to first-parties’ obligation to provide “enhanced notice” in or around interest-based ads. The decisions state that the Accountability Program seeks to “empower…users to learn and make informed decisions about their online privacy.”

Through its recent enforcement efforts, the Accountability Program is highlighting the “enhanced notice” principle, which enables both transparency and consumer choice. According to Genie Barton, vice-president and director of the Accountability Program, some web publishers are still unaware of the “enhanced notice” links requirement, despite industry efforts to publicize them.⁷ The Accountability Program has vowed to continue to enforce the OBA Principles, and it clearly expects the type of cooperation and voluntary compliance it received from the companies it recently challenged. In fact, the Accountability Program referred one company, Sun Trust Bank, to the U.S. Consumer Financial Protection Bureau for refusing to participate in its self-regulatory process.⁸

¹ FTC Report, Self-Regulatory Principles for Online Behavioral Advertising (February 2009), available at http://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-staff-report-self-regulatory-principles-online-behavioral-advertising/p085400behavadreport.pdf.

² Digital Advertising Alliance, Self-Regulatory Principles for Online Behavioral Advertising (2009), available at http://www.aboutads.info/resource/download/seven-principles-07-01-09.pdf. See also WSGR Alert, “New Principles for the Collection of Data Online Released,” November 17, 2011, available at https://www.wsgr.com/publications/PDFSearch/wsgralert-online-advertising-data-collection.pdf.

³ Online Interest-Based Advertising Accountability Program, Compliance Warning, “Responsibilities of First Parties for Notice of Third-Party Data Collection for Online Behavioral Advertising on Their Websites,” October 14, 2013, available at http://www.bbb.org/us/Storage/113/Documents/First-Party-Compliance-Warning-20131008.pdf.

⁴ See In re BMW of North America, LLC, No. 27-2013 (November 18, 2013), available at http://www.asrcreviews.org/wp-content/uploads/2013/11/Online-Interest-Based-Advertising-Accountability-Program-Formal-Review-27.2013.pdf; In re Scottrade, Inc., No. 28-2013 (November 18, 2013), available at http://www.asrcreviews.org/wp-content/uploads/2013/11/Online-Interest-Based-Advertising-Accountability-Program-Formal-Review-28.2013.pdf; In re Volkswagen of America, Inc., No. 29-2103 (November 18, 2013), available at http://www.asrcreviews.org/wp-content/uploads/2013/11/Online-Interest-Based-Advertising-Accountability-Program-Formal-Review-29.2013.pdf. Because Volkswagen had already taken steps to come into compliance before the Accountability Program’s inquiry letter, the case was closed via an administrative disposition.

⁵ Online Interest-Based Advertising Accountability Program, Compliance Warning, “The Digital Advertising Alliance’s Cross-Industry Self-Regulatory Principles are Enforceable Irrespective of the Identification Technology Used,” August 21, 2014, available at http://www.asrcreviews.org/wp-content/uploads/2014/08/Alternative-Identifiers-Compliance-Warning.pdf.

⁶ Accountability Program Decisions can be found at http://www.asrcreviews.org/accountability-program-decisions/.

⁷ Wendy Davis, “BBB’s Online Privacy Watchdog Faults 5 Web Publishers,” Online Media Daily, October 29, 2014, 5:08 PM, http://www.mediapost.com/publications/article/237232/bbbs-online-privacy-watchdog-faults-5-web-publish.html.

⁸ See Online Interest-Based Advertising Accountability Program, Press Release, “SunTrust Bank Referred to the CFPB for Refusal to Participate in Self-Regulation,” May 8, 2014, available at http://www.asrcreviews.org/2014/05/suntrust-bank-referred-to-the-cfpb-for-refusal-to-participate-in-self-regulation/.