Client Alert: Online and Mobile Tracking Company Settles FTC Charges It Deceptively Tracked Consumers
On December 20, 2016, the Federal Trade Commission (FTC) announced that Turn, Inc. (Turn) has agreed to settle charges that it deceived consumers by tracking them online and in mobile apps, even after consumers attempted to opt-out of such tracking. The charges stem from Turn’s former partnership with Verizon Wireless (Verizon) and its use of Verizon’s mobile device identifier.
Turn is a large digital advertising company that advertises itself as the “largest independent company in the advertising technology sector and the recognized leader in platform-based mobile, video, display, and Facebook advertising.” Like other digital advertising companies, Turn uses “cookies” and “web beacons” to track consumer’s web browsers across the Internet, but also uses unique device advertising identifiers to track consumers across mobile applications (Apps) since many Apps cannot set or access browser cookies. The information collected by Turn helps its clients target advertisements to people based on their tastes and interests.
Beginning in 2013, Turn began participating in a program offered by Verizon that enabled Turn and its clients to access certain demographic information provided by Verizon about Verizon’s users. Verizon created unique tracking headers so that it and participating companies like Turn could uniquely identify each Verizon user, and Verizon injected these tracking headers into all unencrypted Web requests for more than 100 million consumers on the Verizon data network. Verizon users, however, had no means to prevent the transmission of the tracking header.
From February 2013 to January 2015, Turn synced Verizon’s tracking header with other identifiers, including cookies and device advertising identifiers. This enabled Turn to continuously track Verizon consumers, even after opting-out, by maintaining a linkage between the consumer’s browser or device and an identifier associated with behavioral, demographic, or tracking data. Turn was therefore able to recognize a user by cross-referencing the unique tracking header associated with his or her device, even if the consumer deleted cookies, reset the device advertising identifier, or both. Moreover, Turn sometimes used the Verizon tracking header to recreate cookies that people had previously deleted.
Turn posted a privacy policy on its website that was applicable to both ads displayed on browsers and within Apps. This privacy policy, however, only disclosed usage of two tracking technologies – cookies and web beacons – and indicated that consumers could prevent Turn’s tracking (and stop targeted advertising) by blocking or otherwise limiting cookies. Despite its representation that consumers prevent tracking, for example, by instructing their browser to “stop accepting cookies,” the FTC alleged that Turn continued to track certain consumers using the unique Verizon tracking headers. Moreover, Turn provided an opt-out mechanism on its website and represented that such mechanism would be effective in blocking tailored ads on websites and mobile Apps. The FTC alleged, however, that the opt-out mechanism applied only to browsers, and was not effective in blocking tailored advertisements on mobile Apps.
Accordingly, the FTC alleged in its complaint that Turn acted deceptively by representing that (1) blocking or limiting cookies would restrict Turn’s ability to track consumers and (2) consumers could opt out of tailored advertising on Apps through Turn’s opt-out mechanism. Turn and the FTC agreed to settle these charges.
The FTC’s proposed consent order prohibits Turn from misrepresenting the extent of its online tracking or the ability of users to limit or control the company’s use of their data. Turn is also required to provide an effective opt out mechanism for consumers who do not want their information used for targeted advertising, and must prominently post on its home page a hyperlink that directs consumers to a disclosure explaining the information Turn collects and uses for targeted advertising. Turn has since published a statement on its website indicating that it has been working to rectify this situation since early 2015, when it terminated its partnership with Verizon and ceased using the device advertising identifier.
This settlement comes on the heels of the Digital Advertising Alliance’s (DAA) announcement that enforcement of its cross-device tracking guidance, the Application of the DAA Principles of Transparency and Control to Data Used Across Devices, will begin February 1, 2017.
If you (or your vendors) are engaged in cross-device tracking, both the FTC and industry guidance have made clear that they expect consumers to be provided with accurate and non-misleading notice and choice about your tracking practices. For questions on cross-device tracking or privacy policies, please contact Heather Enlow-Novitsky, Scott Guttman or your Vorys attorney.
