Share This Article
The Article 29 Working Party, the European Union data protection advisory body, issued an interesting opinion on online behavioral advertising, i.e. the tracking of users when they surf the Internet and the building of profiles over time, which are later used to provide them with advertising matching their interests. Rules on behavioral advertising are relevant for (i) ad network providers, i.e. those connecting publishers with advertisers (e.g. the major search engines); (ii) advertisers, i.e. those promoting a product/service to a specific audience; and publishers, i.e. websites owners looking for revenues by selling space to display ads. In particular, the Article 29 Working Party focused its attention on the usage of cookies or similar devices and on the data collected through them and stated:
- cookies often entail the processing of personal data;
- ad network providers, publishers and advertisers can all act as data controllers and therefore (depending on the activity performed) are responsible for the compliance of the processing of the personal data collected through the cookies and other sources (or transferred to thrid parties) depending on the activity performed;
- Art. 5(3) of the E-Privacy Directive requires that ad network providera – before the cookie is placed/the information stored in the user’s terminal is collected – (i) provide users with a clear and comprehensive privacy policy outlining the data processing performed and compliant with the EU Privacy Directives; and ii) obtain the users’ consent to the storage of or access to information on his or her terminal equipment.
In this context, the Article 29 Working Party puts relevant restrictions to the possibility to give such consent through mere browser settings requiring ad network providers to create prior opt-in mechanisms (no mere opt-out) implying an affirmative action by the data subjects indicating their willingness to receive cookies or similar devices and the subsequent monitoring of their surfing behavior for the purposes of serving tailored advertising. It will not be necessary to request consent for each reading of the cookie (but just on the first occasion), but data controllers should: i) limit in time the scope of the consent (i.e. requiring it again after a period of time e.g. one year); ii) offer the possibility to revoke it easily and iii), create visible tools to be displayed where the monitoring takes place.
Even if the opinions of the Article 29 Working Party are generally not binding, they represent a relevant point of reference for the interpretation of local privacy laws. Indeed, not only ad network providers, but any publishers i.e. any websites from which cookies are installed on users’ terminals should take into account the privacy limitations identified in the opinion.
Even if the opinions of the Article 29 Working Party are generally not binding, they represent a relevant point of reference for the interpretation of local privacy laws. Indeed, not only ad network providers, but any publishers i.e. any websites from which cookies are installed on users’ terminals should take into account the privacy limitations identified in the opinion.
If you want to discuss the implications for your business of the abovementioned opinion, feel free to contact me, Giulio Coraggio.
(Visited 7 times, 1 visits today)
