Articles

This article originally appeared in Bristows' Monthly Technology, Media and Telecommunications e-newsletter, The Cookie Jar.

Despite being the fastest growing advertising medium (at least in terms of annual ad spend), online behavioural advertising continues to attract controversy. Privacy advocates, data protection authorities and legislators have all weighed in on the subject. And whilst an alphabet soup of industry bodies - the IAB, the AAAA, the ANA, the BBB and the DMA - have produced industry codes, it would seem that these may not be enough to head off legislative attention altogether.

In the recent All Party Parliamentary Communications Group's report, "Can we keep our hands off the net?" the following question was raised:

"Should the Government be intervening over behavioural advertising services, either to encourage or discourage their deployment; or is this entirely a matter for individual users, ISPs and websites?"

Many groups provided evidence to the inquiry, with individual users' representatives expressing concerns about the lack of clarity in online advertising practices whilst industry groups extolled its benefits. It would appear that the consumer lobby won the day with the APPCG concluding as follows:

"We recommend that the Government review the existing legislation applying to behavioural advertising, and bring forward new rules as needed, to ensure that these systems are only operated on an explicit, informed, opt-in basis."

Whilst not legally-binding, this is a significant development. The entire online advertising eco-system operates on an opt-out basis; that is, users of the web are served ads based on their browsing history (i.e. websites they have visited) unless they specifically opt-out.

Another development relates to changes to the EU's 'cookie' Directive (or the Privacy & Electronic Communications Directive to be precise). Under the current law, cookies - text files placed on a user's computer - may be placed provided clear notice is given to the user (usually via a privacy policy) along with an opportunity to reject the cookie concerned (usually by the user changing his/her browser settings); in other words, an 'opt-out' regime for cookies is operated. Since virtually all online behavioural advertising is based upon cookies being used to record a user's browsing history, an 'opt-out' regime for cookies supports the existing 'opt-out' regime for online advertising.

If, on the other hand, a user's prior consent was to be required before a cookie could be set on his machine then any online advertising using that cookie would also require his prior consent. Unfortunately, this may be where things are headed as the Council of Europe recently approved the following amendment to the Directive:

"the storing of information ... in the terminal equipment of a user is only allowed on condition that the subscriber or user concerned has given his consent..."

So, on the face of it, a user's prior consent is required for online behavioural advertising that uses cookies. Curiously though, the following new language appears in the Directive's recitals:

"...the user's consent to processing may be expressed by using the appropriate settings of a browser..."

This suggests no change to the existing requirements. It's hard to overestimate how unhelpful it is to have such confusion on the face of the Directive, something that will only get worse as member states implement the requirement in inconsistent ways. Bad for the online advertising industry? Potentially, yes, but bad for the internet generally too. Free services such as Facebook, MySpace, YouTube and the like only exist through being monetised (i.e. paid for) by online advertising. A legislative threat to online advertising may be a threat to these services too.