How the IAB Plans to Head Off Mobile-Privacy Qualms

The whole privacy debate often fluctuates with the media story of the day. It’s often very reactive in the sense that a major company will change a privacy policy or do something that triggers a chain of media stories, and the discussion reacts to that. Location became a really big issue in over the past year because of several high profile cases, for example. When we’re talking about privacy, though, it’s really about understanding how data is collected and how it’s used. It’s not so much an issue of specific technologies or issues; it comes down to expectations, and that’s where our focus has been with our work with the DAA program.

It’s about educating consumers, regulators and the industry. We’re currently working on the consumer education piece with the DAA, for example, which will include rolling out the AdChoices icon to mobile. In mobile there’s also somewhat of a gap between consumers’ understanding of what it is they’re using and how it relates to their data. They need to be given both notice and choice around that. For example, if you talk about location tracking out of context, it makes people uncomfortable, but when you talk about it in the context of a mobile application, it’s a different situation. The second part is working with regulators. If you read a story in a newspaper, that can create a lot of confusion and concern for both consumers and regulators. It’s about sitting down with policy makers and talking about what the technology actually is and what’s being done.

I’m only familiar with a handful of companies trying to use it right now. It’s a very small percentage of the market. As of right now, I don’t see that it will take off in any particular direction, but even if it does, those companies would still be subject to the DAA program. If they’re deploying device fingerprinting, they would have to match up the tech with the principles in order to comply. We’ll keep seeing evolution in that space, and Apple’s deprecation of UDIDs has companies looking elsewhere. But again, we want to talk about the policy and good practices, not the technology itself. The marketplace is moving so rapidly that if we focus on the specific technologies we’re going to be constantly reviewing the program.

I think there’s a pretty strong consensus now that that information can be pretty sensitive and has to be treated more like personally identifiable information. The next question is how exactly you treat it, though. There are also differences within geolocation itself. For example there are differences between one-time use and long-term use, so what should the notice and consent procedures be for each? I think we all agree that there has to be notice and consent around location data, but the biggest question is who controls that. Is it the operating system, the app or another party?

When you’re talking about self-regulation, you can never say victory and stop what you’re doing; it has to continuously improve. Regulators have really helped us shape our program to meet a lot of their concerns, but there’s always room for improvement, and the area will continue to evolve. I think we’re marching in time with the marketplace. If we’d have come out too quickly with a set of principles, we might not have addressed some of the issues correctly. I actually think we’re in a great position right now to both protect consumer choice and preserve innovation. The market is growing but still very nascent, and the fact is that a lot of the technologies that we read about do exist but aren’t really being put into practice.