Targeted Advertising, Retargeting and Privacy: What Companies

© 2015 LOEB & LOEB LLP

Targeted Advertising,

Retargeting and Privacy:

What Companies Need

to Know

Andrew Elman, Re:Sources USA, A Publicis

Groupe Company

Nathan Hole, Loeb & Loeb LLP

Brian Nixon, Loeb & Loeb LLP

May 24, 2016

Greater New York Chapter Association of Corporate Counsel

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjUxbXUoOTMAhUD2oMKHZSrB2cQjRwIBw&url=http://www.sciencemag.org/site/special/privacy/&bvm=bv.122129774,d.amc&psig=AFQjCNHtlqAZq8XWhNdHkmEsJ8AASp0Xqw&ust=1463682479721844

2 © 2015 LOEB & LOEB LLP 2 © 2016 LOEB & LOEB LLP

Targeted Advertising - Today’s Topics

• The Legal Landscape

• In Practice

• General Enforcement Trends

• Keys to Compliance & Best Practices

• What’s On the Horizon


[graphic that represents the intersection

of data and analytics]

More online/digital activity

+ More connected devices

= More data



Interest-Based Advertising

Web pages visited over time …

Based on user’s online

activities, relevant ads

are displayed on a

publisher website


Visit a website for online shopping…

An ad for an item previously viewed on a prior website then appears on a subsequent webpage visited later in time

Retargeting

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjQ7rPzwObMAhVkzIMKHcVaBNoQjRwIBw&url=http://www.ninthlink.com/2010/09/14/retargeting-ads-you-can-run-but-you-cant-hide/&psig=AFQjCNG5iBPtpDo9JXDHsh_KVkrAxuJXzg&ust=1463759924337583


Online and Mobile Targeted Advertising

Increasingly Use Programmatic Buying

Programmatic buying refers to a wide range of technologies that

automate the buying, placement and optimization of advertising, often

through ad exchanges.

• Real-time bidding for online display ads is just one type of

programmatic buying.

• Established ad exchanges already exist for online and mobile display

and video.

• It’s similar to buying stocks on the stock exchange.


The Players in Today’s Eco-System

Ad Agency Buys ad inventory

directly from publishers and from ad networks and ad

exchanges

Demand-Side Platform

A centralized interface for

managing digital advertising

Ad Exchange Provides

automated, real-time bidding on ad

inventory

Ad Network Buys and repackaged

ad inventory from many publishers

Data Aggregator

Collects data from multiple sources and

“cleans” it for downstream users

Publisher Controls the

websites where ads

are displayed


Advertiser #1: I offer $2 for this impression because the visitor

abandoned a shopping cart on my site 2 hours ago.

Advertiser #2: I offer $1.80 for this impression because the visitor is a 15- to 22-year-old male with an interest in sports.

Advertiser #3: I offer $1.60 for this impression because this is

an authoritative movie and gaming site.

2. Ad Exchange makes

available details of

visitor, Publisher site,

and ad unit to

participating

advertisers/agencies.

4. Visitor sees ad from

highest-paying

advertiser. Complete

process takes place

while web page loads.

3. Ad Exchange selects

the highest-paying

advertiser and sends

corresponding creative

to Publisher website.

1. Visitor enters Publisher

website URL. Publisher

sends request to Ad

Exchange for 1 ad of

particular spec (e.g., a

banner).

Online Ad Exchanges

© 2015 LOEB & LOEB LLP 10 © 2016 LOEB & LOEB LLP 10

1000 Main St. 1001 Main St.

Traditional TV


1000 Main St. 1001 Main St.

Female

26 years old

Interest in

beauty

care

Male

38 years old

Interest in

clothing

Addressable Television


http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwip996-huLMAhVELmMKHVDvBrUQjRwIBw&url=http://screenmediadaily.com/outfront-launches-on-smart-media-in-partnership-with-xad-and-videri/&bvm=bv.122129774,d.cGc&psig=AFQjCNF_jOveMN5VLaW2J6-oW1OME11x4w&ust=1463606620707261




Methods of Targeting or Tracking

Mobile device

location

Audio fingerprinting

Bluetooth low-energy /

beacons


FTC Warns 12 App Developers re: SilverPush

• SilverPush enables mobile

device to hear audio beacons

embedded in TV programming

and create a log of what users

have watched

• March 2016: FTC sent warning

letters to 12 app developers

whose apps included

SilverPush

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwiq4tbzhefMAhVPpIMKHYM6BKAQjRwIBw&url=http://500.co/startup/silverpush/&bvm=bv.122448493,d.amc&psig=AFQjCNEzyb_p4JQkAtPMoptCfru_m2bXUA&ust=1463778060739054


Methods of Targeting or Tracking

Device identifiers (web or mobile)

Vehicles Linking purchases to

digital activity


Card-Linked Measurement / Targeting

Ad measurement / targeting Connecting digital ad impressions to offline purchase activity

Consumer consent Sensitive financial

information


Social Media + Digital On-Demand

Services


The Legal

Landscape


U.S. Approach to Data Collection and Privacy

Virtually every piece of data has strings attached – rules about how it can be

used, shared, protected, stored and destroyed.

• There is no single comprehensive privacy law in the U.S.

• Data collection and optimization is governed by:

Patchwork system of state and federal laws

Self-regulatory frameworks and industry guidelines

Platform Terms of Use and Privacy Policies

Contracts with vendors and partners

Your own privacy policies


Selected Federal Laws That Regulate the Collection and

Use of Consumer Data

• FTC Act

• requires companies to comply with their own privacy policies

• Gramm-Leach-Bliley Act (GLB)

• limits how consumers’ financial information may be used

• Health Insurance Portability and Accountability Act (HIPAA)

• limits how covered entities may use health information

• Children’s Online Privacy Protection Act (COPPA)

• limits the collection of children’s personal information and requires parental notice and consent

• New U.S.–E.U. Privacy Shield Program (replaces the U.S.-E.U. Safe Harbor Framework)

• Places limits on data transferred between the U.S. and E.U.

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwj5qp-s-9rMAhXJ5oMKHUt_CAkQjRwIBw&url=http://www.wired.com/2014/01/theres-no-good-way-to-patch-the-internet-of-things-and-thats-a-huge-problem/&bvm=bv.122129774,d.amc&psig=AFQjCNGbe229zNjCg-Vr96fuU4U4APEBrQ&ust=1463361998532192


California Continues To Lead on Privacy Issues

• Dozens of privacy laws - typically

provide more protection to the

consumer than federal laws

• Recently enacted a “do not track”

law and a law limiting the use of

recordings made by a voice-

activated connected TV

• California laws = minimum

requirements for online companies

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjBrPKHk9_MAhUS3WMKHQu6A9UQjRwIBw&url=https://nakedsecurity.sophos.com/2015/10/13/california-nixes-warrantless-search-of-digital-data/&bvm=bv.122129774,d.cGc&psig=AFQjCNHVzNO3v56zlFAgbyahRMknUaCvxw&ust=1463507076876926


Spokeo, Inc. v. Robins, No. 13-1339 (2016)

For standing to challenge a statutory

violation plaintiff’s must suffer

particularized and concrete injury

- Personal and individualized

- Real, not abstract

• Bare procedural violation is

insufficient.

• Intangible injuries can be concrete


The FTC has initiated many enforcement actions against online and offline companies for violating the FTC Act by:

• Not complying with a posted privacy policy

• Changing a privacy policy (perhaps to reflect new technology or new partners/vendors) and not giving consumers notice or the opportunity to opt out of the new policy

• Failing to adequately safeguard data

• Claiming to provide adequate security for data and then failing to do so

• Failing to adequately disclose what data is collected and for what purpose

• Failing to honor opt-out promises


Selected Privacy Guidelines • FTC

• Online Behavioral Advertising

• Mobile Apps

• Internet of Things

• California AG

• Mobile Apps

• Privacy Policies and Do Not Track Disclosures

• Digital Advertising Alliance (DAA)

• Online and Mobile Interest-Based Advertising

• Cross Device Tracking

• Mobile Marketing Association

• Text Message Marketing

• Alliance of Automobile Manufacturers

• Internet-connected cars


Self-Regulatory Compliance Actions

Compliance Actions have focused on:

• Failure to provide notice on every page where data is collected or used for interest-based advertising

• Opt-out links that did not work

• Privacy policies that did not accurately describe a company’s data collection and use policies

• Failing to honor an opt-out request for five years

http://discover.sap.com/internet-of-things


One more thing to keep in mind…

Platforms and app stores have Terms of Use,

Privacy Policies and other guidelines which may limit

how you can use data.

These policies change frequently.


Targeted

Advertising &

Retargeting – In

Practice


Advertisers reach Facebook users taking own first-

party data (e.g., email address, phone number,

customer name) to create target audience and can

layer Facebook audience segments over this to

refine targeting and deliver a targeted ad.

Facebook ‘Custom Audiences’ works by applying hashes

to the customer data of an advertiser to remove any

personal information, and then mapping that hashed

data to its users with the same or substantially similar

sequence of characters from Facebook’s database.

Additional targeting parameters may be added such as

age, interests, etc. to reach a specific audience.

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwj8gfneht_MAhVWwGMKHR5XBqsQjRwIBw&url=http://www.johnchow.com/how-to-build-custom-audiences-for-facebook-ads/&bvm=bv.122129774,d.cGc&psig=AFQjCNGuBPW4gATLf2ibj835N9qEzuo7qw&ust=1463503771982415

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwj8_qX-ht_MAhVB62MKHXSxCskQjRwIBw&url=http://www.emailvendorselection.com/featurewatch/ontraport-integrates-facebook-custom-audiences/&bvm=bv.122129774,d.cGc&psig=AFQjCNGuBPW4gATLf2ibj835N9qEzuo7qw&ust=1463503771982415


• Advertisers can show ads to customers based on data about those customers (e.g., email addresses) that the advertiser shares with Google.

• Currently available on Google’s Search Network, YouTube, and Gmail.

• Option to target similar audiences on YouTube and Gmail based on the advertiser’s created Customer Match audience.

Google AdWords Customer Match works by advertiser uploading a customer data file using AdWords or the AdWords API, either hashed or without hashing the data. Google compares each hashed string (or email address, if the advertiser didn’t hash) with that of Google accounts. For matches, the corresponding Google account is added to the advertiser’s Customer Match audience.

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjyiKOAt9_MAhWq34MKHZs3AvgQjRwIBw&url=http://magnafi.com/blog/customer-match-google-announces-adwords-enhancement-increase-relevance&bvm=bv.122129774,d.cGc&psig=AFQjCNEvl-X2am6u6pPnMb88OI_8Bn3__A&ust=1463516547249846

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjqxO-ct9_MAhUH3IMKHYvSALEQjRwIBw&url=http://www.internetsm.com/news/customer-match-di-adwords&bvm=bv.122129774,d.cGc&psig=AFQjCNEvl-X2am6u6pPnMb88OI_8Bn3__A&ust=1463516547249846


Twitter TV Targeting

Twitter TV Ad Targeting is a dashboard for marketers that allows them to send a

promoted tweet to someone who tweeted during a television program in which the marketer’s commercial was broadcast.


DAA 1st Mobile Enforcement Action (May 2016)

• Spinrilla allowed third parties to collect user data for IBA, without providing required notice and enhanced notice.

• Data collected included cross-app data, IFA data (a unique, persistent device identifier) and precise location data

• DAA’s Mobile Guidance requires:

• First party enhanced notice and consumer control for cross-app data collection

• First party notice, enhanced notice and consumer control for precise location data


Cross Device Tracking

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjGwYWj7eHMAhUI6mMKHageC2oQjRwIBw&url=https://iabhublog.com/2015/11/14/cross-device-tracking-time-to-get-excited-paranoid/&psig=AFQjCNGSTFeUcuithvmjOoqLcJsvm5gO3Q&ust=1463599930399122


Buy, sell or transfer tickets. Pay for parking.

Pre-order and pick-up food before event. Order & track delivery to seats.

Access to in-venue mobile video content; multi-angle playback during live event.

Find shortest lines for restrooms, food, & merchandise.

Earn, track and redeem loyalty rewards.

Option to purchase seat upgrades after arriving at venue.


Cross Device Tracking Issues

DAA issued Application of the DAA Principles of Transparency and Control to Data Used Across Devices (Nov. 2015), requiring • Notice that data collected from a particular

browser or device may be used with another linked computer or device, or may be transferred to a non-affiliate

• Clear, meaningful, and prominent link to a

disclosure linking to industry developed website or choice mechanism, or individually listing the Third Parties engaged in the collection

• Consumer choice (i.e., an opt-out mechanism)

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwilpJ6_7eHMAhUW92MKHWRLASgQjRwIBw&url=https://keomarketing.com/blog/2015/01/mobile-makes-cross-device-tracking-essential/&psig=AFQjCNGSTFeUcuithvmjOoqLcJsvm5gO3Q&ust=1463599930399122


Michael v. Verizon et al.

• Verizon tagged customers with a unique code (or “header”) so that it could follow customers as they navigated around the web and their mobile apps. Customers could opt-out of this tracking, but a blogger

revealed that ad companies could use this persistent identifier (called a “supercookie”) to track customers even after they had tried to opt-out.

• Less than two weeks after the New York Times article about Verizon’s supercookies was published, a class action complaint was filed in federal district court against Verizon and Turn asserting claims under the Computer Fraud and Abuse Act and the Electronic Communications Privacy Act.


Location Technology - Tracking

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwimk9b1lrbKAhVpg4MKHZckCo4QjRwIBw&url=http://blogs.pb.com/pbsoftware/2014/08/06/location-intelligence-data/&bvm=bv.112064104,d.amc&psig=AFQjCNEyFkR0aWyYdkFGTB0q2P3CEJzHLQ&ust=1453303285782001

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjYgJi8l7bKAhXjw4MKHRhiAWsQjRwIBw&url=http://9to5mac.com/2013/11/28/judge-formally-dismisses-user-privacy-lawsuit-regarding-location-services-and-app-store-data-collection-policy/&bvm=bv.112064104,d.amc&psig=AFQjCNHv9w5Ym_0Dv0-x9gO4DPQ1nlZ6hg&ust=1453303251875345


FTC Enforcement: Location Tracking

FTC Settlement with Nomi

Technologies (2015)

Nomi Technologies, a company

whose technology allows retailers to

track consumers’ movements

through their stores, agreed to settle

Federal Trade Commission charges

that it misled consumers with

promises that it would provide an in-

store mechanism for consumers to

opt out of tracking and that

consumers would be informed when

locations were using Nomi’s tracking

services.

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjr7fi9u-HMAhVO2WMKHf7HDaYQjRwIBw&url=http://ftcbeat.com/tag/data-privacy/&psig=AFQjCNFAwuLDR8F8hROop27bSoxe6SYzUg&ust=1463586012571572


Internet of Things (IoT) / Connected Devices

It involves “things” — whether cars, appliances, machines, consumer goods

or personal devices — embedded with sensors and transmission technology so

they can “talk” to other devices and to the Internet.

http://www.alfredomartinelli.info/category/proximity


Connected Home

Connected Cars



Connected

Self


General

Enforcement

Trends


Recent FTC Enforcement and Other Actions

Silverpush (March 2016) Must disclose audio beacon functionality of app

In the Matter of General Workings Inc., also doing business as Vulcun (May 2016) • Companies must disclose

• Collection, use and sharing of consumers’ information • Consumers’ level of control over their data • Steps to maintain privacy or security • Types of information a product or service will access and

how it will be used

• Express affirmative consent required before the installation or material change

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwj92_zshOfMAhXG5oMKHVzgCREQjRwIBw&url=http://yourstory.com/2015/11/silverpush/&bvm=bv.122448493,d.amc&psig=AFQjCNEzyb_p4JQkAtPMoptCfru_m2bXUA&ust=1463778060739054

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwiq4tbzhefMAhVPpIMKHYM6BKAQjRwIBw&url=http://500.co/startup/silverpush/&bvm=bv.122448493,d.amc&psig=AFQjCNEzyb_p4JQkAtPMoptCfru_m2bXUA&ust=1463778060739054

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjkjpGahufMAhWFzIMKHeptDFAQjRwIBw&url=http://www.bbc.com/news/uk-32005851&bvm=bv.122448493,d.amc&psig=AFQjCNFbIlbHpd9hW47LFdxp-WKm84Uowg&ust=1463778544220563


BBB Compliance Action – 23andMe

BBB’s Accountability Program determined that 23andMe was

engaging in retargeting, but failed to provide enhanced

notice on 23andMe’s web site and in or around the ad

displayed on nonaffiliated web sites

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwij9aexg-fMAhVQpIMKHfWyBmcQjRwIBw&url=https://www.23andme.com/&bvm=bv.122448493,d.amc&psig=AFQjCNHUKvUeEpd82JwRYLHdJSg8rVZ06A&ust=1463777799318570


Keys to Compliance

& Best Practices


Keys to Compliance

Short Form Privacy Policy

Participate in Self-

Regulatory Programs

Coordinate with Ad

Networks & Analytics

Companies

Just in Time Notification


Applying Privacy By Design in the Real World

KNOW THE PRODUCT

• From what product is the data collected?

• Is it a mobile app, a website, a physical product or

something else?

• What technology does it use?

• How does it connect to other devices and to the

Internet?

UNDERSTAND THE DATA & USE CASES

• What types of data are collected?

• Is sensitive data collected?

• How is the data used and shared?

• What security features protect the data?

KNOW THE TERRITORIAL CASES

• In which countries is the data collected?

• Where will the product using this data be

marketed and sold?

• Where will data processing occur?

• Where will data be store

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwji7dPF-NrMAhXr6YMKHXcrASMQjRwIBw&url=http://www.techradar.com/news/internet/a-guide-to-the-internet-of-things-1299047&bvm=bv.122129774,d.amc&psig=AFQjCNGbe229zNjCg-Vr96fuU4U4APEBrQ&ust=1463361998532192


What’s on the horizon

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwi97d68gOfMAhUC7oMKHSxuBN4QjRwIBw&url=http://n4bb.com/fcc-ftc-join-mobile-security-investigating-google-blackberry-apple-microsoft/&psig=AFQjCNFtIG9XxHJ6MU2KX_30U_mTSo9nWA&ust=1463777014416497

Documents

Targeted Advertising, Retargeting and Privacy: What Companies