Several online ad companies have tweaked their practices in response to inquiries from the Better Business Bureau, the organization said on
Wednesday.
The self-regulatory principles require online ad companies to notify consumers about online behavioral targeting via an icon. The principles also require ad companies to allow users
to opt out of receiving targeted ads, but don't require companies to stop collecting data about users for many other purposes, including analytics or frequency capping.
The alleged violations
flagged by the BBB ranged from relatively minor problems in the wording of a privacy policy to more substantive issues, like defective opt-out links. BBB Vice President Genie Barton, who is in charge
of enforcing the ad industry's privacy initiative, says the actions announced on Thursday show that the industry will identify and expose companies that don't follow the guidelines. "We feel that the
principles have been out long enough that people should be in compliance with the letter of the law -- the self-regulatory law," Barton says.
The BBB named four companies engaged in behavioral
targeting that changed their practices -- Turn, BlueCava, DataXu and OxaMedia.
Turn, a demand-side platform, allegedly did not specifically say in its privacy policy that it follows principles
of the Digital Advertising Alliance. The DAA requires companies to explicitly promise to follow self-regulatory principles because the Federal Trade Commission can bring enforcement actions against
companies that break promises to consumers. The company revised its policy in response to the BBB's inquiries, the organization said.
Another potential problem for Turn was that it
appeared to place tracking cookies on consumers' computers even after they opted out of online behavioral targeting. But Turn said that it used those cookies for analytics and ad reporting, as opposed
to collecting information in order to target ads, according to the BBB.
The BBB's criticism of BlueCava centered on how it described its tracking technology, which relies on identifying users
based on unique characteristics of their devices. The company says it can track users across more than one device, and that users can opt out of tracking, but its language on that point created a
"potential ambiguity" about a consumer's opt-out would be honored across multiple devices, the BBB alleged.
BlueCava said it revised the language in its privacy policy and also is
reviewing how to allow consumers to opt out of across all of the devices they use.
The demand-side platform DataXu allegedly had a defective opt-out link on its corporate site, which it fixed
after hearing from the BBB. The company says this problem resulted in "a few consumers receiving DataXu ads after they left the company's corporate website," according to the BBB. DataXu also
reportedly says that the issue wasn't related to the platform that manages advertising for clients, the BBB reported.
The ad network OxaMedia allegedly did not notify consumers via an icon,
and also offered an opt-out that expired after just one year. OxaMedia now licenses the icon from the DAA and its opt-outs now persist for five years, the BBB says.