Business FAQ

Who is participating in the Canadian AdChoices program?

The list of participating companies in the AdChoices program can be viewed on this site and is updated frequently.

How do I know if the activities of my organization are covered by the principles?

The principles apply only to those entities engaged in online interest-based advertising (IBA). Not all online advertising is considered IBA.

While the principles are intended to apply broadly across a wide range of marketing and media entities, they focus on the three major types of entities that, working interdependently, deliver relevant advertising to specific computers or devices in ways that enrich the consumer online experience:

• First Parties: such as website publishers and operators;

• Third Parties: such as advertising networks and data companies (including DSPs, ad exchanges and data aggregators) and in some cases advertisers; and,

• Service Providers: such as any internet access provider (ISP), search engine, web toolbar, browser, or other service that enables the provider to have access to all or substantially all URLs accessed by its users and that in the course of its activities as such a provider, collects and uses such user data for IBA.

An entity’s actions are governed by the respective principles related to the particular role or roles it fulfills in collecting and using data for IBA purposes. Each function will be separately subject to the relevant provisions of the principles.

Please read the sections for First Parties, Third Parties and Service Providers to learn more about the specific responsibilities and requirements for each type of entity under the principles.

I represent a web publisher and there is IBA activity that occurs on my website. What do the principles indicate that I should do?

In this capacity, you are acting as a First Party. Please read the First Party responsibilities closely and comply with the requirements described in the principles.

I am engaged in collecting and using data for IBA purposes across multiple websites. What do the principles indicate that I should do?

In this capacity, you are acting as a Third Party. Examples of Third Parties are advertising networks, data companies (including ad exchanges and data aggregators) and in some cases advertisers.

Please read the Third Party responsibilities closely and comply with the requirements described in the principles.

The services that I provide enable me to have access to all or substantially all URLs accessed by my users and, in the course of my activities, I collect and use such user data for IBA purposes. What do the principles indicate that I should do?

In this capacity, you are acting as a Service Provider. Service Providers may provide internet access, search capabilities, web toolbars, internet browsers, desktop applications, software or other similar services.

Please read the Service Provider responsibilities closely and comply with the requirements described in the principles.

Do the principles provide requirements for Third Parties to provide consumers with choice with respect to IBA?

Yes, the principles state that a Third Party should provide consumers with the ability to exercise choice with respect to the collection and use of data for IBA purposes, and the disclosure of data to another entity for IBA purposes.

Please read the Third Party responsibilities closely and comply with the requirements described in the principles.

If an entity is collecting IBA data from a webpage, but not serving advertisements based on that data, is it still required to comply with the principles?

Yes. The principles define IBA as the practice of collecting and using data from a particular computer or device regarding web-viewing behaviours over time and across multiple websites. Even if that data is NOT currently being used for the purpose of targeting the delivery of advertisements, notice about the practice should be provided in accordance with the principles and the remainder of the requirements still apply.

Do the principles impose specific data security standards?

Yes. The principles require all entities to maintain appropriate physical, electronic and administrative safeguards to protect the data collected and used for IBA purposes from loss or theft or unauthorized access, disclosure, copying, use or modification. The principles also require all entities to retain data that is collected and used for IBA only as long as necessary to fulfill a legitimate business need, or as required by law.

The principles also set forth steps that a Service Provider must take to safeguard data. Please read the Service Provider responsibilities closely and comply with the requirements described in the principles.

Do the principles limit the collection of Sensitive Personal Information?

Yes. The principles place the following limitations on the collection of Sensitive Personal Information:

• Entities must not collect personal information for IBA purposes from children they have actual knowledge are under the age of 13 or from sites directed to children under the age of 13 for IBA purposes, or otherwise engage in IBA directed to children they have actual knowledge are under the age of 13, unless such collection and other treatment of personal information is in accordance with Canadian privacy legislation.

• Entities must not collect or use sensitive personal information for IBA purposes without consent, as required and otherwise in accordance with Canadian privacy legislation.

Do the principles provide for accountability and compliance mechanisms?

Yes. Ad Standards, an independent advertising self-regulatory body, monitors companies participating in the DAAC's self-regulatory program for compliance with the principles, and works cooperatively with our participants to effect compliance. Ad Standards also accepts and responds to complaints about practices that may not comply with the principles. Learn more about the accountability program.