PIPC Strengthens Transparency in Processing Behavioral Information for Personalized Advertising Purposes

'Policy Measures for Protecting Online Behavioral Data Used in Personalized Advertising' Established

The level of protection for the processing of online behavioral information used for personalized advertising will be strengthened going forward.

The Personal Information Protection Commission announced the "Policy Measures for the Protection of Online Behavioral Information Used for Personalized Advertising" containing these details on the 31st.

Personalized advertising allows users to effectively view ads that reflect their interests. However, there is a risk that the collected behavioral information is accumulated and aggregated through repetitive and continuous processing, leading to processing where individuals are identified without their consent, or even enabling inference of sensitive information such as beliefs, political views, and other sensitive data.

The problem is that users find it difficult to know how their behavioral information is collected and used during this processing. Companies are also exposed to legal uncertainties due to ambiguous regulations on behavioral information.

The newly established measures first clarify the roles and responsibilities of key stakeholders in personalized advertising. There were existing regulations requiring prior consent from users when processing behavioral information combined with personally identifiable information. However, there were no separate regulations for processing behavioral information not combined with personally identifiable information.

The Personal Information Protection Commission allows advertising operators, as key stakeholders, to process behavioral information without obtaining user consent if the information is processed without identifying specific individuals. However, it mandates that the processing must ensure that the possibility of identifying specific individuals through accumulation, overlap, or combination during processing does not arise, and that recommended measures such as ensuring transparency, providing post-control rights, and implementing safety measures are followed.

Additionally, for advertising media operators, the processing procedures will be transparently disclosed so that users can effectively verify the processing of behavioral information. First, if web or application operators process behavioral information for their own personalized advertising purposes, the same standards as advertising operators will apply. If advertising media operators allow third parties to collect behavioral information through collection tools, it is recommended that the behavioral information collected by third parties be separated by each web/app and included in the privacy policy. It is also required that the Chief Privacy Officer (CPO) regularly monitor the status of behavioral information collection tools.

Regarding personalized advertising targeting children, businesses intending to provide personalized ads by combining behavioral information with personally identifiable information of children under 14 must obtain prior consent from their legal guardians. Furthermore, if the individual is not identified but the service is aware that the user is under 14 or primarily used by children, it is recommended not to collect or use behavioral information for personalized advertising purposes.

Advertising media operators whose main users of their operated web/apps are children under 14 are advised not to install behavioral information collection tools for personalized advertising purposes. Operators running in-app browsers must meet lawful collection requirements, such as obtaining user consent when identifying users and processing behavioral information.

Efforts will also be made to strengthen the understanding and protection capabilities of data subjects regarding behavioral information. Customized behavioral information protection content will be prepared and operated according to the target audience and their level to enhance understanding of behavioral information. Additionally, user practice guidelines for protecting behavioral information will be promoted so that data subjects can effectively protect their own behavioral information.

A status survey and evaluation of privacy policies will also be conducted. The Personal Information Protection Commission plans to conduct an online personalized advertising status survey in the first half of this year to understand the market situation and the current status of behavioral information processing for preparing personalized advertising system guidelines. It will also check whether advertising operators and advertising media operators properly disclose the collection and use of behavioral information in their privacy policies.

Based on this policy measure, the Personal Information Protection Commission will collaborate with the private sector to establish specific processing standards and methods applicable in the field where behavioral information is processed. An online behavioral information protection public-private consultative body will be formed in the first quarter of this year, and through joint work, the revised personalized advertising guidelines will be announced by the end of the year.

Yang Cheong-sam, Director of the Personal Information Policy Bureau at the Personal Information Protection Commission, said, "The personalized advertising industry is currently facing a major turning point in the processing of users' behavioral information, as Google has announced the discontinuation of support for third-party cookies," adding, "Interest in the processing of behavioral information for personalized advertising purposes is increasing."

He continued, "The policy measures announced this time include ways to enhance the protection of data subjects' rights during the processing of behavioral information for personalized advertising purposes, and based on this, we will improve the legality and transparency of behavioral information processing."

This content was produced with the assistance of AI translation services.