Code of Conduct

The Network Advertising Initiative’s Code of Conduct is a set of self-regulatory principles that help guide NAI members’ approach to privacy and data governance in connection with the collection and use of data for Interest-Based Advertising (IBA). NAI members include ad networks, exchanges, platforms, creative optimization firms, yield optimization firms, sharing utilities and other technology providers.

NAI member companies generally collect data for Interest-Based Advertising that is not customarily regarded to be personally identifiable information (PII) and is not defined as such in the NAI Code. Nevertheless, the Code requires NAI members to provide notice and choice with respect to the data collected and utilized to offer Interest-Based Advertising. The Code also limits the types of data that member companies can use for Interest Based Advertising purposes, and imposes a host of substantive restrictions on member companies’ collection, use, and transfer of data used for Interest-Based Advertising.

In 2015, the NAI began enforcement of the 2015 Update to the Code of Conduct, which addressed member company practices on mobile device web browsers. The NAI began enforcement of the 2015 Update to the Mobile Application Code, which addresses the collection and use of data on mobile applications for Tailored Advertising purposes in 2016.

In 2017, the NAI combined the 2015 Update to the Code of Conduct with the 2015 Update to the Mobile Application Code, merging those two documents into the 2018 Code of Conduct. It went into enforcement on January 1, 2018.

In a major Code revision for 2020, the NAI streamlined these prior Code updates for the 2020 Code of Conduct. The Code expanded the definition of Tailored Advertising to include Audience-Matched Advertising, it incorporated the Guidance for NAI Members: Viewed Content Advertising, and it now requires Opt-In Consent for additional uses of Sensitive Information and Precise Location Information among others. The 2020 Code went into enforcement on January 1, 2020.

The commentary to the NAI Code of Conduct was added for two principal reasons: 1) to provide additional information to explain the intent of the Code, and 2) to offer non-binding, illustrative guidance on ways to comply with the NAI Code. Information in the commentary is not intended to be either exhaustive or exclusive. In fact, this is made clear in the Code Commentary section, which states:

The purpose of the commentary is not to add substantive obligations on member companies or to alter the principles set forth in the Code itself. Instead, the commentary’s purpose is to explain the intent behind certain provisions of the Code. The commentary is also intended to provide examples of possible measures member companies may take to meet the substantive obligations of the Code.

We recognize that members hear conflicting views from regulators and privacy advocates on what to include in privacy policies. On the one hand, a common criticism we hear from regulators and advocates is that privacy policies are too long and detailed, too “legalistic,” and that consumers don’t read them. On the other hand, regulators, advocates and class action lawyers have filed complaints, enforcement actions or lawsuits charging that privacy policies lack adequate detail. This creates an obvious Catch-22 for industry. As data collection becomes more complex, finding a way to balance the pressure for more and more detailed disclosures with countervailing pressures for simplified privacy statements is an increasing challenge.

The NAI position is that notices should generally describe a member company’s data collection, use, disclosure and practices. NAI Code sets forth what descriptions and notice the NAI expects in a member’s privacy policy or privacy disclosure including, for instance, a description of Interest-Based Advertising activities undertaken by the member company and the types of data collected or used for Interest-Based Advertising. There is no “one size fits all” answer or template that NAI uses when evaluating a member’s privacy policy, since members engage in different practices and activities.

The Commentary also suggests that members should describe their data collection and use practices in as clear and concise a manner as possible, and to disclose technologies used for Interest-Based Advertising and Ad Delivery and Reporting. However, NAI recognizes that it is important to strike the balance between conciseness and thoroughness.

Therefore, during the Code compliance review process, NAI staff will carefully review the member’s privacy policy, in conjunction with responses to the annual compliance review questionnaire, and will provide input from the NAI perspective about the level of detail that NAI staff believes is necessary to meet the notice requirements of the NAI Code. Again, the NAI cannot offer legal advice and compliance with the NAI Code does not necessarily assure compliance with all applicable regulations. Nor does compliance with the NAI Code indicate how other stakeholders might interpret the level of required disclosure in a member’s privacy policy in any given instance.

Technological changes involving digital activities are occurring at a dizzying rate. One of the strengths of self-regulation is that our system is nimble and flexible, and allows us to respond more quickly than regulation or legislation to those changes through our code update process. This involves a constant evaluation of changes, consideration by our Board and members of how our principles should be applied to new technologies, new uses and new situations, and also allows us to tap into our members’ expertise in developing possible updates. Our ability to consider member input that reflects application of general principles, as well as practical operational considerations, is what allows our Code to enjoy such strong support from members. Where there are evolving developments, we need time to gain some practical experience to be sure that we making the right sort of recommendations when we update the Code.

The NAI Code is a self-regulatory code. Only the NAI staff is authorized to interpret the requirements of the NAI Code and to enforce the NAI Code. Where NAI staff determines that there is an instance of non-compliance with the Code by a member, and a member refuses to implement the recommended steps to bring its practices into compliance, the NAI enforcement procedures allow NAI to refer the matter to the Federal Trade Commission (FTC). The referral is based on a theory that the member committed to adhere to the requirements of the NAI Code and failed to do so. In making such a referral, NAI does not ask the FTC to interpret its Code, but simply to address the member’s failure to comply with NAI’s interpretation and application of the NAI Code.