AdChoices? Online Behavioral Advertising Compliance

This is the summary of a behavioral targeting article by Saranga Komanduri, et al. You can get the pdf of the behavioral targeting article here: AdChoices? Compliance with Online Behavioral Advertising Notice and Choice Requirements

Online behavioral advertising is the practice of tracking consumers activities online to target advertising. Part of the responsibilities of companies engaging in online behavioral advertising is to listen to the privacy concerns of their consumers. Thus, in 1999, the Network Advertising Initiative (NAI) was created. Now, 66 companies are members of the NAI and they offer services for consumers to opt-out of online behavioral advertising. Another set of organizations formed the Digital Advertising Alliance (DAA) and they too have set principles of self regulation for online behavioral advertising.

The FTC determines what the next step is, and this study helps by investigating how effective opt-out and notices are. This paper also studies if the regulations implemented by DAA and NAI are being followed by several websites.

Online Behavioral Advertising

With online behavioral advertising, users are tracked to give them advertisements that are relevenant to their interests. Cookies are used to do the tracking. Despite its effectiveness, privacy concerns are being raised because data is being collected in secret, and this can create profiles of users tagged with sensitive personal information.

A huge majority of Americans who participated in various services found behavioral advertising tobe invasive. They did not want ads that reflect their interests, and wanted websites to erase their personal information immediately. Thus, the opt-out mechanism was invented. Furthermore, self-regulatory methods were invented in the form of notices and website privacy policies, these policies are so hard to read that users can’t read them every time they visit a website. However, a study shows 50 percent of users believe that if a website has a privacy policy, that website won’t share their personal data.

DAA and NAI Principles

DAA has seven principles. Education Principle (to main the website of DAA as an educational website), Transparency Principle (inspect ads and websites as they share certain info), Consumer Control Principle (provide opt out mechanism), Security Data Principle (data security requirements), Material Changes Principle (require companies consent before making changes), Sensitive Data Principle (steps for handling sensitive data), and Accountability Principle (develop compliance programs).

These are the same principles to NAI, along with additional principles that are irrelevant to the study.


66 NAI members were checked during February to March 2011 for the following requirements. Privacy notice requirements at the front page of their websites. Their privacy policy. Opt-out cookies from the opt-out mechanisms by NAI and DAA. Compliance with the notice requirements enhanced from the principles of DAA, through inspection of the ads posted in the websites. These enhancements are only for behavioral advertisements, so ads that excluded an ad network were not inspected. The estimate is that 80 percent of the ads are behavioral, and rely on third party cookies.


Non-contextual ads were looked for in 100 websites, and 400 pages of these websites. 164 of these pages are monitored by the NAI members. The enhanced notice requirement requires the notice to be in the same page that contains the behavioral ads, but upon investigating these 164 pages, only 35 percent put enhanced notices, which is a huge compliance gap. The study further sees most of these enhanced notices are from the advertisers, the companies purchasing the ads, and not the members of NAI.

For Privacy Notice requirement, only Audience Science stated in its privacy policy that it abides by the principles of DAA. It is therefore the only NAA member which fully complies with the requirements for privacy notice. Aside from this fact, 83 percent of the members would be compliant. For choice requirement, the opt out mechanisms of DAA and NAA were checked in this study. The two mechanisms have shown inconsistency between them, such as setting different cookies and getting different content from the same advertiser. Other results show that these mechanisms do not work in Safari. These are some of the results obtained from this study.

Implications for Public Policy

Compliance to DAA Principles is slow and infrequent in some aspects, opt-out mechanisms contain errors. Furthermore, the definition of online behavioral advertising by the DAA and NAI may not be enough to ease concerns regarding privacy. Furthermore, two members of NAI, Undertone and Valueclick, imposes their demands and limitations to a user that visits their site, through messages that direct them to the privacy policy, and this may surprise the user as to the limitations of his or her rights upon reading. Finally, some members of NAI have their own opt out features, usually going beyond what is set by NAI, which is a good thing for privacy.

Leave a Reply

Your email address will not be published. Required fields are marked *