According to Paid Content, Google’s AdSense network will soon allow many other third-party ad networks to serve advertising via the AdSense code already embedded on millions of websites. This is significant from a privacy point of view, to the extent that it provides many smaller ad networks with access to a much wider set of websites, complicating privacy and opt-out disclosures.
Google will make the determination as to whether a third-party ad network qualifies to participate, and according to the program rules, this includes a review of their privacy practices. When it comes to user targeting, here’s how Google explains the requirements in an FAQ for third-party ad networks:
- NAI Self-Regulatory Code of Conduct for Online Behavioral Advertising (www.networkadvertising.org)
- IAB UK Good Practice Principles for Online Behavioral Advertising (www.iabuk.net/en/1/behaviouraladvertisinggoodpractice.html)
Where there is a conflict between the NAI and IAB UK policies, the more stringent policy applies. Google determines at its own discretion whether or not you are compliant with these standards.
In particular, the certification process requires you to have the following:
- No PII used in the creation of segments
- No sensitive segments or segments targeted at children under 13 years of age
- No packet sniffing in the collection of behavioral data
There’s no mention of the new self-regulatory principles, which are more specific about disclosure and require individual websites to disclose specific ad networks that use or collect behavioral data on their site (if such disclosure is not present in the ads themselves). Google does not seem to be requiring that a participating AdSense website provide such disclosure; the privacy statement and opt-out presentation applies only to the ad network’s own website.
The AdSense policies draw a distinction between collection and use of behavioral information in this program — third-party networks may use behavioral information they have gathered elsewhere to serve the ad, but may not collect information for behavioral purposes in the course of serving it. As Google explains it to the ad network:
You may use a cookie, web beacon, or other tracking mechanism to collect anonymous traffic data for purposes of aggregated reach, frequency and/or conversion reporting. Collecting impression-level data via cookies or other mechanisms for purposes of subsequent re-targeting, interest category categorization, or syndication to other parties on AdSense inventory is prohibited. (This restriction does not apply to click- or conversion-level data.)
Google does not explain here if or how these distinctions will be enforced. The same information is available to the ad network in either case, so to confirm compliance with this rule would require some kind of back-end audit of the network’s practices.