Explains online behavioural advertising and profiling.
1.1 What is online behavioural advertising?
It’s the collection of tracking data through tracking tools that record users’ online activity and habits through time and across non-affiliated websites. The data gathered are used to infer the user’s preferences with a view to showing them ads that may interest them (known in the industry as “interest-based ads”). Such practices allow companies to deliver advertisements or content they believe to be more relevant to the user.
Online behavioural advertising raises ethical questions since the data on which it is based are often collected without the user’s knowledge.
1.2 Profiling
Profiling consists of aggregating data from various sources (tracking tools) to build a user profile. Tracking data are combined with other types of information to create detailed profiles. Two elements make profiling possible: the persistent identifier that’s part of the device’s unique identifier; and the tracking tools that recognize a user through time and across websites. The more third-party cookies there are on sites visited by the same user, the more detailed that user’s profile will be.
Profiling is one of the cornerstones of digital marketing. It is used to detect market trends as well as for behavioural advertising.
Apart from the province of Québec, most countries monitor advertising through self-regulatory programs. However, since behavioural advertising is based on collecting user data, it is also covered by laws that govern the protection of personal information.
CANADA
Personal Information Protection and Electronic Documents Act (PIPEDA) — Policy Position on Online Behavioural Advertising
Federal statute defining the rules for the personal information handling practices of private-sector organizations in the course of commercial activities. The Policy Position on Online Behavioural Advertising represents the application of PIPEDA to the collection and use of data for the purposes of online behavioural advertising.
PIPEDA considers data collected for such purposes to be personal information. Accordingly, you must obtain valid or meaningful consent to collect such data; you must also give the user a chance to opt out. PIPEDA does not refer to specific age thresholds for providing consent, but underscores that practices need to correspond to the user’s cognitive and emotional development.
Children’s personal information should not be tracked for the purposes of behavioural advertising. This practice is deemed inappropriate, since children cannot be expected to understand or appreciate the issues associated with tracking their data and are thus unable to provide meaningful consent. Simply put, platforms aimed at children should avoid including any third-party tracking technologies.
**QUÉBEC: Consumer Protection Act
Québec’s Consumer Protection Act prohibits commercial advertising directed at children aged under 13, regardless of the platform, barring certain exceptions prescribed by regulation. Accordingly, it is prohibited to use data from Québec children under 13 years of age for the purposes of behavioural advertising. This prohibition is also applicable to companies based outside the province. For more information about advertising directed at children in Québec, click here.
Additional information:
Office of the Privacy Commissioner of Canada: Policy Position on Online Behavioural Advertising
Consumer Protection Act – Advertising Directed at Children Under 13 Years of Age
UNITED STATES
Children’s Online Privacy Protection Act (COPPA)
Federal law that governs the online collection of information about children. It applies to products that collect personal information about U.S. children aged under 13, even if the company in question is based outside of the U.S.
COPPA does not consider behavioural advertising as necessary to supporting internal operations). Consequently, if you and/or a third party collect data for the purposes of behavioural advertising, you must obtain verifiable parental consent before starting collection. Furthermore, you must clearly outline your practices linked to behavioural advertising in your privacy policy.
Seek COPPA-compliant services. For example, for mobile apps can use the “kid-safe” marketing platform SuperAwesome as well as the analytics services Flurry and PreEmptive Solutions.
*The U.S. self-regulation program Your AdChoices is similar to its Canadian counterpart AdChoices.
Additional information:
Federal Trade Commission: COPPA Rule: A Six-Step Compliance Plan for Your Business
EUROPEAN UNION & FRANCE
Directive on Protection of personal data and Directive on Privacy and Electronic Communications
These directives frame privacy protection for citizens of the European Union and cover companies that do business in one or more EU Member States.
With the exception of cookies that are used to facilitate navigation (e.g. user authentication, content personalization, shopping carts), any use of tracking tools requires the user’s consent. You must also offer the option of refusal. Information about the use of tracking tools along with the right to refuse should be offered the first time the user connects and cover future use.
Additional information:
European Union Agency for Fundamental Rights, Handbook on European Data Protection Law
Your Online Choices: A guide to online behavioural advertising
AUSTRALIA
Privacy Act
Federal law, general in scope, on the protection of personal information as it affects companies engaged in business activities in Australia. If you collect personal information using a tracking tool, you must inform the user (a notice on the home page is sufficient) and explain what the information is used for in your privacy policy.
Additional information : Office of the Australian Information Commissioner, Privacy fact sheet 4: Online behavioural advertising – know your options
Apple App Store
Apps in the Kids Category may not use behavioural advertising.
Google Play
Apps cannot include features that track user behaviour or incite the user to click them inadvertently. These must be clearly identified at all times by an icon and accompanying notification.
The Digital Advertising Alliance of Canada (DAAC)
Consisting of Canadian advertising and marketing trade associations, the DAAC is a national self-regulation program launched to increase consumer understanding of online behavioural advertising. Its proposed system is based on the opt-out mechanism. Under this system, the AdChoices icon appears near an ad whenever data is collected and/or used for behavioural advertising purposes. By clicking on the icon, users can see the name of the company collecting the data, a description of its usage practices and a link to a consumer opt-out page.
The DAAC advises its members not to use tracking tools or any other means to collect personally identifiable information from children known to be under 13 years of age for the purposes of behavioural advertising.
Additional information:
Canadian Self-Regulatory Principles for Online Behavioural Advertising
Advertising Standards Canada
Unless authorized by law, advertisers cannot disclose personal information collected from children to any third party without first obtaining parental consent. The exception to this is third parties who support the platform’s internal operations and neither use nor disclose personal information for any other purposes.
Additional information: Interpretation Guideline # 2 – Advertising to Children
Canadian Marketing Association
Marketers must not participate in the use of behavioural advertisements that knowingly or directly target websites aimed mainly at audiences under 13 years of age, nor do so through a third party, except in situations where a parent or legal guardian grants their explicit consent.
Additional information: Code of Ethics and Standards of Practice, see section K. Special Considerations in Marketing to Children
- If possible, avoid integrating third parties who collect information for behavioural advertising purposes.
- Before allowing third-party cookies to be placed on your site, review the terms of service and privacy policy of the party in question to ensure that its practices meet your requirements.
- Be transparent about your behavioural advertising practices: contact parents and notify them using clear and simple language when collecting tracking data — for example, with a banner or interactive tool.
- Give parents the choice to opt out of behavioural advertising without preventing their children from accessing your platform. The opt-out must take effect immediately and apply to future connections.
- If appropriate, use your privacy policy to explain your practices with regard to behavioural advertising and explain the roles of the various parties involved.
- Periodically review the terms of service and privacy policies of any third-party services on your platform.
- **Québec: All advertising directed at children under 13 years of age is strictly prohibited in Québec, barring certain exceptions prescribed by regulation. This should factor into your decision to host an advertising network on your platform.
