On 4 February 2013 the Committee of Advertising Practice (CAP) Code changed and now covers some forms of Online Behavioural Advertising (OBA).  The aim of the changes is to try to secure greater transparency and consumer control over OBA whilst allowing OBA to flourish to the benefit of both consumers and the advertising industry. In the first of what we hope will be a succession of guest blogs, Suzy Weeks digests the new rules and guidance.

It is important to understand, at the outset, that the new rules apply to third parties (defined in the new rules as organisations that engage in OBA via websites other than those that they control, own or operate) and do not apply to the collection and use of information for OBA by website operators on their own websites.  Third parties will have to consider how they can still cleverly target consumers and still stay within the self regulatory framework.

What is OBA?

Have you ever browsed a website for a particular product or type of product, then gone to a different website and noticed adverts for the products you were just looking at? In a nutshell that is OBA.  Various technological methods can be employed to look at your browsing history and categorise your interests (into an “interest segment”) and a cookie is then placed on your computer telling third parties what type of adverts to show you.

Why has the CAP Code changed?

OBA raises both data protection and privacy concerns; technology allows advertising network providers (i.e. the third parties) to track an individual’s behavior across the web, creating a highly specific profile of that individual for marketing purposes. OBA is fuelled by tracking cookies and similar technologies and can also be done at an Internet Service Provider (ISP) level. The issue is that, in most cases, individuals are unaware that this is happening.

Ofcom research carried out earlier this year found that nearly half of internet users were “not very”, or “not at all” comfortable with OBA.  However, research by Internet Advertising Bureau UK (IAM UK) and ValueClick has shown that once OBA is explained to consumers they are more likely to want to receive it, particularly if they are able to have more control over it.

According to CAP’s November 2012 Online Behavioural Advertising Regulatory Statement:

“The… new remit will enhance the protection it offers consumers and the industry in the digital space and help ensure that all advertising is legal, decent, honest and truthful, however it might be experienced by, or targeted at, consumers”.

The ASA has made it clear that the new regime is not designed to deliver compliance with all privacy and data protection law; the rules will operate separately and in parallel with relevant legal control systems

What are the new rules?

The new rules require OBA networks to do the following things.

On their own website(s):

  • Give a clear and comprehensive notice about the collection and use of web viewing behaviour data for the purposes of OBA on their own website, including how a web user can opt out from having web viewing behaviour data collected and used for this purpose.  The notice should also link to a mechanism that allows the consumer to opt out of the collection and use of web viewing behaviour data for OBA purposes by that network or that network and other third party networks.

On the advert delivered using OBA:

  • Give a clear and comprehensive notice that they are collecting and using web viewing behaviour data for the purposes of OBA, in or around the display advertisement. The notice should link to a mechanism whereby a web user can opt out of the collection and use of web viewing behaviour data for OBA purposes by that network or that network and other third party networks.


  • Do not create “interest segments” specifically designed for the purpose of targeting OBA to children aged 12 or under.
  • Obtain prior explicit consent from web users to the use of technology to collect and use information about all or substantially all websites that are visited by web users on a particular computer in order to deliver OBA to that computer. The way CAP have drafted the relevant “help note” on this rule seems to indicate that they are focusing their attention on deep packet inspection rather than use of cookies (about which there are the separate “new cookie laws”). That said, CAP have not tied their hands on this point and could interpret the rules more widely. In our view, if read to apply to cookies, opt-in consent would be the only practicable means of compliance, which would be highly damaging to user experience and cut across the ICO’s UK guidance on the new cookie laws for which implied (not explicit!) consent is acceptable. In short, the cookie landscape just became even more complicated and confusing!

Are there any exclusions from the new rules?

The new rules do not cover:

  • The collection and use of information for OBA by website operators on their own websites.
  • Contextual advertising
  • Web analytics
  • Ad reporting or ad delivery
  • The use of OBA in rich media, in-stream videos online or on mobile devices.  However, it is envisaged that the rules will be extended to mobile devices in due course.

An international element to the new rules

The CAP Code rules form part of a wider European picture on self regulation for OBA and are intergral to the European Advertising Standards Alliance European “Best Practice Recommendation”, which aims to provide a pan-European, industry-wide, self-regulated standard for OBA.  Similar rules will be incorporated into advertising codes across Europe.

In addition to the Best Practice Recommendation, IAB Europe (an industry body representing over 5,500 organisations) produced an EU Framework for OBA which is administered by European Interactive Digital Advertising Alliance (EDAA).  Signatory companies can use a single icon in or around display advertisements in order to provide a notice to users and a link to a website called, where users will have the choice to opt out of OBA.  Signatories can also obtain a trading seal if they have undergone the independent certification process with an EDAA approved independent certification provider, helping to increase consumer trust in their brand. According to the IAB UK website, in the UK, 95% of businesses serving behavioural or interest-based adverts are already participating in the EU self-regulatory initiative, currently the highest in all EU markets.

The CAP Code rules therefore plug in to an existing move towards trying to secure greater transparency and consumer control (and therefore confidence) over OBA through self regulation.


In the UK, CAP writes and maintains the UK advertising codes, and the ASA enforces them.  ASA enforcement can range from attempting to work in co-operation with the offending party, to carrying out formal investigations which may lead to adjudication and finally public naming and shaming by way of publishing adjudication decisions on the ASA website.  

In some cases where the third party continues to breach the rules, the compliance teams may pursue other measures to encourage the third party to comply with the CAP Code. This could involve bringing the third party’s non-compliance to the attention of potential clients and partners. For signatories to the IAB Europe EU Framework, the CAP compliance team will also be able to remove the trading seal of approval, as well as remove the licence to use the single icon referred to above.

CAP will review the new rules and their effect after 12 months to check they are still necessary and proportionate.

What does it mean for me?

If you are a third party and you are not yet compliant, you now need to look into your options for getting compliant and choose what works for you.

If you are a website owner you will need to check what measures your OBA providers and advertising providers have in place to ensure they comply with these requirements.  These checks should form part of your routine due diligence to ensure you and your website stays reputable.

This information is intended as a general discussion surrounding the topics covered and is for guidance purposes only. It does not constitute legal advice and should not be regarded as a substitute for taking legal advice. DWF is not responsible for any activity undertaken based on this information.