• by Wendy Davis  @wendyndavis, June 15, 2023

The self-regulatory group Digital Advertising Alliance has issued a guide to best practices for applying the industry's privacy code to smart TVs, watches and other internet-connected devices.

That privacy code, which dates to 2009, broadly requires online companies to notify consumers about ad targeting based on most data collected across sites and apps, and to allow consumers to opt out of receiving those ads. The principles also require companies to obtain opt-in consent before harnessing certain types of "sensitive" data, such as precise geolocation information.

The new guidance attempts to extend those requirements to internet-connected gadgets by recommending that “first parties” -- meaning companies that consumers intentionally interact with -- notify consumers about data collection via a “clear, meaningful, and prominent link,” and allow them to opt out.

The guidance also encourages “third parties” -- defined as companies that collect connected-device data “from or through a non-affiliate’s connected device or digital properties or services on a connected device” -- to provide notice through a mechanism like the AdChoices icon, and allow consumers to opt out.

Those definitions mean that there could be more than one “first party” collecting data in an interaction.

For instance, if a consumer watches Netflix on a Roku device, both Netflix and Roku might be considered first parties, according to a spokesperson for the Digital Advertising Alliance.

At the same time, companies can be both "first parties" and "third parties" under the framework.

For instance, if Roku (or any other company) collects data across non-affiliated properties, it would also be considered a “third party.”

Those and other operational issues will be addressed by a working group, the spokesperson said.

Even if consumers opt out, the guidance allows companies to continue to collect data for market research and product development, among other reasons.

Lou Mastria, CEO of the organization, stated that the group aims “to extend the easy and widely recognized AdChoices experience from the desktop and mobile environments into this emerging space.”

He added that the release of the best-practices guide “will kick off a creative ad specification process.”

The Digital Advertising Alliance is managed by a coalition including the American Association of Advertising Agencies, American Advertising Federation, Association of National Advertisers, Interactive Advertising Bureau, and Network Advertising Initiative.

Privacy advocate Justin Brookman, director of technology policy for Consumer Reports, questioned Digital Advertising Alliance's continued reliance on its 2009 framework, given more recent legal developments.

"This guidance seems frozen in time from 10 years ago," he says, adding that the 2009 notice-and-opt-out framework "has proved to be insufficient ... to forestall regulatory attention."

He noted that in the years since the Digital Advertising Alliance first issued its code, a number of states have passed their own privacy statutes, and the Federal Trade Commission has brought an enforcement action against smart TV manufacturer Vizio over data collection.

In addition to the FTC case, Vizio in 2019 settled a class-action lawsuit alleging that it violated the federal Video Privacy Protection Act by collecting identifiable video viewing information by default.

The Digital Advertising Alliance says the best practices are intended to be a baseline, and that companies must comply with applicable federal and state laws.