Online behavioural advertising and its principal legal implications in Brazil
Back to Litigation Committee publications
Carla Cavalheiro Arantes
Pinheiro Neto Advogados, São Paulo
ccavalheiro@pn.com.br
Introduction
The advent of mass consumerism has profoundly modified the way of life, behaviour, and aspirations of a large proportion of the global population in a short period of time, truly revolutionising and shifting free market economies.
However, even before the various areas of study and even the law itself could understand the entirety of the impact of this new way of life, technological development allowed the creation of the internet, revolutionising the telecoms sector AND pushing the world into the Information Age.
This Information Age represents a new level of societal development, in which information acquires the status of merchandise. It becomes a primary asset and a determining factor for economic and social development. In light of this transformation, mass consumerism and advertising itself become intertwined with the online world.
This article will outline the concept and the operation of online behavioural advertising, its primary legal implications and the parameters that can be observed by suppliers to mitigate the risk of questioning the practice in Brazil.
Online behavioural advertising, its operation and major legal implications in Brazil
Inemphasising the importance of commercial practices in a consumer society, the Justice of the Brazilian Superior Court of Justice (STJ), Mr Antônio Herman de Vasconcellos e Benjamin, stated that mass society is inserted in a diffuse and collective context, and the personal society ‘in which consumer and supplier are old acquaintances’[1] disappears or loses importance.
Not that long ago, consumers were not identified by suppliers. At that not so remote time, television and radio were the main means of communication to the mass consumer market, which did not enable much interactivity or exchange of information with the public. Consumers’ purchases were mostly made in cash, which allowed for anonymity. Their tastes, preferences and needs were known and shared only, and at most, with their family and close friends.
Today, the internet, e-commerce and social networks compete with traditional media and the ‘offline world’, providing the network user with a faster, easier and more interactive existence, with much more information but much less privacy. The use of credit cards has largely replaced cash purchases, thereby identifying consumers and mapping their purchasing habits. E-commerce, and almost all user’s internet browsing habits produce a rich database of consumer preferences, which is collected, analysed, processed and stored by a number of different companies and segments.
The rise of the internet and development of several other Information Age technological tools has facilitated and improved the process of collecting, storing and cross-referencing data. Suppliers are able to obtain information about consumer choices, experiences and characteristics through data generated by several of an individual’s interactions with the network.
As a result, consumers who were previously overlooked as being part of the mass consumer market, receiving mass and standard advertising, are now becoming more customised, targeted with online behavioural advertising based on their specific consumer profile. Online behavioural advertising, therefore, presupposes that the data stored about individuals will be consulted and used to advertise products and services in which consumers have already shown interest, to which they have a connection through their consumer profile, therefore making advertising much more assertive and effective.
Online behavioural advertising mainly occurs in two ways online. The first, which uses a more modest technology, effects the individual’s legal sphere in a less complex way and takes place when consumers log on to a particular supplier’s website or application.
Through this format, by identifying consumers on its platform, the supplier can retrieve their purchase history or check the products and services that would fit their profile and, based on this information, advertise products and/or services on its platform that may be of interest to them.
In such cases, advertising targeted at users based on their purchasing habits will usually only be made available if consumers choose to identify themselves on supplier’s website or application, by logging in. In this case, a consumer's purchase history with that specific supplier will be the database used to target advertising.
The most sensitive aspect of this way of collecting data for advertising purposes, is that in many cases consumers are not adequately informed: (i) that the data and information will be collected and stored by suppliers (purchase history, products researched); and (ii) how such data will be used by suppliers.
The second way to conduct online behavioural advertising uses more complex technology and monitors users’ browsing through the web, bringing more relevant effects to consumers’ legal sphere, particularly to their privacy and their right to information. This is because, through a technique known as remarketing or retargeting, a technology tool is installed on the users’ computer to tag and identify the consumers who visited the website of a particular supplier or who have searched for specific products or services online.[2]
Consequently the supplier contracting the remarketing service may advertise on other websites or social networks visited by the consumer who has already shown an interest in its products, services or subjects related to the commercial activity performed by the supplier.
Cookies are the technological tool commonly used to monitor users’ browsing history. These are small packets of data sent by websites to be stored on consumers’ computer or mobile device and work as shown in the illustration.[3]
This way of collecting data for online behavioural advertising purpose is often conducted without transparency or information to consumers on the installation of cookies or other tools that monitor their browsing. This is one of the main issues of online behavioural advertising through the remarketing technique.
Based on the above, it becomes quite evident that the idea of anonymity in mass markets has become a thing of the past. In the present state of technology, suppliers not only know who their consumers are but also are keenly aware of their consumer habits and preferences. The advertising used by the suppliers thereby becomes very much targeted to the profile of their potential consumers and increases the odds of completing the sale for an advertised product or service.
This new internet advertising practice based on consumer data represents a shifting in the pattern of marketing activities. From the perspective of Brazil’s legislation, all these innovations represent a great challenge as it is left to lawmakers and law enforcement authorities to elaborate on alternatives and solutions to protect consumers and their privacy, while aligning this need with economic and technological development.
The legality of online behavioural advertising and mitigating mechanisms
In Brazil, the importance of advertising activities in a consumer society and their legitimacy are addressed and endorsed by the Federal Constitution, respecting not only freedom of enterprise, but also freedom of expression.
Freedom of enterprise constitutes an economic policy principle and a fundamental right in Brazil, as set out in the Federal Constitution. According to this constitutional principle, no authority can create restrictions or hindrances for private persons to develop their business activities fully, or otherwise impose duties or requirements for their exercise, other than pursuant to law. But, the constitutional right to freedom of enterprise is not absolute, as there must be a law to prohibit or restrict certain market practices.
Advertising is also protected by the principle of freedom of expression set out in the Federal Constitution. It does not admit censure but may be restricted and regulated by law.
Therefore, as a rule advertising is a lawful commercial activity protected by both freedom of enterprise and freedom of expression enshrined in the Federal Constitution. Online behavioural advertising is an advertising practice targeting an individual’s consumer profile. Although online behavioural advertising may bring implications for consumer privacy and their right to information, this practice in itself cannot be punished by law, under penalty of violating the principles of freedom of enterprise and freedom of expression.
Accordingly, based on the legality principle set out in the Federal Constitution, which establishes that ‘no one shall be required to act or refrain from acting as regards anything except by virtue of the law’, the logical conclusion is that online behavioural advertising is permitted because there is no law expressly prohibiting such a practice.
The fact that online behavioural advertising is lawful, as a rule, does not prevent this practice, in some situations, from being deemed abusive or unlawful if it violates other legal provisions. In this aspect, it is important to mention that the Federal Constitution established the individual’s essential right to privacy in its Article 5, X, and set out, in the same Article, item XXXII that ‘the State shall provide, pursuant to law, the consumer protection.’
Therefore, on the one hand, online behavioural or non-behavioural advertising must be protected in view of the constitutional rights of freedom of enterprise and freedom of expression, but on the other, the constitutional rights of privacy and consumer protection must also be upheld.
In the context of the Information Age and of online behavioural advertising, the right to privacy is intrinsically connected with the discussion on the protection of consumers’ personal data and the creation of databases containing information about them.
A problem exists relating to the collection and use of consumer data that may affect their privacy, which is aggravated by the lack of consumer information on the existence of the practice and the way in which this technology works, including the promotion of online behavioural advertising. Likewise, one can see that the event that generates a potential violation of consumers’ privacy or right to information is not online behavioural advertising itself, but the way in which consumer data is collected for advertising purposes.
Therefore, although it is recognised that depending on how consumers’ data is collected and used, there may be abuse in the practice of online behavioural advertising, this is not in line with the extreme belief that online behavioural advertising and the way of collecting data are entirely unlawful practices.
This is the case because the purpose of Brazil’s law is not to ban advertising, since it represents an essential activity to the very existence of consumer society, but to establish minimum parameters guaranteeing consumer protection and the respect of the freedom of enterprise.
In order to respect consumer privacy in Brazil, obtaining consumers’ consent is indispensable. Their information may be collected by third parties, pursuant to: (i) Article 7, I,[4] of the Law No 13,709/2018[5] (General Data Protection Law); and (ii) the understanding has been adopted by court precedents[6] when dealing with the right to privacy relating to the internet.
In all aspects regarding information, consumers must consent in a conscientious and free manner. Information must be provided to them beforehand in a clear and adequate way, and in Portuguese, about: (i) the collecting of their data; (ii) what data will be collected (record details, personal, sensitive); (iii) how the data will be collected (filling in record data, cookies, access to public database, access to public information regarding consumers, access to information existing on social networks, etc); and (iv) the objective of collecting the data.
Therefore, in light of the provisions stated in Articles 6, III[7] and 31[8] of Brazilian Consumer Defence Code (CDC), article 7, VIII[9] of the Law No 12,965/2014 (Internet Legal Framework) and Article 8, paragraph 4,[10] of the General Data Protection Law, in order to use the data collected from Brazilian consumers for online behavioural advertising, it is mandatory that the said objective be expressly declared in the terms and conditions and/or privacy policies and that the consumer declares their full consent with the contractual instruments. Failure to do so would deem such online behavioural advertising based on the data supplied as unlawful.
Furthermore, the provisions of Article 54, paragraphs 3 and 4[11] of CDC, state that all terms and conditions and/or privacy policy clauses that deal with the collection of personal data, the way in which such data is collected, and the objective of the data collection shall be prominently displayed in text no smaller than font size 12. In electronic contracts, suppliers must make the contract summary available for prior consultation, in which the above mentioned clauses shall be prominent, according to the terms of Article 4, I,[12] of Decree No 7,962/2013.
It is also worth mentioning that according to the provisions set out in Article 7, IX[13] of the Internet Legal Framework and Article 8, paragraph 1,[14] of the General Data Protection Law, the consent as dealt with in the above-mentioned clauses shall be expressed and given separately from the other contractual clauses. Therefore, it is necessary for suppliers to obtain a separate form of consent from consumers regarding the collection and use of their personal data for the objective of conducting online behavioural advertising. Failure to do so, depending on the characteristics of the concrete case, may invalidate said consent thereby making the supplier fully liable for improper use of personal data.
Finally, regarding cookie use, it is the responsibility of the supplier to explain how they are used in its terms and conditions and/or privacy policy, and to obtain consumer consent to install this tool jointly with the other contractual clauses. However, in cases where cookies are installed independently of the existence of a relationship between supplier and consumer (ie, when no terms and conditions and/or privacy policy has been previously made available to the user and duly agreed), the supplier is only authorised to install the tool if consumers are informed of the existence of cookies and only on the consumers’ express consent.
Conclusion
In light of the above and considering the perspective of Brazilian law, the most appropriate legal solution to online behavioural advertising is one which aligns consumer protection and economic and social development, based on the premise that online behavioural advertising is a lawful practice. It must, however, observe certain consumer protection rules when such data is collected and used.
Therefore, in general: (i) consumers’ privacy will not be deemed violated when consumers authorise collection of their data for online behavioural advertising purposes; and (ii) consumers’ right to information will be deemed respected when suppliers provide clear and appropriate information regarding their commercial practices.
Notes
[1] Ada Pellegrini Grinover et al, Código brasileiro de defesa do consumidor: comentado pelos autores do anteprojeto, 11 edn, Rio de Janeiro: Forense, 2017, p 262.
[2] Academia do Marketing news, available at: www.academiadomarketing.com.br/o-que-e-remarketing/, last accessed 4 June 2020.
[3] Picture credit: www.higher-education-marketing.com/blog/remarketing-higher-education-campaigns, last accessed 4 June 2020.
[4] ‘Article 7. The processing of personal data shall only be carried out in the following cases: I - through individual’s consent.’
[5] This Law is yet to come into force due to the Covid-19 pandemic. There are legislative bills currently in discussion to extend the date of its effectiveness.
[6] ‘10. The development of technology gave rise to a new concept of privacy, in which the consent of the interested party is the point of reference for the entire system of privacy protection, a right that all persons have to dispose of their own information, including right to image.’ Appeal No 1114488-54.2014.8.26.0100, 5th Chamber of Private Law of the São Paulo State Higher Court, Reporting Justice Fernanda Gomes Camacho, 8 June 2016.
[7] ‘Article 6. The following are basic consumer rights: (...) III – adequate and clear information on different products and services, with correct specification as to quantity, characteristics, composition, quality, taxes assessed and price, as well as any risks they entail’.
[8] ‘Article 31. The offer and presentation of products or services shall ensure correct, clear, accurate and easily read information in Portuguese as to product or service characteristics, quality, quantity, composition, price, warranty, expiration dates and origin, among other data, and as to any risks they may cause to consumers’ health and safety.’
[9] ‘Article 7. Access to the internet is essential for exercise of citizenship, and the following rights are warranted to users: (...) VIII - clear and complete information on collection, use, storage, processing and protection of their personal data, which may only be used for purposes that: (a) justify the collection of such personal data; (b) are not prohibited by law; and (c) are specified in the service agreements or terms of use for Internet applications’.
[10] ‘Article 8. The consent established in art. 7, item I, of this Law must be provided in writing or by other mean that demonstrates the individual’s willingness. (...) Paragraph 4 – Consent shall be given for specific purposes, and generic authorisations for the processing of personal data shall be null and void. (...) VIII – clear and complete information on collection, use, storage, processing and protection of their personal data, which may only be used for purposes that: (a) justify the collection of such personal data; (b) are not prohibited by law; and (c) are specified in the service agreements or terms of use for Internet applications’.
[11] ‘Article 54 – Adhesion contract is the contract where the clauses have been approved by the competent authorities or established unilaterally by the product or service supplier, without the consumers being able to bargain or substantially modify the contents thereof. (...) Paragraph 3 – Written adhesion contracts shall be worded clearly, and in easily read, legible print, whose font size shall not be less than 12, thereby facilitating their comprehension by the consumer. Paragraph 4 – Clauses limiting consumer rights shall be prominently displayed for immediate ease of comprehension.’
[12] ‘Article 4 – To ensure easy customer service in e-commerce, supplier shall: I – to present a summary of the contract before the signing, with the information necessary for the full exercise of consumer’s right to choose, emphasising clauses that limit rights’.
[13] ‘IX – express consent to collection, use, storage and processing of personal data, which shall be given separately from the other contractual clauses’.
[14] ‘Paragraph 1 – If consent is given in writing, it shall be given separately from the other contractual clauses.’
Back to Litigation Committee publications