Association of online publishers Helping media owners build better digital business

Online behavioural advertising: what you need to know

On 8 July, AOP hosted an event at Olswang's offices entitled Going Global: Monetising your International Audience. The event was attended by a high calibre audience comprised of digital media owners, and their partners in ad exchanges, optimisers and networks.

As media owners look to efficiently understand and monetise an array of distinct regional audiences around the world, one potential means of maximising revenue, for UK and non-UK inventory alike, is online behavioural advertising (OBA).

Olswang has been closely following the progress of OBA technologies in the UK. With some more controversial than others, the media spotlight has fallen particularly on Phorm's Webwise software.

What is Online Behavioural Advertising?

OBA is the process of analysing internet users' web-surfing habits to determine their interests. The data collected during this process can then be used to deliver highly-targeted advertisements that are tailored to the interests of the user.

To some, this delivers benefits across the board. Advertisers reach a more receptive market, consumers receive promotions that are of interest or of relevance to them and, as a consequence of increased responses to advertising appearing on their sites, online publishers' content receives a commensurate uplift in value. To others, however, OBA raises significant invasion of privacy issues.

There are a number of key players in the OBA market but the one to have hit the headlines is Phorm owing, in part, to the controversy surrounding British Telecom's ("BT") trial of Phorm's Webwise software on its customers in 2006 and 2007. Phorm works at an ISP level to monitor and collect information on internet users' viewing habits. This information would then be sold to advertisers to allow them to direct their advertising at particular users whose web use indicates an interest in the products or services being advertised.

The Consumer’s View

Recent studies would indicate that consumers are more willing to accept advertising if it means access to free content. According to the IAB, 85% of consumers would prefer to have access to free online content with advertising than to pay for ad-free content – the success of ad-funded music streaming service Spotify is a good example of this. In addition, 50% of the consumers who took part in the IAB survey indicated that they would prefer to receive targeted advertising which was relevant to them.

Despite BT's very public announcement that it has no immediate plans to use Phorm's technology, BT has said that "we continue to believe the interest-based advertising category offers major benefits for consumers and publishers alike." Indeed, Virgin Media is believed to still be considering working with Phorm, although it has said that no deal is imminent.

In Olswang’s view then it is likely that OBA will, in one shape or form, be implemented in the future, but what are the legal issues?


Tracking technology can offer considerable advantages to advertisers, but the complaints which BT's trial of Phorm's Webwise software on its customers in 2006 and 2007 attracted illustrate the concerns of privacy campaigners. Although Phorm has said that the data it collects is anonymised and cannot be traced to an individual, BT's trial sparked complaints from UK citizens and UK MEPs. These complaints resulted in the European Commission announcing, in April of this year, that it had opened infringement proceedings in the United Kingdom in relation to the implementation of the EU Directive on Privacy and Electronic Communications.

If OBA does get taken up in the UK, there are legal and regulatory issues of which ISPs, online publishers and advertisers will need to be aware.

Data Protection Legislation

In the UK, the collection of personal data and the processing of such data are governed by the Data Protection Act 1998 (the "Act"). The Act imposes obligations of fair and lawful processing and the obtaining of consent from the data subject is a pre-requisite before the data can be processed. The Act applies to both the online and offline collection and processing of data.

Consent is not defined in the Act but, under the EU Data Protection Directive (95/46/EC) which the Act implements, consent must be "freely given, specific and informed". The opt-out policies currently employed by Phorm arguably conflict with these requirements. Indeed, the Information Commissioner's position had been, until recently, that OBA technologies should operate on an opt-in basis. However, the introduction of the IAB Good Practice Principles (further described below) has seen a u-turn in this position.

In addition to their obligations under the Act, marketers using electronic means or who use cookies to collect information about visitors to their websites will also need to comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PEC Regulations") which require marketers to obtain the consent of the recipient prior to sending marketing communications and which limit the use of website cookies to obtain personal data.

As part of a review of the Privacy and Electronic Communications Directive at a European level, there is a proposal to amend the current provisions relating to cookies and other devices. This amendment would require websites to obtain consent from site users to the use of cookies in contrast with the existing provisions which only require information and an opportunity to refuse their storage and disable them to be given. However, the debate has taken a break until September so, for the time being, the PEC Regulations still stand in their current form.

IAB Good Practice Principles

The IAB launched good practice principles for OBA which will come into effect on 4 September 2009. Google, Microsoft Advertising, Phorm and Yahoo! are a few of the key players to have signed up to the principles so far. The aim of the three key principles – notice, user choice and education - is to provide consumers with transparency and greater choice in relation to OBA. A company using OBA must provide:

  1. A 'clear and unambiguous notice' to users that it is collecting data for this purpose
  2. a mechanism for users to opt-out
  3. information to users about OBA, the collection and use of data and how to opt-out

The self-regulatory guidelines are endorsed by the Information Commissioner (although privacy campaigners do not consider the principles to go far enough to protect consumers).


Despite the introduction of the IAB's principles, privacy campaigners are still concerned about the potential for misuse of data if OBA is adopted by ISPs. To date, the Information Commissioner is satisfied with Phorm's claims that it 'anonymises' the information it collects by tracking internet users' surfing habits so that the user cannot be identified.

The negative press surrounding OBA means that it will be a while yet before we see technology such as Phorm's Webwise software adopted into the mainstream (if at all). However, if and when we do, advertisers and online publishers alike should be prepared to take advantage of what could be a valuable new tool.

For further information about the issues raised in this article, please contact Anouska Spiers or Jamie McIntyre-Brown at Olswang LLP. Please also see the Datonomy blog for updates on this subject.

Read the IAB's Consumer Guide to Online Behavioural Advertising

Join the AOP group on LinkedIn - open for all Members to join
Subscribe to AOP's e-newsletter.