• by Wendy Davis  @wendyndavis, November 8, 2023

The self-regulatory privacy group Network Advertising Initiative (NAI) on Wednesday issued a new best practices guide that encourages advertisers to target health ads based on demographic data -- such as information about people's age, gender or general geography -- instead of personal, sensitive health information.

“The use of this broad demographic data allows advertisers to reach consumers with ads that are likely to be more relevant to them, while also protecting consumer privacy,” NAI states.

The new guidance comes as an increasing number of states have passed privacy laws that require companies to obtain consumers' express consent before processing a broad array of health-related data, including data the ad industry hasn't traditionally considered sensitive -- such as whether a consumer has a common cold, or an ear infection.

“Some audience creation methods that rely on sensitive information (such as health data, purchase information, or deductive inferences based on a user’s prior engagement with a health-related website or mobile application) are likely to require consumer consent under certain new privacy laws,” the NAI writes in the best practices guide.

“On the other hand, audience creation methods that rely only on general demographic factors such as age, gender, education level, presence of children or pets in the household, or general geographic region need not involve the processing of sensitive data in a way that requires consumer consent,” the group adds.

The new guidance gives several examples of ad targeting methods that it says don't rely on sensitive data.

For instance, the NAI proposes that an advertiser could create an all-male audience for an ad for a prostate cancer treatment without harnessing sensitive medical data.

“Instead, the advertiser is relying on a population-level observation that only (or predominantly) men get prostate cancer and is creating an audience composed of men to increase the likelihood that the treatment being advertised is relevant to the audience,” the group writes.

But the organization adds that combining demographics with information about an individual -- such as health-related web browsing, app use, specific purchases, or precise location -- potentially could support an inference that the person has a medical condition. If so, the information about the individual “may need to be treated as sensitive,” the guidance says.

The NAI's privacy code requires companies to obtain opt-in consent before collecting or using sensitive information for targeted advertising, ad delivery or reporting. 

“While the NAI Code limits the scope of sensitive health information to, among other things, particularly sensitive health conditions such as cancer, mental health conditions, pregnancy termination, and sexually transmitted diseases, there is little evidence that the regulators responsible for enforcing new privacy laws and regulations will follow the NAI’s model by distinguishing between common ailments and those more sensitive conditions,” the group writes.