BBB National Programs’ data privacy watchdog, the Digital Advertising Accountability Program (DAAP), has issued a new compliance warning against the practice of inferring consent from a consumer’s passive use of a product or service following a notice of interest-based advertising (IBA). In this warning, DAAP reminds companies that in situations where consent is required for IBA, both a notice from the company and an active response to that notice by consumers are necessary.
DAAP monitors online and mobile advertising, enforcing the Digital Advertising Alliance’s (DAA) Self-Regulatory Principles, which provide a baseline for consumer data privacy regarding digital ads.
Under the DAA Principles, consumers must have transparency about and control over IBA. Commonly, the DAA Principles work on an “opt-out” basis, in which consumers should be given up-front indications of IBA activity linked to fuller disclosures and a means to choose not to participate in a company’s IBA practices.
In other cases, however, the DAA Principles require companies to obtain consumers’ consent before engaging in IBA. The DAA Principles define consent as “an individual’s action in response to a clear, meaningful, and prominent notice regarding the collection and use of data for a specific purpose.” The DAA Principles specify that consent is required in situations calling for a heightened degree of consumer choice, such as the collection of precise location data or particularly sensitive data, making a material change in the use of prior-collected data, or the collection and use of data by a service provider for IBA.
Put simply, today’s compliance warning underscores the fact that inaction is not action. Companies may use notice and enhanced notice to point to a mechanism for providing consent, but such notices cannot themselves stand in for a consumer’s consent. This is because consent requires an individual’s action in response to a notice. A company’s provision of notice, without a corresponding action in response by the relevant consumer, does not pass this test. Practically speaking, then, companies should not consider a consumer’s mere continued use of a product or service after receiving notice to constitute consent.
Companies seeking guidance on developing and deploying Principles-compliant consent flows are encouraged to reach out to the Accountability Program proactively for free, confidential consultation.