Self-regulation and privacy regulation
The regulatory environment for the collection and use of consumer data by advertising networks, advertisers, and publishers is very unsettled in Europe, the United States and internationally.
The United States and foreign governments have enacted, considered or are considering legislation or regulations that could significantly restrict industry participants' ability to collect, augment, analyze, use and share anonymous data, such as by regulating the level of consumer notice and consent required before a company can place cookies or other tracking technologies. A number of existing bills are pending in the U.S. Congress that contain provisions that would regulate how companies can use cookies and other tracking technologies to collect and utilize user information.
In addition to compliance with government regulations, we voluntarily participate in several trade associations and industry self-regulatory groups that promulgate best practices or codes of conduct relating to targeted advertising. For example, the Internet Advertising Bureau EU & US, the Network Advertising Initiative and the Digital Advertising Alliance, have developed and implemented guidance for companies to provide notice and choice to users regarding targeted advertising. There is ongoing debate about whether the current guidance and approaches by such associations and industry groups complies with EU law. For example, on December 28, 2011, the Article 29 Working Group published an opinion stating that the self-regulatory code was not adequate to comply with Article 5.3 of the amended E-Privacy Directive addressing placement and reading of cookies for targeted advertising. We could be adversely affected by changes to these guidelines and codes in ways that are inconsistent with our practices or the practices of our publishers and advertisers or in conflict with the laws and regulations of the EU, United States or other international regulatory authorities.
These existing and proposed laws, regulations and industry standards can be costly to comply with and can delay or impede the development of new products, result in negative publicity and reputational harm, increase our operating costs, require significant management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices.
Privacy risks relating to our clients' actions or inactions
On behalf of certain of our clients using some of our services, we collect and store information derived from the activities of website visitors and their devices. This enables us to provide such clients with reports on information from and about the visitors to their websites in the manner specifically directed by each such individual client and to conduct targeted advertising. Federal, state and foreign governments and agencies have adopted or are considering adopting laws regarding the passive collection, use, sharing and storage of data collected from or about users' or their devices. Any perception of our practices or products as an invasion of privacy, whether or not such practices or products are consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm or claims by regulators, which could disrupt our business and expose us to increased liability.
Our compliance with privacy laws and regulations and our reputation among the public body of website visitors depend in part on our clients' adherence to privacy laws and regulations and their use of our services in ways consistent with visitors' expectations. We contractually require our clients to notify visitors to their websites about our services (i.e., that we place cookies and collect and share certain non-identifying data for purposes of targeting advertisements), and further require that they link to pages where visitors can opt-out of the collection or targeting. We rely on representations made to us by clients that they will comply with all applicable laws including all relevant privacy and data protection regulations. We make reasonable efforts to enforce contractual notice requirements but do not fully audit our clients' compliance with our recommended disclosures or their adherence to privacy laws and regulations, nor do we contractually require them to seek explicit consent to the placement of cookies which may be required in certain countries. If our clients fail to adhere to our contracts in this regard, or a court or governmental agency determines that we have not adequately, accurately or completely described our own products, services and data collection, use and sharing practices in our own disclosures to consumers, or if explicit consent was required, then we, and our clients, may be subject to potentially adverse publicity, damages and related possible investigation or other regulatory activity in connection with our privacy practices or those of our clients.