• by Wendy Davis  @wendyndavis, May 30, 2012

Several online ad companies have tweaked their practices in response to inquiries from the Better Business Bureau, the organization said on Wednesday.

The self-regulatory principles require online ad companies to notify consumers about online behavioral targeting via an icon. The principles also require ad companies to allow users to opt out of receiving targeted ads, but don't require companies to stop collecting data about users for many other purposes, including analytics or frequency capping.

The alleged violations flagged by the BBB ranged from relatively minor problems in the wording of a privacy policy to more substantive issues, like defective opt-out links. BBB Vice President Genie Barton, who is in charge of enforcing the ad industry's privacy initiative, says the actions announced on Thursday show that the industry will identify and expose companies that don't follow the guidelines. "We feel that the principles have been out long enough that people should be in compliance with the letter of the law -- the self-regulatory law," Barton says.

The BBB named four companies engaged in behavioral targeting that changed their practices -- Turn, BlueCava, DataXu and OxaMedia.

Turn, a demand-side platform, allegedly did not specifically say in its privacy policy that it follows principles of the Digital Advertising Alliance. The DAA requires companies to explicitly promise to follow self-regulatory principles because the Federal Trade Commission can bring enforcement actions against companies that break promises to consumers. The company revised its policy in response to the BBB's inquiries, the organization said. 

Another potential problem for Turn was that it appeared to place tracking cookies on consumers' computers even after they opted out of online behavioral targeting. But Turn said that it used those cookies for analytics and ad reporting, as opposed to collecting information in order to target ads, according to the BBB.

The BBB's criticism of BlueCava centered on how it described its tracking technology, which relies on identifying users based on unique characteristics of their devices. The company says it can track users across more than one device, and that users can opt out of tracking, but its language on that point created a "potential ambiguity" about a consumer's opt-out would be honored across multiple devices, the BBB alleged. 

BlueCava said it revised the language in its privacy policy and also is reviewing how to allow consumers to opt out of across all of the devices they use.

The demand-side platform DataXu allegedly had a defective opt-out link on its corporate site, which it fixed after hearing from the BBB. The company says this problem resulted in "a few consumers receiving DataXu ads after they left the company's corporate website," according to the BBB. DataXu also reportedly says that the issue wasn't related to the platform that manages advertising for clients, the BBB reported.

The ad network OxaMedia allegedly did not notify consumers via an icon, and also offered an opt-out that expired after just one year. OxaMedia now licenses the icon from the DAA and its opt-outs now persist for five years, the BBB says.