Original at the Stanford Center for Internet and Society.
Jovanni Hernandez and Akshay Jagadeesh are the first authors of this study.
Responding to pressure from the Federal Trade Commission, in mid-2009 the largest advertising industry trade groups joined forces to develop a new self-regulatory program for behavioral advertising: the Digital Advertising Alliance (DAA). Like the parallel self-regulatory program for advertising networks, the Network Advertising Initiative (NAI), the DAA makes no promises about providing privacy choices: DAA members must only provide an opt out of seeing advertising that is based on tracking, not an opt out of tracking itself.1 As Chris Hoofnagle at Berkeley Law has noted on several occasions, the word “privacy” scarcely even appears in the DAA’s documents.
The centerpiece of the DAA self-regulatory program is “enhanced notice,” a common text and icon for linking a consumer to information about behavioral advertising and an opt out of behavioral targeting (again, not tracking). The initial proposal for “enhanced notice” was a large insert for third-party behavioral ads consisting of a “Power I” icon alongside descriptive phrases such as “Interest based ads” and “Why did I get this ad?”
In its final consensus form, “enhanced notice” consists of a small “Forward I” icon (aka the “Advertising Option Icon”) in or around a third-party behaviorally targeted ad and, in some cases, the text “AdChoices.”
“Enhanced notice” can also appear in the footer of a page.
Usability of an advertising choice mechanism, like any software feature, will be a key driver of adoption. We note that at no point did the DAA conduct testing to determine how “enhanced notice” compares in usability to alternative choice mechanism designs, such as an in-browser option.2 In fact, web browser Do Not Track features — which aren’t yet fully backed by industry or regulation — are already seeing significantly greater usage than the DAA’s “enhanced notice” (1, 2).
In recent press materials and congressional testimony members of the online advertising industry have touted that trillions of “enhanced notice” icons are being served. We conducted this study to empirically examine the DAA’s “enhanced notice” icons.3 For simplicity, and following convention in the privacy community, we refer to any iteration of the DAA’s icon-based program as “AdChoices.”
Methodology
We began with the Alexa list of top 500 U.S. websites as of August 4th, 2011. For each site on the list we manually inspected4 the homepage for third-party advertisements. We labeled content as a third-party ad if it appeared in a standard ad box size and was served by a third-party advertising network. For each third-party ad, we noted whether an AdChoices icon or text link was present. We also manually examined page footers for AdChoices icons and text. Please email if you would like to examine the screenshots from our study.5
Results
We identified 627 third-party ads. Only 62 (9.9%) included an AdChoices icon in or around the ad. And only 32 (5.1%) had an “AdChoices” text link. We found an AdChoices icon and text link in the footer of only 13 (2.6%) of the pages we examined.
Restricting our dataset to the 449 non-explicit, domestic websites in the Alexa U.S. top 500, we spotted 512 third-party ads. 58 (11.3%) had an AdChoices icon. 28 (5.5%) had an “AdChoices” text link. We identified the AdChoices icon and text in the footer of 13 pages (2.9%).
A full spreadsheet of results is available in Excel format.
Concluding Thoughts
We, and many other researchers, already had grave doubts about the AdChoices program’s efficacy. The icon is only approximately 13×13 pixels6 and nondescript. The accompanying text is in small font and reads, ambiguously, “AdChoices.” Now we learn that the icon rarely shows up and, half the time, doesn’t even include any text.
Beyond demonstrating shortcomings in the DAA’s AdChoices program, our findings also run contrary to two common claims from members of the online advertising industry: that the vast majority of third-party ads are behaviorally targeted7 and that the largest players in behavioral targeting have embraced the AdChoices icon (1, 2). Given our results, both claims cannot be true. We call upon the online advertising industry to share its statistics on what proportion of third-party ads are behaviorally targeted and what proportion of third-party ads bear an AdChoices icon.
[1] The NAI and DAA use slightly different language to describe their opt-out commitments. An attorney for Venable, DAA’s counsel, confirmed that there is no practical effect to the difference at a recent symposium at Yale Law School. The NAI is now a participant in the DAA consortium.
NAI: “Opt out of OBA [online behavioral advertising] means that a consumer is provided an opportunity to exercise a choice to disallow OBA . . . . [C]ollection of non-PII data regarding that consumer’s browser may only continue for non-OBA purposes . . . .” (emphasis added).
DAA: “A Third Party should provide consumers with the ability to exercise choice with respect to the collection and use of data for Online Behavioral Advertising purposes . . . .” (emphasis added).
[2] Research by McDonald and Cranor found that the NAI’s choice mechanism, which is built around an information page and an opt-out page much like the DAA’s, created substantial consumer confusion. A paper by the Future of Privacy Forum, an industry-funded advocacy group, found that the icon approach fell flat in conveying information about behavioral targeting (“substantial repetition and consumer education may be needed to improve [the icon’s] communication effectiveness over time”) and that the “Power I” icon and “AdChoice” text performed worse than an alternative icon and several alternative texts.
[3] This study is not an examination of legal compliance with the DAA self-regulatory program. The DAA’s formal third-party “enhanced notice” requirement is very lax, and can be satisfied by as little as a link to the DAA in the website’s privacy policy. For a study examining compliance with the DAA’s self-regulatory program, see “AdChoices? Compliance with Online Behavioral Advertising Notice and Choice Requirements” by Komanduri et al.
[4] As with any study that relies on manual labeling, there is a possibility we made labeling errors. At least two different researchers examined each page to minimize the possibility of mislabeling. Moreover, the proportions we are reporting are very robust against individual labeling errors owing to the size of the dataset.
[5] Because a number of the Alexa top websites contain explicit content, we are not able to publicly post our screenshot dataset.
[6] Compare to the smallest standard display ad size at 88×31 pixels.
[7] Industry metrics imply only a very small proportion of third-party advertising is behaviorally targeted. See “Do Not Track Is No Threat to Ad-Supported Businesses.”