Third Parties

If you have identified yourself as a Third Party, it means that you engage in online interest-based advertising (IBA) on a First Party’s website. This guidance for Third Parties is directed primarily to advertising networks and data companies that collect web-viewing or app data across multiple sites and/or apps and use such data to serve online interest-based advertising.

An advertiser (i.e. a company whose product or service is being promoted in an advertisement) may also be a Third Party, if it engages in data collection and use for online interest-based advertising. However, if the advertiser uses an ad network/exchange/DSP or other entity to collect data for IBA purposes, and that entity does NOT provide such data to the advertiser for its independent use, the advertiser is not a Third Party and not subject to the principles in that capacity.

Third Parties shall provide notice on their websites describing their IBA data collection, use, and disclosure practices. Such notice shall include clear descriptions of the following:

  • The types of data collected online for IBA purposes, including any personal information;

  • The uses of such data, including whether the data will be transferred or disclosed to another entity for IBA purposes;

  • An easy to use mechanism for exercising choice with respect to the collection and use of the data for IBA purposes, or disclosure of such data to another entity for such purposes; and

  • The fact that the company adheres to the DAAC principles.


Below is a more detailed explanation of each of the requirements for Third Parties.

1. Ensuring Transparency

The principles assign responsibility for consumer transparency and control concerning IBA practices to Third Parties. The entity collecting the data for IBA purposes is responsible for complying with this aspect of the principles.

In addition to providing notice on your website as described in the principles, Third Parties shall:

  • Provide notice of the collection of data for IBA purposes via the icon that links to a notice described in the principles, in or around the advertisement;

  • Provide notice via the icon that links to a notice described in the principles on the webpage where the data for IBA purposes is collected if there is an arrangement with the First Party for the provision of such notice; and

  • Be individually listed on the IBA consumer choice page; or, if agreed to by the First Party, in the notice on the webpage where data is collected for IBA purposes.

In all cases, the enhanced notice must be clear, meaningful, and prominent. For example, providing notice hidden in lengthy terms & conditions does NOT satisfy the requirement to provide clear, meaningful, and prominent notice.

2. Providing Choice

You should provide consumers with the ability to exercise choice with respect to the collection and use of data for IBA purposes, and the disclosure of this data to other entities. An example of a mechanism that would satisfy the choice requirement is one that allows a user to stop the collection and use of data for IBA purposes.

In all cases, the choice mechanism should be easy to use.

You should provide consumers with a choice mechanism in at least one of three locations:

  • In the notice on your website regarding IBA practices linked to by a notice link placed “in” or “around” the advertisement or elsewhere on the page with agreement from the First Party;

  • From your listing on youradchoices.ca/choices; or,

  • In instances where you are individually listed in the First Party’s notice on the webpage where IBA data is collected, your choice mechanism should be available in the notice information on your website linked to from the First Party’s listing.

3. Maintaining Data Security

You should maintain appropriate physical, electronic, and administrative safeguards to protect the data collected and used for IBA purposes.

You should retain data that is collected and used for IBA only as long as necessary to fulfill a legitimate business need, or as required by law.

4. Refraining from the Collection of Sensitive Information

Companies shall not collect sensitive information for IBA purposes from children they have actual knowledge are under the age of 13, or from sites directed to children under the age of 13 for IBA, or otherwise engage in IBA directed to children they have actual knowledge are under the age of 13, unless such collection and other treatment of personal information is in accordance with Canadian privacy legislation.

Companies shall not collect, use or disclose sensitive personal information for IBA purposes without consent, as required under and otherwise in accordance with applicable Canadian privacy legislation.

 

A Note About First Parties

If your company also operates a website or app and/or exercises control over a website or app, then you may also be a First Party and you should also comply with the First Party responsibilities.