On February 27, 2011, the Interactive Advertising Bureau (“IAB”) Board of Directors voted to require its members to adopt industry self-regulatory privacy rules governing online behavioral advertising. Within six months, members must publicly affirm that they will follow self-regulatory principles, which were created in 2009 by the IAB, the American Association of Advertising Agencies, the Association of National Advertisers, and the Direct Marketing Association. Companies that do not comply with the new self-regulatory standards will face a minimum six-month suspension from the IAB.
The new rules: (1) require entities to provide consumers with clear and prominent notices in at least two places, including on the marketers’ websites and within or around the targeted advertisements or another place on the webpage where data is collected, before engaging in cookie-based behavioral targeting; and (2) require entities to obtain consumers’ consent before collecting sensitive personal data, such as financial account numbers, Social Security numbers, or medical information. More information regarding the IAB’s self-regulatory principles is available through the IAB’s website.
The IAB’s self-regulatory efforts follow recently introduced legislation designed to regulate marketers’ online tracking activities. The bills include the Do Not Track Me Online Act (H.R. 654) introduced by Representative Jackie Speier (D-CA)–which would allow consumers to opt out of online tracking by marketers–and the Best Practices Act (H.R. 611), an online privacy bill reintroduced by Representative Bobby Rush (D-IL) that would require marketers to obtain consumers’ consent before engaging in online tracking.