On December 20, 2016, the Federal Trade Commission (FTC) announced that Turn Inc. agreed to settle charges that it misled consumers about its online tracking activities and failed to honor consumer opt-outs as described in its privacy policy.
Background
Turn is a digital advertising company that facilitates targeted marketing by commercial brands and ad agencies through the use of various tracking mechanisms such as cookies, web beacons and device identifiers that help direct ads to consumers online and through mobile apps.
Once such device identifier, Verizon's UIDH, was the subject of an FCC action in March 2016 concerning the fact that its persistence made it possible to track opted-out consumers by regenerating cookies (sometimes referred to as "zombie cookies" or "supercookies") on the consumers' devices.
The Complaint
The FTC's Complaint alleges that Turn's privacy policy misrepresented that consumers could prevent Turn's tracking by blocking or otherwise limiting cookies. Because Turn was able to track certain consumers using the persistent UIDH identifier, however, opting out oftentimes did not restrict Turn's ability to continue to monitor and target advertising to those consumers.
The Complaint also alleges that Turn's privacy policy misled consumers into believing that its opt-out mechanism applied to browsers as well as mobile apps, when in fact the opt-out was not effective for blocking tailored ads on mobile applications.
The Order
The FTC's proposed consent Order imposes a number of obligations relating to disclosure, operation, reporting, record-keeping and monitoring. Of particular note, the Order requires that Turn post a clear and conspicuous "Consumer Opt Out of Targeted Advertising" hyperlink on its home page that directs to (1) a disclosure that explains what information Turn collects and uses for targeted advertising and (2) an effective mechanism that enables users to opt out of such targeted advertising. Turn has now posted the link, which directs visitors to this page.
The Order further requires Turn to honor any signal it receives that indicates the activation of a control intended to opt out of or otherwise limit targeted advertising. Turn also is prohibited from misrepresenting the extent to which it collects or uses consumers' information and the extent to which consumers can opt out of the collection or use of their information.
Takeaways
Businesses that use online tracking technologies to target marketing across platforms and devices, including companies that engage ad tech service providers to help direct their advertising, should verify that their privacy policies are accurate, transparent and up to date.
- Review privacy policies and other consumer-facing representations regarding online tracking activities to confirm that such statements clearly describe the company's practices and provide information about tracking mechanisms used by service providers on the company's behalf (where applicable).
- If consumers are offered a means by which they may stop or limit online tracking, ensure that such opt-out mechanisms are working properly, then test and monitor them on an ongoing basis to confirm they are operating as described. If an opt-out's functionality is changed or limited in a material way, notification regarding the relevant changes may be appropriate.
- Consider whether tracking and opt-out functionality may differ between web browsers and mobile applications. If need be, clarify that a given opt-out mechanism is effective for one or the other, but not both. In some cases, it may be useful to engage a third party to provide technological assistance with opt-out solutions for in-app advertising.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.