The Rules in this Section relate to Online Behavioural Advertising (OBA) aiming to secure transparency and control for consumers in the use by any OBA third party (see definition) of OBA. The rules require an OBA third party to provide notice to web users in or around an online display advertisement if they are undertaking OBA. The notice should link to a relevant mechanism whereby a web user can opt out of the collection and use of web viewing behaviour data for OBA purposes by that third party, or that third party and other parties. These rules are integral to a pan-European initiative – the European Advertising Standards Alliance (EASA) Best Practice Recommendation and an EU industry Framework. Further information can be found at www.asai.ie.
18.1
(a) Online Behavioural Advertising (OBA) means: the collection, over a period of time, by a third party of web viewing behaviour data from a particular computer or device which takes place across multiple web domains not under common control, and which is used by the third
party to deliver advertising to that particular computer or device based on the preferences or interests inferred from the data by the third party’s technology. (These preferences or interests are often categorised into “interest segments” which are then used to target multiple web users with a specific preference or interest.)
• OBA does not include the activities of Web Site Operators (First Party), Ad Delivery or Ad Reporting, or contextual advertising (such as, for example advertising based on the content of the web page being visited, a consumer’s current visit to a web page, or a
search query).
• OBA encompasses behavioural re-targeting whereby display advertisements may be served to consumers who have shown a previous interest in a product but may not have made a purchase.
(b) An “OBA third party” is an organisation that engages in OBA (i.e. collects and uses web viewing behaviour data for the purposes of OBA) via websites other than those that it or an entity with which it is under common control owns or operates.
(c) Explicit Consent means an individual’s freely given, specific and informed explicit action in response to a clear and comprehensible notice regarding the collection and use of data for OBA purposes.
(d) A Web Site Operator is the owner, controller or operator of the website with which the web user interacts.
(e) Entities or web sites under Common Control include ones that Control, for example parent companies, are Controlled by, such as subsidiaries, or are under Common Control, such as group companies. They also include entities that are under a written agreement to process data for the controlling entity or entities, and do such processing only for and on
behalf of that entity or entities and not for their own purposes or on their own behalf.
(f) Ad Reporting is the logging of page views on a web site or the collection or use of other information about a browser, operating system, domain name, date and time of the viewing of the web page or advertisement, and related information for purposes including, but not limited to:
• statistical reporting in connection with the activity on a web site(s);
• web analytics and analysis; and
• logging the number and type of ads served on a particular web site(s).
(g) Ad Delivery is the delivery of online advertisements or advertising-related services using Ad Reporting data. Ad Delivery does not include the collection and use of Ad Reporting data when such data is used to deliver advertisements to a computer or device based on user preferences or interests inferred from information collected over time and across sites not under Common Control.
• The use of Ad Reporting data is not covered by this exception when it is used in a way that matches the definition of OBA. In other words, where a company collects Ad Reporting data across multiple web domains it does not own or operate and uses such data to create interest segments and to deliver ads which are targeted according to these interest segments, it does serve OBA as defined by the European Advertising Standards Alliance Best
Practice Recommendation on Online Behavioural Advertising and is therefore expected to comply with the obligations accordingly.
Application of Rules
18.2
The rules in this Section do not apply to: contextual advertising; web analytics; ad reporting or ad delivery; the collection and use of information for behavioural advertising by web site operators on their own website(s) or the use of OBA in rich media, in-stream videos online or on mobile devices.
Rules
18.3
To ensure that consumers are made aware of, and can exercise choice over, the collection and use of information for the purposes of OBA, OBA third parties must:
(a) Give a clear and comprehensive notice about the collection and use of web viewing behaviour data for the purposes of OBA on their own website, including how a web user can opt out from having web viewing behaviour data collected and used for this purpose. The notice should also link to a relevant mechanism that allows the consumer to opt out of the collection and use of web viewing behaviour data for OBA purposes by that third party and other third parties.
(b) Give a clear and comprehensive notice that they are collecting and using web viewing behaviour data for the purposes of OBA, either in or around the display advertisement delivered using OBA. The notice should link to a relevant mechanism whereby a web user can opt out of the collection and use of web viewing behaviour data for OBA purposes by that third party or that third party and other third parties.
(c) Not create interest segments specifically designed for the purpose of targeting OBA to children aged 12 or under.
(d) Not create or use OBA segments relying on the use of sensitive personal data1 without obtaining a web user’s Prior Explicit Consent.
18.4
Third parties that use technology to collect and use information about all or substantially all websites that are visited by web users on a particular computer in order to deliver OBA to that computer must obtain explicit consent from web users before doing so.
Compliance Section
18.5
Rules in this Section apply only to OBA third parties as defined. If the ASAI is unable to identify the relevant third party, the advertiser – on behalf of whom the OBA advertisement is delivered to web users – must, in good faith, co-operate with the ASAI to help determine the identity of the third party.
1: Sensitive Personal Data means personal data as to (a) the racial or ethnic origin, the political opinions or the religious or philosophical beliefs of the data subject, (b) whether the data subject is a member of a trade union, (c) the physical or mental health or condition or sexual life of the data subject, (d) the commission or alleged commission of any offence by the data subject, or (e) any proceedings for an offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in such proceedings. Source: www.dataprotection.ie
OBA and the Law
18.6
Advertisers and OBA third parties must take account of privacy and data protection laws applicable in Ireland. The relevant legislation in Ireland is the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations, 2011.
18.7
Guidance from the Office of the Data Protection Commissioner is available on the application of the legislation. Companies are encouraged to seek their own legal advice to ensure compliance with privacy and data protection legislation.
OBA Complaints Procedure
The rules and procedures for the making and resolution of OBA complaints are
set out at Appendix 1, Part B.
