Don’t tailor experience based on device/user (serve non-BA ad)*

1. Don’t tailor experience based on device/user (serve non-BA ad)* 1 4 Collect only what is necessary for that use DNT 0/1 2 Use only for that use 3 Retain only for that use 1 0 • Use of the retained data must be limited to the purpose for which the data was retained. • Third parties: • Don’t serve B.A. Ad • Don’t personalize based on precise location • Don’t personalize based on user’s browsing history • Don’t (use/append) to profile for social widget • * MAY alter experience (deny service) based e.g. on security concern, “You’re naughty go away” • Third parties will still: • Have a unique identifier when necessary (e.g. counting # users who have seen the ad) • Log impressions (including IP address, URL of the page) for • audit purposes • Security • fraud purposes Retention period must be what is minimally necessary for the purpose. E.g. if you are subject to audits for 2 years, your retention for audit purpose should be 2 years