Client Alert

Enforcement of DAA Principles Will Track New Technologies

24 Oct 2016

The Digital Advertising Alliance (DAA) continues to adapt its self-regulatory principles for interest-based advertising (IBA) to technological developments—and it intends to enforce them as well.  Specifically, last week, the DAA announced that the enforcement of its cross-device tracking principles, which were issued in November 2015, will begin on February 1, 2017.[1] 

Cross-device tracking entails ascertaining—either definitively or with a high degree of probability—that multiple devices are connected to the same person.  One way to do this is by using a deterministic identifier, such as login information.  For example, if a user is logged into a web-based email account or e-commerce website on both a mobile device and a laptop, that service can determine that the two devices belong to the same user.  Alternatively, companies can probabilistically infer that two devices are used by the same person based on a variety of information collected from those separate devices, such as IP address, location, installed fonts and plug-ins and activities on those devices.

The DAA cross-device principles apply the DAA’s IBA self-regulatory notice-and-choice regime to cross-device tracking if browsing activity on one device may be used to deliver advertising on another device.[2]  Specifically, the DAA requires a device-specific opt-out from:  (1) collecting data on the device to deliver IBA on another device, and (2) delivering IBA on a device based on information collected on another linked device.

The DAA announcement heralds the enforcement of compliance with this cross-device guidance “for all companies engaged in data collection and use covered by the DAA Principles” by the DAA independent enforcement program, which is run by the Council of Better Business Bureaus and the Direct Marketing Association.  As we noted in a recent Client Alert, the program has recently interpreted the DAA principles broadly in the mobile context, such as by requiring “enhanced notice” of IBA practices within mobile applications.  We expect that the DAA will take a similarly broad approach with respect to cross-device tracking.  Accordingly, companies that are engaged in the collection and linking of information across multiple devices should review whether their practices are subject to the cross-device principles and, if so, how they disclose them and provide appropriate choice.

[1] The DAA is a consortium of media and marketing associations that created a self-regulatory program in the wake of a 2009 Federal Trade Commission (FTC) report, Self-Regulatory Principles for Online Behavioral Advertising.  As technologies for collecting information from consumers’ use of online services for IBA purposes have evolved, and as the types and number of devices on which consumers access online services has proliferated, the DAA has issued new and updated guidance, all based on the same principles of enhanced notice and choice.

[2] Our Privacy Minute on the release of these cross-device principles, and the FTC’sinterest in cross-device tracking, can be found here.



Unsolicited e-mails and information sent to Morrison & Foerster will not be considered confidential, may be disclosed to others pursuant to our Privacy Policy, may not receive a response, and do not create an attorney-client relationship with Morrison & Foerster. If you are not already a client of Morrison & Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.