Privacy Commissioner Releases Policy Paper on Online Behavioural Advertising
Online Behavioural Advertising (OBA) refers to the online advertising technique, whereby a website operator uses “cookies” to track visitors on a website and then uses the data obtained by the tracking (in combination with geographic and demographic data) to create targeted advertising tailored to the individual’s inferred interests.
On June 6, 2012, the Office of the Privacy Commissioner of Canada (OPC) released a policy position on OBA. The OPC found that:
- It will generally consider information collected for the purpose of OBA to be personal information, given the fact that the purpose of collecting information is to create individual profiles that in turn permit the serving of targeted ads.
- Some people would consider targeted advertisements to be useful. However, OBA should not be considered a term or condition for individuals to use the internet. There should be meaningful consent and limits on collection.
- Opt out consent may be acceptable provided certain conditions are met.
- Tracking options that do not allow users to opt-out should not be used (e.g. “zombie cookies”, “supercookies”, device fingerprinting, etc.)
- Organizations should avoid knowingly tracking children and tracking on websites aimed at children.
Prior to the policy paper of the OPC, some companies have been joining a coalition of big internet players to create voluntary controls on OBA. While the program is self-regulated, big players such as Microsoft, Google, Firefox and Twitter have recently announced that they will support “Do Not Track”, a proposed internet standard that would effectively allow a user to request an opt out of online tracking at the browser level. Browsers such as Mozilla’s Firefox, Google’s Chrome, Apple’s Safari and Microsoft’s Internet Explorer will all support a Do Not Track option. Microsoft is even going so far as to try and make Do Not Track the default setting on the upcoming Internet Explorer 10. However, since this initiative is self-regulated, the website operator does not have to comply with the Do Not Track Request.
In the US, the Federal Trade Commission and the Obama Administration are pushing for Do Not Track legislation that would compel organizations and advertisers to respect the opt-out mechanisms. While the OPC’s policy paper did not give an indication of whether it would push for this matter to be legislated, the OPC will likely keep a close eye on developments in the U.S.
