Feeds

Ad slingers - obeying EU snoop code is NOT GOOD ENOUGH

Industry rules at odds with cookie laws, say watchdogs

3 Big data security analytics techniques

Choice to 'opt out' is no choice at all

"The EASA/IAB Code, instead of seeking users' consent, claims to provide for a way of exercising 'choice'. In fact it is a choice to opt out, as it offers the user the possibility to object to having his/her data collected and further processed for OBA. This 'choice' is not consistent with ... the revised e-Privacy Directive, as the data are in fact processed without user's consent and without providing the user with information before the processing takes place," the opinion said.

The Working Party also expressed concern that individuals who managed their OBA preferences via the 'youronlinechoices.eu' website would themselves be served cookies without consent when opting to choose not to be tracked.

"Although the opt-out cookie prevents the further reception of personalised advertising, it does not stop the advertising network from accessing and storing information in the user's terminal," the opinion said. "On the contrary, it has been demonstrated that an ongoing technical exchange of information between the user’s terminal equipment and the advertising network is still in place after the installation of the opt-out cookie. The user is not informed on whether or not the tracking cookie remains stored in his/her computer and for what purpose."

"The installation of the opt-out cookie does not offer the possibility to manage and delete previously installed tracking cookies, whereas at the same time it creates the mistaken presumption that opting out disables the tracking of internet behaviour," the opinion said.

The 'youronlinechoices.eu' website also contains "JavaScript functions" that track users without proper consent to do so and "in two cases, without any possibility to opt-out from this specific tracking".

The Working Party said that it had concerns about how long data stored about users was being retained for.

"The EASA/IAB Code does not contain any provisions on the amount of data collected and the retention period(s) for the specific purposes. Since the website currently also fails to provide any explanation on this matter, it is unclear how many data are collected by the different advertising networks, how long they are stored, and for what purposes they are being processed. This information is absolutely necessary for a user to make a fully informed decision to consent to such profiling," the watchdogs said.

"In general, given the lack of transparency and public awareness, it is highly undesirable for each advertising network to have a different retention policy in this regard and a self-regulatory initiative would have been very helpful. Such an initiative should at least address the period in which consent can be considered valid, and after which data shall then be deleted," it said.

Nick Stringer, director of regulatory affairs at the IAB UK, told Out-Law.com that the OBA self-regulatory code was not designed specifically to comply with the e-Privacy Directive.

"The self-regulatory EU Framework for online behavioural advertising intends to provide consumers across Europe with greater transparency and control. Through an icon in adverts and information provided, users’ knowledge and ability to control customised advertising will be enhanced. This has been welcomed by the UK Government as a part of its package for compliance with the revised e-Privacy Directive. It should be noted, however, that the work on the EU Framework pre-dates the legislation and is not intended to specifically address compliance with Article 5.3 [of the Directive]. We will continue to work with the European Commission, the Government, the Article 29 Working Party and national regulators on this," Stringer said.

The Working Party said it is possible to obtain users' consent to cookies without having to display multiple 'pop-up' messages on users' screens. Operators could use information banners that requests user consent to cookies and a link to more details about what is being requested, it said. In some cases it may be possible to obtain users' consent to individual ad networks that apply to OBA across different sites or where a single indication of consent is sufficient to enable more than one ad network to place cookies on users' machines, the Working Party said.

Copyright © 2012, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Combat fraud and increase customer satisfaction

More from The Register

next story
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
US Supreme Court supremo rakes Aereo lawman in oral arguments
Antenna-array content streamers: 'Ruling against us could dissipate the cloud'
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
prev story

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.