The Rules in Appendix III which relate to Online Behavioural Advertising (OBA) aim to secure transparency and control for consumers in the use by any third party (see definition) of OBA. The rules require a third party to provide notice to web users in or around an online display advertisement if they are undertaking OBA. The notice should link to a relevant mechanism whereby a web user can opt out of the collection and use of web viewing behaviour data for OBA purposes by that third party or that third party and other parties. These rules are integral to a pan-European initiative – the European Advertising Standards Alliance (EASA) Best Practice Recommendation1 and an EU industry Framework2. Further information can be found on www.asai.ie.
Advertisers and third parties (see below) must take account of privacy and data protection laws applicable in Ireland. The relevant legislation in Ireland is
- European Communities (Electronic Communications Networks And Services) (Privacy And Electronic Communications) Regulations 2011
Guidance from the Office of the Data Protection Commissioner is available on the application of the legislation. Companies are encouraged to seek their own legal advice to ensure compliance with privacy and data protection legislation.
1.1 (a) Online Behavioural Advertising (OBA) – “OBA” means: the collection by a third party over a period of time of web viewing behaviour data from a particular computer or device which takes place across multiple web domains not under common control, and which is used by the third party to deliver advertising to that particular computer or device based on the preferences or interests inferred from the data by the third party’s technology. (These preferences or interests are often categorised into “interest segments” which are then used to target multiple web users with a specific preference or interest).
(b) Online Behavioural Advertising does not include the activities of Web Site Operators (First Party), Ad Delivery or Ad Reporting, or contextual advertising (e.g. advertising based on the content of the web page being visited, a consumer’s current visit to a web page, or a search query).
1.2 The definition above encompasses behavioural re- targeting whereby display advertisements may be served to consumers who have shown a previous interest in a product but may not have made a purchase.
1.3 A “third party” is an organisation that engages in OBA (i.e. collects and uses web viewing behaviour data for the purposes of OBA) via websites other than those that it or an entity with which it is under common control owns or operates.
1.4 Explicit Consent means an individual’s freely given specific and informed explicit action in response to a clear and comprehensible notice regarding the collection and use of data for Online Behavioural Advertising purposes.
1.5 A Web Site Operator is the owner, controller or operator of the website with which the web user interacts.
1.6 Entities or web sites under Common Control include ones which Control, for example parent companies, are controlled by, such as subsidiaries, or are under Common Control, such as group companies. They also include entities that are under a written agreement to process data for the controlling entity or entities, and do such processing only for and on behalf of that entity or entities and not for their own purposes or on their own behalf.
1.7 Ad Reporting is the logging of page views on a web site or the collection or use of other information about a browser, operating system, domain name, date and time of the viewing of the web page or advertisement, and related information for purposes including, but not limited to:
- Statistical reporting in connection with the activity on a web site(s);
- Web analytics and analysis; and
- Logging the number and type of ads served on a particular web site(s).
1.8 Ad Delivery is the delivery of online advertisements or advertising-related services using Ad Reporting data. Ad Delivery does not include the collection and use of Ad Reporting data when such data is used to deliver advertisements to a computer or device based on user preferences or interests inferred from information collected over time and across sites not under Common Control.
1.9 The use of Ad Reporting data is not covered by this exception when it is used in a way that matches the definition of OBA. In other words, where a company collects Ad Reporting data across multiple web domains it does not own or operate and uses such data to create interest segments and to deliver ads which are targeted according to these interest segments, it does serve OBA as defined by the BPR and is therefore expected to comply with the obligations accordingly.
2 Application of Rules
The rules in this section do not apply to: contextual advertising; web analytics; ad reporting or ad delivery; the collection and use of information for behavioural advertising by web site operators on their own website(s) or the use of OBA in rich media, in-stream videos online or on mobile devices.
3.1 To ensure that consumers are made aware of, and can exercise choice over, the collection and use of information for the purposes of OBA, third parties must:
(a) Give a clear and comprehensive notice about the collection and use of web viewing behaviour data for the purposes of OBA on their own website, including how a web user can opt out from having web viewing behaviour data collected and used for this purpose. The notice should also link to a relevant mechanism that allows the consumer to opt out of the collection and use of web viewing behaviour data for OBA purposes by that third party and other third parties.
(b) Give a clear and comprehensive notice that they are collecting and using web viewing behaviour data for the purposes of OBA, either in or around the display advertisement delivered using OBA. The notice should link to a relevant mechanism whereby a web user can opt out of the collection and use of web viewing behaviour data for OBA purposes by that third party or that third party and other third parties.
(c) Notcreateinterestsegmentsspecificallydesigned for the purpose of targeting OBA to children aged 12 or under.
(d) Not create or use OBA segments relying on the use of sensitive personal data3 without obtaining a web user’s Prior Explicit Consent.
3.2 Third parties that use technology to collect and use information about all or substantially all websites that are visited by web users on a particular computer in order to deliver OBA to that computer must obtain explicit consent from web users before doing so.
4 Compliance section
4. 1 Rules in Appendix 3 apply only to third parties as defined. If the ASAI is unable to identify the relevant third party, the advertiser – on behalf of whom the OBA advertisement is delivered to web users – must, in good faith, co-operate with the ASAI to help determine the identity of the third party.
Effective 1st September 2013