Until recently, ICO has been very clear that advertisers wishing to use OBA platforms must operate on the basis of opt-in consent. However, recent developments – including the unannounced update to ICO’s Web site – have suggested a possible change of heart by ICO, indicating that it may now be prepared to allow advertisers to run OBA on an opt-out basis. The change to the ICO Web site was spotted by Osborne Clarke.
They feel that this and other recent developments have suggested a softening in ICO’s attitude towards the consent requirements for OBA:
IAB ‘Good Practice Principles: On 4 March, the Internet Advertising Bureau produced a set of OBA ‘Good Practice Principles, endorsed by Google and Microsoft and also by Ofcom. The principles place a strong emphasis on opt-out, although there is ambiguous wording in attached ‘Guidance’ which talks about having to obtain ‘specific consent’ where required by law or ‘applicable regulatory guidance.’ ICO has welcomed these Principles, with Assistant Commissioner Phil Jones going on the record to say that the ICO is: ‘pleased that the online advertising industry has come together to produce these guidelines’.
Google AdSense: On 11 March, Google announced its intention to operate an OBA platform on the basis of opt-out (user opt-outs being stored permanently). Despite this, Google appears to have the backing of the ICO, with the ICO reported as saying: ‘… we are pleased that [Google’s] preference manager feature allows users a high level of control over how their information is used and that the method by which users can choose to opt out is saved permanently.’
Unannounced updating of ICO’s Web site: The ICO appears to have removed a statement addressing Phorm’s OBA technology, in which it clearly supported opt-in consent requirements, from its website. The statement URL now brings up a ‘Page Not Found’ error. ICO has not made any announcement about the removal of the statement.
Phil Lee, an advertising and data privacy solicitor at Osborne Clarke, said:
‘The disappearance of the ICO statement supporting opt-ins could be a further sign that ICO is moving towards allowing an opt-out regime for advertisers of OBA platforms. Since its introduction, OBA has been the subject of heated debate over concerns about the lack of user transparency and the inability for users to control the collection and use of their personal data. A requirement for OBA platforms to operate on the basis of opt-in consent could be seen as something of a death knell for the technology. However, if advertisers can operate OBA platforms on an opt-out basis and adhere to the IAB Principles, this may significantly reduce public disquiet about the technology. For the time being, uncertainty persists as to whether opt-in or opt-out is required, but there is hope for the advertising industry on the horizon. We can only hope that ICO clarifies its position soon.’
