European Industry SelfRegulatory Framework on
Data-Driven AdvertisingApril 2011

Introduction
The undersigned companies (the “Companies”) have developed
this European self-regulatory Framework (the “Framework”) for
Online Behavioural Advertising (“OBA”). The Framework lays
down a structure for codifying industry good practices andestablishes certain Principles to increase transparency and choice
for web users within the EU/EEA which are binding upon theCompanies and Associations. The associations listed at the endof this document (the “Associations”) have been working jointly
on this Framework and support its promotion across theadvertising ecosystem. The Principles contained herein areintended to apply consumer friendly standards to Online
Behavioural Advertising and the collection of online data in orderto facilitate the delivery of advertising based on the preferences
or interests of web users. It does not seek to regulate the contentof online advertisements nor does it regulate Ad Delivery (asdefined below).

The Framework does not apply to web viewing behaviour for aparticular web site or related web sites under Common Control.
The Framework applies across the Internet “ecosystem”. TheFramework has separate provisions for Web Site Operators, ThirdParties and providers of desktop application software thatengage in OBA. The Framework recognises that a Company may
conduct a number of different activities, and therefore theFramework recognises that different Principles and types ofnotice and consent may therefore be applicable to each different
activity.

Application of the Framework and thePrinciples
There are a number of differing laws which may apply to OBA,
particularly in cases where the data collected or processed relates
to an identified or identifiable natural personal and thereby
comprises personal data. The Principles assist and encourage
Companies to design into their systems and contracts aframework for compliance with applicable law as well as
establishing protections for areas that are un-regulated. Given
that the applicable law varies from country to country,
compliance with these Principles does not guarantee compliancewith any applicable law and is not a substitute for suchcompliance. These Principles provide direct benefits to web
users, in particular by standardising consumer notices on web
sites or within advertisements, and by creating simple
mechanisms for accepting or declining OBA, even thoughpersonal data is not implicated. Web users may make complaints
about incidents of suspected non-compliance with the Principles
against the Companies by following the procedures set out inthe Principles.
The Framework applies to OBA focusing on web viewing
behaviour over time and across multiple web domains not underCommon Control in order to create interest segments or toallocate such viewing behaviour against interest segments for thepurposes of delivering advertisements to and by that web user’s
interests and preferences.

iDefinitions
Ad Delivery

Explicit Consent

Ad Delivery is the delivery of online advertisements oradvertising-related services using Ad Reporting data. Ad Delivery
does not include the collection and use of Ad Reporting datawhen such data is used to deliver advertisements to a computeror device based on user preferences or interests inferred frominformation collected over time and across sites not underCommon Control.

Explicit Consent means an individual’s freely given specific andinformed explicit action in response to a clear andcomprehensible notice regarding the collection and use of data
for Online Behavioural Advertising purposes.

Ad Reporting
Ad Reporting is the logging of page views on a web site or thecollection or use of other information about a browser, operating
system, domain name, date and time of the viewing of the web
page or advertisement, and related information for purposes
including, but not limited to:lStatistical reporting in connection with the activity on a website(s);l Web analytics and analysis; andl Logging the number and type of ads served on a particular
web site(s).

Control
Control of an entity means that another entity (1) holds amajority of the voting rights in it, or (2) is a member of it andhas the right to appoint or remove a majority of its board ofdirectors, or (3) is a member of it and controls alone, pursuant
to an agreement with other members, a majority of the voting
rights in it, or (4) has placed obligations upon or otherwise
controls the policies or activities of it by way of a legally binding
contract, or (5) otherwise has the power to exercise a controllinginfluence over the management, policies or activities of it, and“Controlled” shall be construed accordingly.

Common Control
Entities or web sites under Common Control include ones which
Control, for example parent companies, are Controlled by, suchas subsidiaries, or are under common Control, such as groupcompanies. They also include entities that are under a writtenagreement to process data for the controlling entity or entities,
and do such processing only for and on behalf of that entity orentities and not for their own purposes or on their own behalf.

Online Behavioural Advertising (OBA)
Online Behavioural Advertising means the collection of data froma particular computer or device regarding web viewing
behaviours over time and across multiple web domains notunder Common Control for the purpose of using such data topredict web user preferences or interests to deliver online
advertising to that particular computer or device based on thepreferences or interests inferred from such web viewing
behaviours. Online Behavioural Advertising does not include theactivities of Web Site Operators, Ad Delivery or Ad Reporting, orcontextual advertising (e.g. advertising based on the content ofthe web page being visited, a consumer’s current visit to a web
page, or a search query).

OBA User Choice SiteA consumer focussed web site and education portal(www.youronlinechoices.eu), available in all official EU and theadditional EEA languages, that provides a mechanism for web
users to exercise their choice with respect to the collection anduse of data for Online Behavioural Advertising purposes by one
or more Third Parties or links to a mechanism permitting user
choice over Online Behavioural Advertising.

Third Party
An entity is a Third Party to the extent that it engages in Online
Behavioural Advertising on a web site or web sites other than aweb site or web sites it or a an entity under Common Controlowns or operates.

Web Site OperatorA Web Site Operator is the owner, controller or operator of theweb site with which the web user interacts.

Icon
An Icon is a visible web based object that contains a hyperlink tothe OBA User Choice Site or to the Third Party Notice describedin I.A.1.

ii

The Framework
Principle I.

Principle II.

NoticeUser choice over Online Behavioural Advertising

A. Third Party Notice1.

Third Party Privacy Notice—Third Parties should give clear
and comprehensible notice on their web sites describing
their Online Behavioural Advertising data collection and use
practices. Such notice should include clear descriptions of
the following:(a) Their identity and contact details;(b) The types of data collected and used for the purpose ofproviding OBA, including an indication or whether any datais “personal data” or “sensitive personal data” as defined by
the national implementation of Directive 95/46/EC;(c) The purpose or purposes for which OBA data is processed
and the recipients or categories of recipient not underCommon Control and to whom such data might bedisclosed;(d) An easy to use mechanism for exercising choice withregard to the collection and use of the data for OBA purposes
and to the transfer of such data to Third Parties for OBA;(e) The fact that the Company adheres to these Principles; andA. Each Third Party should make available a mechanism for web
users to exercise their choice with respect to the collection
and use of data for OBA purposes and the transfer of suchdata to Third Parties for OBA. Such choice should beavailable from the notice described in I.A.1 and via the OBA
User Choice Site.
B.

To the extent that Companies collect and use data via specifictechnologies or practices that are intended to harvest datafrom all or substantially all URLs traversed by a particular
computer or device across multiple web domains and use
such data for OBA, they should first obtain Explicit Consent.

C. Companies that have obtained Explicit Consent pursuant toII.B should provide an easy to use mechanism for web users
to withdraw their Explicit Consent to the collection and useof such data for OBA.

Principle III.
Data Security
A. Safeguards
Companies should maintain appropriate physical, electronic, andadministrative safeguards to protect the data collected and used
for Online Behavioural Advertising purposes.

(f) A link to the OBA User Choice Site.
2.

Third Party Enhanced Notice to Consumers(a) In addition to providing notice as described in A.1, ThirdParties should provide enhanced notice of the collection ofdata for OBA purposes via the Icon in or around theadvertisement; andB. Data Storage
Companies should retain data that is collected and used forOnline Behavioural Advertising only for as long as necessary tofulfil a legitimate business need, or as required by law.

Principle IV.
(b) Third Parties may provide notice via the Icon on the web
page where the data for OBA purposes is collected if there
is an arrangement with the Web Site Operator for theprovision of such notice.

B. Web Site Operator Notice
In addition to complying with applicable existing legal
obligations, when a Web Site Operator permits data to becollected from and used on a web site for OBA purposes by Third
Parties, the Web Site Operator should provide adequate
disclosure of this arrangement. The Web Site Operator does notneed to include such disclosure in instances where the Third
Party provides notice as described in I.A.2.

Sensitive Segmentation
A. Children’s segmentation
Companies agree not to create segments for OBA purposes thatare specifically designed to target children. For the purposes ofthis provision, ‘children’ refers to people age 12 and under.

B. Other Sensitive Segments
Any Company seeking to create or use such OBA segments
relying on use of sensitive personal data as defined under Article
8.1 of Directive 95/46/EC will obtain a web user’s Explicit
Consent, in accordance with applicable law, prior to engaging
in OBA using that information.
iii

The Framework
Principle V.
Education
Companies that engage in OBA should provide information to
inform individuals and businesses about OBA, including easily
accessible information about how data for OBA purposes isobtained, how it is used and how web user choice may be
exercised. This may include information in easy-to-understandlanguage and user-friendly format (such as online video).
Companies and Associations are encouraged to use a consistentor common resource for such educational information.

Principle VI.
Compliance and Enforcement Programmes
A. Applicability and Eligibility
This Framework is self-regulatory in nature and creates obligations
for any signatory Company that self-certifies compliance with
the Principles and obligations contained herein. Following theadoption of this Framework and the Icon each Company should
comply and self certify by 30 June 2012. Companies adopting
the Framework later than 1 January 2012 should comply and selfcertify within 6 months of adopting the Framework and the Icon.

B. Compliance and Self-certification
Self-certification of compliance shall be limited to thoserequirements applicable to each Company’s business model. In
the event that a single Company may be subject to multiple
obligations, self-certification must cover all such applicableprovisions. Self-certification of compliance with this Framework
does not exempt Companies from fulfilling their obligations
under applicable national laws.

C. Auditing of Self-certification
Companies that are subject to Principle II shall submit toindependent audits of their self-certification. Audits should be ofsufficient scope to review compliance of Companies engaging
in OBA in the EU and EEA Member States. Such independent
audits must demonstrate, at a minimum, the following attributes:a) Processes for individual and independent review ofCompany web sites for the purpose of validating compliancewith obligations under this Framework;b) Processes for automated or individualised periodic
monitoring of a statistically significant number of web sites
where objective evidence of compliance with Principles I andII in this Framework can be verified;c)

Processes for resolving identified areas of non-compliance directly with the signatory Company in atransparent manner and within a reasonable period of time;d) Publication of decisions in case of un-rectified noncompliance with any commitments made under thisFramework, as well as the findings of general goodcompliance, for one or multiple Companies that have selfcertified under this Framework.

D. Consumer Complaints Handling
Programmes under this Framework for complaints handling shall
include the following elements:a) Easily accessible mechanisms for complaints to be filed
directly to Companies;b) Transparent, easily recognisable and accessible
mechanisms for handling complaints through independent,
alternative dispute resolution mechanisms such as
advertising self-regulatory bodies;c) Coordination between Companies and alternative
dispute resolution mechanisms, including advertising selfregulatory bodies, to ensure that Companies engaged in
OBA are not unreasonably subject to multiple enforcement
mechanisms regarding compliance with the obligations ofthe Framework;d) Consumers filing complaints to a complaints handling
body, including advertising self-regulatory organisations
shall have access to a simple complaint handlingmechanisms in their local language;e) Publication of decisions in case of non-compliance withthe commitments under this Framework, including in thelanguage of the country where the complaint was firstlaunched.
In addition, Companies that are subject to this Principle shallcollaborate to make available the OBA User Choice Site.

E. Relationship between Compliance Programmes:
Administrators of relevant auditing and complianceprogrammes, including existing advertising self-regulatory
systems in the context of processing consumer complaints,should ensure effective coordination, including promoting acommon audit form within the EU and EEA Member States andwith other regions or countries such as the USA.
Administrators of relevant compliance programmes should also
coordinate to ensure transparency, consistency and coherenceof the implementation and enforcement across EU and EEA
Member States.

iv

The Framework
Principle VII.
Review
The undersigning Companies and Associations shall regularly review this Framework at least every 3 years in response to thedevelopment of OBA and business practices, and modify or add to the Framework as appropriate.

Participating companies
A list of all companies participating in the EU Self-Regulatory Programme on OBA, and thus adhering to the principles
laid out in this Framework, can be found at:
http://www.edaa.eu/participating-companies/or
http://www.youronlinechoices.eu/goodpractice.htmlv

CONTACTEDAA
26, Rue des Deux Églises
1000, Brussels
Email: info@edaa.eu
Call: +32 (0) 2 513 78 06

xi