User Consent Needed for Online Ad Tracking: EU Working Party

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Online behavioral advertising providers are required to obtain the informed consent of users before installing tracking devices, such as cookies, on their computers, under the terms of the European Union’s online privacy rules, according to the Article 29 Data Protection Working Party.

Use of an “opt out” mechanism would not be sufficient to comply with the requirements of the recently revised ePrivacy Directive, the Working Party said in an opinion released June 24.

Behavioral Advertising

Behavioral advertising is defined as the continuous tracking of individuals across multiple websites. Commonly, tracking cookies are used to collect information about individual surfing behavior and to send users targeted advertisements. In most cases, according to the Working Party, individuals are unaware that this is happening.

Although online behavioral advertising may bring advantages to online businesses and users, the Working Party said, its implications for personal data protection and privacy are significant. Monitoring Internet surfing can give third parties a very detailed picture of a person’s online life. Thus, online advertising networks and browser vendors must employ simple and effective mechanisms for users to affirmatively give their consent for online behavioral advertising.

Equally simple and effective mechanisms should be established for users to withdraw consent, the Working Party added.

Consent

Currently, three of the four most widely used browsers are set by default to accept all cookies, the Working Party noted. Not changing a default setting cannot be considered meaningful consent, in most cases. Advertising networks and publishers should provide information about the purposes of tracking in a clear and understandable manner to enable users to make informed choices about whether they want their browsing behavior to be monitored.

Advertising network providers should work with browser manufacturers and developers to implement privacy by design in browsers, the Working Party recommended.

Ad network providers should enable individuals to exercise their rights to access their personal data stored by the networks and to make corrections and request erasure of such information. Ad networks also should implement retention policies that ensure information is automatically deleted after a reasonable period of time. These policies should apply to alternative tracking technologies, such as “Java cookies.”

Application to Children

In addition, in the Working Party’s view, online advertising networks should not serve behavioral advertising to children at all, because of inherent difficulties in obtaining informed consent and because of the vulnerability of children.

The Working Party is an independent advisory body on data protection and privacy, set up under Article 29 of the EU Data Protection Directive. It is composed of representatives from the national data protection authorities of the EU Member States, the European Data Protection Supervisor, and the European Commission.

Text of the Working Party’s Opinion 2/2010 on online behavioural advertising appears at CCH Privacy Law in Marketing ¶60,494.