Ad companies that rely on “fingerprinting” techniques to track mobile users across apps for ad-targeting purposes must notify people that their data is being collected, and allow them to opt out of receiving targeted ads, an industry watchdog warned on Tuesday.
Fingerprinting involves collecting data about users based on characteristics of their devices -- such as IP address, brand, operating system version, screen resolution, processor, language settings, even battery levels.
The advertising industry's privacy code generally requires online companies to notify consumers via an icon when their data is collected across sites or apps, and let consumers opt out of receiving ads based on that data.
Those requirements are the same whether companies track people via traditional cookies, advertising identifiers (such as Apple's Identifier for Advertisers), or digital fingerprints, the BBB National Programs Digital Advertising Accountability Program effectively says in the new compliance warning.
“Entities that use fingerprinting techniques to identify users or devices for [interest-based advertising] are required to provide the same level of transparency and choice to consumers as they would if using an Advertising ID for the same purpose,” the organization writes.
The warning comes 10 months after Apple rolled out new privacy settings that require app developers to obtain iPhone and iPad users' permission before tracking them across apps. Those settings only allow developers to access devices' “Identifier for Advertisers” -- alphanumeric strings, comparable to serial numbers -- if users consent on an app-by-app basis.
Apple also says it prohibits developers from using workarounds, like device fingerprinting, to track users who say they don't want to be tracked.
Advocates have said for years that device fingerprinting poses a particular threat to privacy, because consumers often lack the ability to prevent tracking through fingerprinting. By contrast, users can block or delete traditional cookies, effectively preventing their browsing history from being seen by ad networks and other third parties.
Despite Apple's policies, some apps reportedly use fingerprinting techniques to track mobile users.
The Accountability Program noted in its warning that fingerprinting techniques “are increasingly relevant as access to other identifiers is restricted or narrowed.”
This isn't the first time the watchdog has said the industry's self-regulatory code applies when companies use digital fingerprinting. In 2014, the Accountability Program also issued a compliance warning addressing cookie-less tracking.
“As new 'cookie-less' technologies increasingly replace the more familiar 'cookies' in the delivery of personalized advertising across multiple screens, consumers must continue to receive real-time 'enhanced' notice and an easy-to-use and effective opt-out mechanism,” that prior warning stated.
The Accountability Program said on Tuesday it was restating that earlier message in the context of mobile devices.
“We thought it was really timely,” Mary Engle, BBB National Programs' executive vice president for policy, says about the new warning.
She adds that some companies may have forgotten the warning issued eight years ago, or questioned whether it applied to tracking across mobile apps.
“To the extent that there was any doubt that it would apply to the mobile environment, we wanted to cast away that doubt,” she says.