An Extra Dose of Transparency: Shedding Greater Light on the Use of Health-Related Data for Online Advertising
The NAI is premised on the notion that users are entitled to transparency and choice with respect to the collection and use of data for online behavioral advertising and related purposes. While we believe that more relevant ads that support free Web content and services provide myriad benefits to users, we also believe that transparency about the practices that make such benefits possible is crucial. Transparency not only helps address users’ privacy expectations by providing access to information about data collection and use practices and to easy-to-use mechanisms to express their choices, it also enhances user confidence. For this reason, transparency is at the heart of the NAI Code. Our code requires members to provide clear and detailed descriptions of their data collection and use practices on their own websites, and to ensure that users are provided notice about their data collection and use practices on the websites where they collect data.
Some NAI member companies have gone beyond NAI Code notice requirements by providing notice not only of their data collection and use practices, but also publicly disclosing all interest segments associated with users’ browsers through “interest managers” or “ad preference managers.” You can see some of these initiatives listed under “Ad Preference Managers” in the column to the right.
In our 2010 Annual Compliance Report, NAI compliance staff recommended that NAI member companies be required to publicly disclose any standard segments used for online behavioral advertising purposes that are based on health-related information. We issued this recommendation because we believe an additional layer of transparency for health-related segments would not only promote compliance with Code requirements, but also would help to normalize best practices by all participants in the online advertising marketplace. We also believed the policy would enhance users’ confidence that sensitive health-related information is not collected and used without their knowledge and consent. Finally, it would allow users to make more educated decisions about whether to opt out of the collection of data for behavioral advertising purposes by some or all NAI member companies, as the ad preference managers provided by some of our member companies have already done.
Throughout 2011, NAI staff worked with NAI member companies to implement this policy recommendation. We then began training member companies about the requirements of the new health transparency policy and best practices with respect to the collection and use of health-related information more generally. In our 2011 Annual Compliance Report, we noted that we would begin fully enforcing the health transparency policy in 2012.
It is important to remember that, in addition to our new health transparency policy, the NAI Code requires opt-in consent for the collection and use of “sensitive consumer data,” which is defined to include “precise information about past, present, or potential future health or medical conditions or treatments, including genetic, genomic, and family medical history” (in addition to certain identifiers, account numbers, and precise geographic location). If an NAI member company were to seek to market to users on the basis of sensitive health conditions such as cancer, mental health-related conditions, or sexually transmitted diseases, the company would need to clearly explain that intent and to obtain opt-in consent for such use. Our transparency policy, on the contrary, is intended to capture those interest segments for which opt-in consent is not required under the Code, but nevertheless may factor into an individual’s decision about whether to opt out of targeting by a particular member company. Thus, for example, member companies may have interest segments associated with such general health categories as headaches, allergies, or diet and fitness that would not require opt-in consent under the NAI Code, but would require disclosure under the transparency policy.
It is also important to remember that the NAI Code prohibits members from using, or allowing the use of, online behavioral advertising segments other than for marketing purposes. Thus, members are prohibited from using, or allowing the use of, health-related interest segments – or any other interest segments – for purposes such as making decisions about eligibility for health insurance, life insurance, or employment.
In summary, our transparency policy relates to the use of interest segments that do not rise to the level of “precise” information about health conditions or treatments for marketing purposes. Under the NAI Code, non-marketing uses of interest segments are already off-limits, and the use of “precise” information about health conditions or treatments for online behavioral advertising requires opt-in consent. Following commentary provided in response to our draft 2008 Code, the NAI has not developed an exhaustive list of conditions or treatments that it considers to be “precise.” Rather, in evaluating our members’ health-related segments, NAI staff looks at the nature of the condition to which the segment relates, including, among other things, the seriousness of the condition, its prevalence, whether it is something that an average user would consider to be embarrassing, whether it is treated by over-the-counter or prescription medications, and whether it can be treated by modifications in lifestyle as opposed to medical intervention.
We believe that this “extra dose” of transparency has already gone a long way to promoting existing obligations under the Code, normalizing best practices, and ensuring consumer confidence with respect to health-related targeting by NAI member companies. We hope that this increased transparency also leads to a productive dialog between industry, advocates, and regulators concerning what should and should not be considered “sensitive” consumer data requiring opt-in consent for use in online advertising.
We applaud those member companies that have already made health transparency disclosures, and look forward to working with membership in 2012 to bring all member companies into compliance with the new policy.
–Meredith Halama, Deputy General Counsel & Director, Policy and Compliance
