• by Wendy Davis  @wendyndavis, June 24, 2020

Ad companies that share highly sensitive information with law enforcement authorities and public health officials should notify consumers about the practice before asking them to consent to the data's collection, the self-regulatory privacy group Networking Advertising Initiative advises in recommendations issued this week.

The new guidance, which addresses the use of tracking data for non-marketing purposes, is not part of the privacy group's official code.

The NAI historically has focused on the collection and use of tracking data for advertising -- including delivering targeted ads, ad delivery and reporting.

For years, the organization has prohibited members from sharing, or using, tracking data in order to determine their eligibility for jobs, health care, insurance, housing and education admissions. But the NAI previously took no position on other non-marketing uses of information.

The self-regulatory group has long required members to obtain consumers' opt-in consent before collecting sensitive data, including precise geolocation information. The new guidance also recommends that companies disclose, via “just-in-time” notifications, whether that type of data might be used for non-marketing purposes.

“Some NAI members and their partners engage in use cases that consumers may not easily understand to be advertising, attribution, or analytics,” the guidance states. “Some examples may be sharing for public health, business research, city planning, or even law enforcement purposes. When those use cases rely on information that requires opt-in consent (e.g., precise location information, sensor information, or sensitive health information), the NAI recommends including more detailed disclosures in the just-in-time notices that are already required for tailored advertising or ADR purposes.”

The organization is also recommending that companies aggregate or de-identify location data and other sensitive information before using the data with law enforcement, public health officials or other parties that want to use it for non-advertising purposes. 

The new guidance comes shortly after it emerged that some NAI members were drawing on location data to track people's movements during the recent COVID-19 lockdowns.

“A number of location intelligence companies in the NAI membership use information collected as a result of tailored advertising or ADR [ad delivery and reporting] to provide valuable business analytics services that are not directly related to tailored advertising or ADR,” the organization states in its new recommendations. “As the COVID-19 pandemic has revealed, information collected as a result of tailored advertising or ADR (and location data in particular) can be a valuable resource for the public good by helping researchers and policy-makers understand the spread of disease, the efficacy of social distancing measures, and other important insights.”

David LeDuc, vice president of public policy at the NAI, says “very few” members companies are currently using or sharing data for non-advertising purposes.

He adds that the organization is currently seeking information from members about the practice.