Product ad placement and the boundaries of the 25% rule for under 16s & HFSS foods – What constitutes ‘all reasonable steps’? Where does using data to create an audience (a mailing list for direct or email marketing) fall?
A recent Advertising Standards Authority (ASA) adjudication on Burger King ads looked at the requirements on marketers not to promote high in fat, salt or sugar (HFSS) products (see Food: HFSS Product and Brand Advertising) to under 16s. It found that practical steps to actively exclude those who were under 16 were necessary, over and above simply stating the offer was not open to them, when it came to the creation of a mailing list for direct marketing.
Cap Code
The CAP code 15.18 states:
HFSS product advertisements must not be directed at people under 16 through the selection of media or the context in which they appear. No medium should be used to advertise HFSS products, if more than 25% of its audience is under 16 years of age. (rule 15.18).
What can I do to ensure responsible targeting?
There is Guidance provided on this at Food: HFSS Media Placement - ASA | CAP. This states:
Broadly speaking, there are two main methods for targeting marketing communications and, depending on the circumstances, either, or both, could be used to ensure a marketer’s message reaches the intended audience.
- Robust, specific audience measurement that shows the under-16s audience is below 25% is best. If this is not available, more general data may be acceptable but the less robust the data, the greater the risk.
- Through the use of data to include or exclude individuals on the basis of their age, or other relevant criteria. If using data to create an audience - a mailing list for direct or email marketing or account data held by a social networking platform, for example - marketers need to ensure they’ve taken ‘all reasonable steps to exclude under-16s from the list or targeting criteria’. On a straight forward level, anyone with a date of birth that means they’re under-16 should be removed. With some online platforms, data held by the media owner may be used to infer ages based on factors like interests or interactions with other users.
BKUK Group Ltd t/a Burger King BKUK Group Ltd - ASA | CAP 7 Feb 2024
Fast food chain Burger King was ordered to pull their recent advertising campaign offline due to the ASA finding they had not taken all ‘reasonable steps’ to avoid the promotion of foods high in fat, salt and sugar (HFSS) to children under the age of 16. This was by reason of the conflation of the creation of an audience via a mailing list for direct or email marketing with an ad being 'directed' at those who were under 16.
Background
The ads, three emails sent to registered users of the “YourBurgerKing” service, featured promotions enabling consumers to add items to a Burger King meal deal at a discounted rate, or to get another item as part of a ‘buy-one-get-one-free’ (BOGOF) offer. The ASA understood that the meals seen in the emails were HFSS products and, as such, considered that the promotional messages were ads for HFSS products for the purposes of the Code.
The ASA set out that “YourBurgerKing” was a rewards scheme which enabled users to earn reward points for every pound spent when purchasing Burger King products online or in-store, which could then be redeemed against future food purchases, and to receive promotional offers. The only mandatory information users were required to provide when signing up for a “YourBurgerKing” account was a first name and an email address. The “YourBurgerKing” sign-up page included a drop-down section labelled “Optional Information”, which allowed users to enter their date of birth and postcode if they wished. In order to create an account, users needed to tick a box confirming that they had agreed to Burger King’s privacy policy, rewards terms and terms of service, all of which were linked from the sign-up page. Users could also choose whether to opt-in to receive marketing communications regarding special offers.
The terms of service stated that “YourBurgerKing" was intended for use by people who were at least 16 years old, or ‘that users who were under the age of 16 obtained permission from their parent or guardian’. However, that information was not presented on the sign-up page, and registration could be completed without needing to have read the terms of service.
ASA Ruling
Burger King said they were careful to take 'all reasonable steps' to avoid targeting their ads at under 16-year-olds. Their terms of service, which were available on their website, app and related channels, stated that the “YourBurgerKing” service was designed for use by persons who were at least 16 years old. The terms also stated that people under the age of 16 who signed up for the service confirmed, by doing so, that they had received permission from their parent or guardian before using the service. Burger King argued they did not prevent people who registered their age as being under 16 from signing up to the service because of that confirmation requirement. Furthermore, the age field on the sign-up form was optional because they believed it was not mandatory for a consumer to share their date of birth during the sign-up process.
The ASA considered that if data was used to create an audience that it should, ‘where necessary’, be used to exclude individuals on the basis of their age, and it was not sufficient only to state that the service should not be accessed by under-16s.
This shows the ASA taking a very strict position on the use of direct marketing audience lists. Even the guidance does not specifically require the actual completion of a date of birth but rather suggests it and the removal of those under age as an example of taking ‘reasonable steps’.
The distinction is made whereby the media ‘selected’ is then seen as directed at under 16s and the percentage threshold is not referenced. This seems to be collating the two aspects of Rule 15.18 to import artificially an outright ban on any HFSS product adverts being knowingly provided to the under 16s by way of direct marketing.
This shows a particularly stringent interpretation of even the ASA's own guidance and one which marketers of HFSS foods would do well to be aware of.
Summary
The take home for marketers of HFSS products is:
- to require the completion of date of birth for targeted audience lists; and
- an active removal of those under 16 irrespective of how small a percentage of the audience they may be.
Processing data of those 12 and Under
A further issue on the giving of consent for processing of personal data was reviewed, whereby the ASA asserted in the published ruling that in the UK, only children aged 13 or over were able to provide their own consent.
The UK Information Commissioner’s Office (ICO) is the UK's independent body set up to uphold information rights. It has looked into this further in their own guidance What are the rules about an ISS and consent? | ICO. As follows:
If you wish to rely upon consent as your lawful basis for processing personal data, Article 8 of the UK GDPR provides that:
- only children aged 13 years and over may lawfully provide their own consent for the processing of their personal data;
- an adult with parental responsibility must provide consent for processing if the child is under 13; and
- in such cases you must make ‘reasonable efforts’, taking into consideration available technology, to verify that the person providing parental consent does, in fact, hold parental responsibility for the child.
Therefore, the ICO sets out this ‘age of consent’ verification requirement, although not explicit, is the implication from Article 8. In practice, there would be the application of ‘reasonable efforts’, taking into consideration the available technology, to verify that any person giving consent on behalf of a child who is too young to provide their own consent, does in fact hold parental responsibility over the child.
An example is provided by the ICO of a direct mailing for a newsletter for a pop band (as opposed to for example, an un-monitored chat room). It is specifically stated in the ICO’s own guidance: 'A ‘reasonable effort’ in this circumstance might therefore entail simply asking for a declaration that the user is old enough to provide their own consent, or a declaration of parental consent and responsibility, via a tick box or email confirmation. You may consider that further checks are not reasonable (or indeed practical) and that these steps are sufficient given the low risk to the child of the proposed processing.'
It would seem the ASA is importing stricter standards into the consent requirements for processing of data than the body responsible for providing guidance on this. It is not known if this is based on the perceived risk to the child of HFSS foods in particular or as a much more broad-based restriction.
Summary
This was stated as an aside to the main issue by the ASA but should be carefully considered in the future by marketers who may be collating the data of those 12 years and under in their data protection impact assessment to help evidence and explain the approach taken to processing and consent.