The Self-Regulatory Principles for Online Behavioral Advertising

2. The Self-Regulatory Principles for Online Behavioral Advertising A How-To Compliance Workshop

3. Panelists • Genie Barton, VP & Director, Online Interest-BasedAdvertising Accountability ProgramCouncil of Better Business Bureaus (moderator) • Peter Kosmala, Managing DirectorDigital Advertising Alliance • Scott Meyer, CEO Evidon • Senny Boone, SVP, Corporate and Social ResponsibilityDirect Marketing Association

4. Schedule • Presentations • Peter Kosmala • Scott Meyer • Senny Boone • Genie Barton • Break-out groups: Test Your OBA IQ • Discussion and Questions

5. DI G I T A L AD V E R T I S I N G AL L I A N C E • I M P L E M E N T I N G T H E S E L F - R E G U L A T O R Y P R O G R A M • I A P P P R I V A C Y A C A D E M Y | S E P T E M B E R 2 0 1 1

6. 1 FA M I L I A R I Z E • Y O U R S E L F W I T H T H E D A A S E L F - R E G U L A T O R Y • P R I N C I P L E S F O R O B A C O M P L I A N C E

7. The DAA Principles • Education • Transparency • Consumer Control • Data Security • Material Change to • Existing OBA Policy/Practices • Sensitive Data • Accountability

8. 2 UN D E R S T A N D • Y O U R O R G A N I Z A T I O N ‘ S R O L E A N D • R E S P O N S I B I L I T I E S I N O B A C O M P L I A N C E

9. DAA Program Participants Publisher Ad Exchange Advertising Enhanced Demand-side Agency or Ad Server or Supply-side Network Notice Platform (DSP) Advertiser Platform (SSP) Provider Ad Server

10. 3 RE V I E W • T H E D A A A D V E R T I S I N G O P T I O N I C O N • C E R T I F I C A T I O N A G R E E M E N T

11. DAA Certification Agreement • Certification v. License • $5,000 annual fee (USD) • User obligations • Usage guidelines & approvals • Proprietary rights & restrictions • Indemnity • Liability

12. 4 IM P L E M E N T • T H E D A A A D V E R T I S I N G O P T I O N I C O N I N A N Y • A D C R E A T I V E A N D O N A N Y W E B P A G E W H E R E • D A T A I S B E I N G C A P T U R E D F O R O B A P U R P O S E S

13. DAA Program Components 1. The DAA Advertising Option Icon (“Ad Choices”, “the forward-I”, “CLEAR ad marker”)

14. DAA Program Components 2. The DAA Consumer Choice Page (“COOP” – Consumer Opt-out Web Page)

15. Contact the DAA P E T E R K O S M A L A , C I P P P E T E R @ A B O U T A D S . I N F O +1. 2 0 2 . 8 6 1 . 2 4 0 6

16. Scott Meyer, CEO Powering the Self-Regulatory Program for Online Behavioral Advertising

17. Evidon Plays Two Roles • Monitoring Platform • Delivers data to CBBB/DMA, primarily from panel, enhanced by lab and other analytics tools, to support Accountability Mechanisms. Enforcement decisions • made by BBB/DMA, • not Evidon. Industry Leader in Compliance Services Technology Provider to the DAA Self-Regulatory Program • Assurance Platform • Delivers ad/site notice to consumers; helps all businesses comply with Program. All data owned and controlled by client, not Evidon or anyone else. 17

18. Think “Nutritional Label for Ads”… = If you do it right: OBA CompliantTrust MarkBuild Brand 18

19. Brands Have Options, And Obligations Where data is collected In Ads • Buy only through DAA-compliant businessesNetworks, DSPs, publishers have the primary compliance responsibility • Use approved providerManage yourself • Build your own solution • Notice and simple opt-out must be provided by 3rd party/ publisher (or advertiser can provide) • If 3rd party data is being collected for OBA purposes on any website 19

20. Should Advertiser Rely on Network/Publisher? Cons • Limited, if any, highly manual reporting • Icon placement can hurt campaign performance • No brand control – network has to get it right; no messaging control • No comprehensive opt-out from campaign • Limits buying to compliant companies Pros • No additional work • No direct cost • Distances brand from association with targeting • Obligation resides with the network/publisher • Networks/publishers have primary responsibility under the Principles 20

21. Best-Practices Ad Notice STEP 1 STEP 2 21

22. Best-PracticesAd Notice STEP 3 Easy opt-out from each; reporting proves that the request has been sent All vendors contributing targeting to ad …the following companies helped target this ad to you... Rich detail on each vendor available Consumer profile management via ODP Global opt-out to hundreds of vendors Click here to opt out of more companies 22

23. Best-Practices Ad Notice Open Data Partnership (ODP) — fine tune targeting profiles …the following companies helped target this ad to you... Click here to opt out of more companies 23

24. Best-PracticesWebsite Notice Easy opt-out from each; reporting proves that the request has been sent Rich detail on each collector available 24

25. Compliance Monitoring for Accountability Program Ghostery — a Massive, Engaged Community… • 4+ million downloads • 140K+ new per month • 300k member opt-in panel • Tracks 400+ trackers on over 5 million domains worldwide • Consumers learn abouttracking and/or block it “Happy birthday, and thanks for the wonderful program, Ghostery. It's a great add-on, and makes me feel more confident about browsing the web. Keep up the good work…” (Community Member) 25

26. …that Informs the Accountability Program Panel Data (300k members) Privacy Database (800+ companies) 26

27. Evidon – Opt Out Compliance Monitoring • Daily testing of 250+ opt out mechanisms • Examination of all cookies dropped • Alert generated if no opt out cookie is found • Daily review and analysis of all alerts by privacy staff 27

28. The Direct Marketing Association’s Role in OBA ComplianceSenny Boone, Esq.Senior Vice President, Corporate & Social Responsibility, DMAContact: sboone@the-dma.orgSee: www.dmaresponsibility.orgwww.dmaaction.org

29. OBA/Interest-Based Ads: Cookies and Tracking

30. Self-Regulatory Principles for Online Behavioral Advertising The Direct Marketing Association was one of the trade associations that worked to create the cross-industry Self-Regulatory Principles for Online Behavioral Advertising DMA & CBBB are providing the “enforcement mechanisms” that satisfy the Accountability Principle and are coordinating their efforts DMA has incorporated the Principles into its Ethical Guidelines

31. DMA & Accountability DMA has a lengthy history in self-regulating its members to build consumer trust across marketing channels. Today, digital accountability is key to allow for growth and innovation rather than regulation that stifles change.

32. DMA Guidelines DMA as an enforcement “mechanism:” DMA asks its members to follow DMA Guidelines as a condition of membership, OBA is included. See www.dmaresponsibility.org/Guidelines/

33. DMA Guidelines DMA Requirements 1. Publish a Privacy Policy and abide by it 2. ALSO provide an Enhanced Notice Link to Consumers and honor their choices-provide a link in or around the ad. 3. Ensure reasonable data security and limited data retention-for a legitimate business purpose.

34. DMA Guidelines DMA Requirements 4. Offer notice and choice for Material Changes to your policies. 5. Obtain Express Consent for Sensitive Information Collection (kids, financial data…) 6. Hold your organization and others accountable. 7. Help to educate-See www.aboutads.info

35. DMA Compliance Process OBA Compliance -Consumers will file complaints via our www.dmaresponsibility.org site. Consumer must support claims with proof. -Review and resolve the issue is our goal. -Many complaints can be resolved quickly -But if there is no resolution at staff level or in cases of egregious, repeated misconduct, the complaint will be sent to the Ethics Operating Committee for review and recommended action.

36. DMA Compliance Process Policing of the Guidelines Complaint handling: -Consumers & members complain -Many issues can be resolved immediately -if a company is not being accountable, or if the action is repeated, egregious a case is brought before DMA’s Ethics Operating Committee

37. DMA Compliance Process DMA Ethics Operating Committee (marketing practitioners) follow due process to ensure the company is held accountable while also educating the company on best practices and needed changes. DMA Ethics Operating Committee demonstrates the strength of peer review in achieving high standards of industry compliance

38. DMA Compliance Process Consumers want us to extract punishment, we do not have sanctioning authority. If Company fails to cooperate, company may be referred to the appropriate authority and/or publicized as non-compliant. DMA Members may be suspended/removed. Casework is confidential.

39. DMA Compliance Process Consumer Concerns: -Location & functionality of privacy policy -Role of email service providers -Whether ad is “general” or “OBA” -Control over SPAM -Mysterious 3rd parties

40. DMA Compliance Process Company compliance will be measured, and industry compliance across the board will be examined.

41. Compliance The Time is Now

42. Role of Accountability in Self-Regulation • The Principles require industry-wide compliance • Consumers, legislators, regulators, and competitors demand that all covered businesses be accountable • Self-regulation succeeds when there is independent, vigorous enforcement across the entire ecosystem • The Council of Better Business Bureaus and the Digital Marketing Association are providing accountability for the Self-Regulatory Program • They are working cooperatively to avoid duplication • Our programs are underway

43. Compliance Timeline • All entities covered by the Principles must: • Be in compliance NOW, or • Be on a “commercially reasonable” path to compliance • DMA and IAB have made compliance a condition of membership • Current IAB members had to be in compliance by August 29, 2011 and new members have 6 months • The Accountability Program has initiated company specific compliance inquiries and is working to resolve those inquiries to bring those companies into compliance

44. Compliance Survey • The BBB’s Accountability Program has sent letters to 250 ad networks and web publishers: • Letters contain a questionnaire on compliance status • Accountability Program is offering companies assistance in understanding compliance requirements • You have been provided with a copy of the letter and survey, please fill it out so we can assist you • If you are working for a company that is operating in the advertising ecosystem, please make sure the person in your company that is in charge of compliance completes the survey • If you represent clients who may have compliance obligations, please ensure that they participate in the survey

45. CBBB/DMA Enforcement Has Started • What you need to do: • You need to be in compliance now or have a commercially reasonable plan for coming into compliance • License icon from DAA (www.aboutads.info) • Put on icon on every page where OBA ad is delivered • Networks, et. al. – provide opt-out either through DAA opt-out page or other easy-to-use opt-out mechanism • Deliver enhanced notice and choice of collection and use of information for OBA purposes

46. Accountability Program Compliance Is Underway Using Many Sources • Monitoring Technology provided by Evidon • Complaints from consumers, competitors, privacy advocates and academics • Academic research • Inquiries and compliance reviews • Goal: help companies to achieve compliance

47. Accountability Review Process • Company receives notification of inquiry and request for evidence of compliance • Accountability Program reviews submissions and formulates recommendations • If non-compliance found, Accountability Program issues public decision, including company’s agreement to implement recommendations • Accountability Program may refer company that refuses to participate, to correct non-compliant practices, or to implement recommendations to the Federal Trade Commission

48. Association Implementation • All DMA members – as a condition of membership – are required to comply with the DMA’s Guidelines for Ethical Business Practice, which have been expanded to include the Principles. • IAB members are also required to comply with the Principles as a condition of membership. • Associations providing tool kits to members

49. FTC OBA Enforcement: Chitika • First FTC case involving OBA • Privacy Policy: Promised consumer an opt out • Opt-out cookie expired after 10 days

50. Chitika OrderRequirements in Blue Same or Similar to the Principles • 20-year order period • Affirmative action by consumer before redirecting to third party • Notice and hyperlink in Ad to opt out (like icon) • 5-year minimum opt-out period (Principles) • Opt out of collection for the purpose of delivering targeted ads (Principles)