Content created by Assistant Secretary for Public Affairs (ASPA)
Date:
10/17/2016
OPDIV:
CMS
TPWA Unique Identifier (UID):
Tool(s) covered by this TPWA:
Resonate Networks (“Resonate”)
Is this a new TPWA?
Yes.
If an existing TPWA, please provide the reason for revision:
Not applicable (N/A).
Will the use of a third-party Website or application create a new or modify an existing HHS/OPDIV System of Records Notice (SORN) under the Privacy Act?
No.
If yes, indicate the SORN number (or identify plans to put one in place.):
N/A because CMS is not collecting or storing any personally identifiable information (PII).
Will the use of a third-party Website or application create an information collection subject to OMB clearance under the Paperwork Reduction Act (PRA)?
No.
If yes, indicate the OMB approval number and approval number expiration date (or describe the plans to obtain OMB clearance.) OMB Approval Number:
N/A.
Expiration Date:
N/A.
Does the third-party Website or application contain Federal Records?
No.
Describe the specific purpose for the OPDIV use of the third-party Website or application:
CMS will use Resonate to deliver behaviorally targeted advertising on third party websites to encourage consumers to visit HealthCare.gov. In addition, Resonate will also deliver retargeted advertising to consumers who previously visited HealthCare.gov to encourage them to return to HealthCare.gov. Behavioral targeting is a technique used to determine relevant recipients for ads, by inferring a consumer’s interests based on information collected about that particular consumer’s online web browsing behaviors, on various websites, over time. Behavioral targeting may also use data about consumers, such as demographic data, from third parties to supplement web browsing information. Retargeting is a form of behavioral targeting used by online advertisers to present ads to consumers who have previously visited a particular website. In addition, Resonate determines the relevant audience for advertising, in part, by using proprietary research on values, attitudes, and beliefs to identify the relevant population. Resonate will use cookies and/or web beacons (also called pixels) placed on HealthCare.gov for retargeting and conversion tracking. Conversion tracking allows Resonate to measure the activity of a consumer who reached a CMS website by clicking on a digital advertisement (e.g., what webpages within the website they clicked on, whether they completed a transaction). Resonate also measures the performance of advertisements and consumer interactions, including ad clicks and video completion rates, by using cookies and/or web beacons (also called pixels) placed on HealthCare.gov for retargeting and conversion tracking. Conversion tracking allows Resonate to measure the activity of a consumer who reached a CMS website by clicking on a digital advertisement (e.g., what webpages within the website they clicked on, whether they completed a transaction). Resonate will provide aggregate reports to CMS showing ad performance by measuring activity and web browsing behavior. Resonate collects no PII in the course of delivering advertisements or tracking conversions.
Have the third-party privacy policies been reviewed to evaluate any risks and to determine whether the Website or application is appropriate for OPDIV use?
Yes, and the review has determined that the application is appropriate for OPDIV use, taking into account the risks posed by the following: use of cookies, pixels or web beacons for targeted advertising based on sensitive information; targeting, retargeting and conversion tracking; and the ability for other advertisers to improve targeting based on data from this advertising campaign.
Describe alternative means by which the public can obtain comparable information or services if they choose not to use the third-party Website or application.
If consumers do not want to interact with advertisements from Resonate, consumers can learn about CMS campaigns through other advertising channels such as TV, radio, CMS websites and in-person assisters and events.
Does the third-party Website or application have appropriate branding to distinguish the OPDIV activities from those of nongovernmental actors?
N/A. Resonate serves CMS-branded ads on third party websites.
How does the public navigate to the third party Website or application from the OPDIV?
N/A. The CMS websites do not link to Resonate. Resonate is a tool used to place and track advertising on third-party sites.
Please describe how the public navigates to the third party Website or application:
N/A. The CMS websites do not link to Resonate. Resonate is a tool used to place and track advertising on third-party sites.
If the public navigates to the third-party Website or application via an external hyperlink, is there an alert to notify the public that they are being directed to a nongovernmental Website?
N/A. The CMS websites do not link to Resonate. Resonate is a tool used to place and track advertising on third-party sites.
Has the OPDIV Privacy Policy been updated to describe the use of a third-party Website or application?
Yes.
Provide a hyperlink to the OPDIV Privacy Policy:
https://www.healthcare.gov/privacy/
Is an OPDIV Privacy Notice posted on the third-party Website or application?
N/A. Resonate serves CMS-branded ads on third party websites. Consumers who see these ads do not have to visit the Resonate website.
Confirm that the Privacy Notice contains all of the following elements: (i) An explanation that the Website or application is not government-owned or government-operated; (ii) An indication of whether and how the OPDIV will maintain, use, or share PII that becomes available; (iii) An explanation that by using the third-party Website or application to communicate with the OPDIV, individuals may be providing nongovernmental third-parties with access to PII; (iv) A link to the official OPDIV Website; and (v) A link to the OPDIV Privacy Policy:
N/A.
Is the OPDIV's Privacy Notice prominently displayed at all locations on the third-party Website or application where the public might make PII available?
N/A.
Is PII collected by the OPDIV from the third-party Website or application?
N/A. Resonate collects no PII in the course of delivering advertisements, and thus, does not pass PII to CMS.
Will the third-party Website or application make PII available to the OPDIV?
N/A. Resonate collects no PII in the course of delivering advertisements, and thus, does not pass PII to CMS.
Describe the PII that will be collected by the OPDIV from the third-party Website or application and/or the PII which the public could make available to the OPDIV through the use of the third-party Website or application and the intended or expected use of the PII:
N/A. Resonate collects no PII in the course of delivering advertisements, and thus, does not pass PII to CMS.
Describe the type of PII from the third-party Website or application that will be shared, with whom the PII will be shared, and the purpose of the information sharing:
N/A. Resonate collects no PII in the course of delivering advertisements, and thus, does not pass PII to CMS.
If PII is shared, how are the risks of sharing PII mitigated?
N/A.
Will the PII from the third-party Website or application be maintained by the OPDIV?
N/A. Resonate collects no PII in the course of delivering advertisements, and thus, does not pass PII to CMS.
If PII will be maintained, indicate how long the PII will be maintained:
N/A.
Describe how PII that is used or maintained will be secured:
N/A. Resonate collects no PII in the course of delivering advertisements, and thus, does not pass PII to CMS.
What other privacy risks exist and how will they be mitigated?
CMS will conduct periodic reviews of Resonate’s privacy policy to ensure its policies continue to align with agency objectives and privacy policies and do not present unreasonable or unmitigated risks to user’s privacy interests. CMS uses Resonate solely for the purposes of improving consumer engagement with HealthCare.gov by directing consumers to the CMS website through the use of targeted advertising.
Use of Cookies, Pixels and Web Beacons for Targeted Advertising Based on Sensitive Information
Potential Risk:
The use of cookies, pixels, and web beacons generally presents the risk that an application could collect information about a user’s activity on the Internet for purposes that the users did not intend. The unintended purposes include providing users with behaviorally targeted advertising, based on information the individual user may consider to be sensitive. In addition, Resonate’s values targeting technology classifies audiences by their “values” as perceived from their internet behavior data. Some users may find the values defined by this technology include sensitive information.
Additional Background:
Resonate collects non-personally identifiable information by placing a cookie or pixel (also known as a web beacon) on HealthCare.gov on advertisements sponsored by CMS on third party websites. A pixel (or web beacon) is a transparent graphic image (usually 1 pixel x 1 pixel) that is placed on a web page and collects information regarding the use of the web page that allows Resonate to collect information regarding the use of the web page. A cookie is a small text file stored on a website visitor’s computer that allows the site to recognize the user and keep track of preferences. These technologies provide information about when a visitor clicks on or views an advertisement. Resonate uses that information to judge which advertisements are more appealing to users and which result in greater conversions, such as transactions with HealthCare.gov.
CMS advertising served through Resonate will carry persistent cookies that enable CMS to display advertising to individuals who have previously visited HealthCare.gov. In this instance, the persistent cookie will be stored on the user’s computer for up to 30 months, unless removed by the user.
Resonate uses “Values Targeting,” technology that classifies audiences by their values, as perceived by their web viewing behavior. For example, in addition to targeting an audience by demographics, i.e., “18 to 24 year old males,” Resonate may also classify an audience as “preserving the environment” or “self-esteem” or “spending time with family.”
Mitigation:
Both HealthCare.gov and Resonate provide consumers with information about the use of persistent cookies and related technologies. This information includes what data is collected, and the data gathering choices included in their website privacy policies, including choices related to behaviorally targeted advertising.
Tealium iQ Privacy Manager is a tool that keeps track of users’ preferences in reference to tracking and will prevent web beacons from firing when a user has opted out of tracking for advertising purposes. When a user is routed to HealthCare.gov by clicking on a CMS advertisement displayed through Resonate, and the Tealium iQ Privacy Manager is present on HealthCare.gov, users are able to control which cookies they want to accept from HealthCare.gov. Tealium iQ Privacy Manager can be accessed through information provided on the privacy policy on HealthCare.gov. There is a large green “Modify Privacy Options” button that turns off the sharing of data for advertising purposes that can be accessed through the HealthCare.gov privacy policy.
The ability to control which cookies users want to accept is only valid when Tealium iQ Privacy Manager is installed on the website. Another alternative is for users to disable cookies through their web browser. Separately, CMS includes the Digital Advertising Alliance AdChoices icon on all targeted digital advertising. The AdChoices icon is an industry standard tool that allows users to opt out of being tracked for advertising purposes, like the Tealium iQ Privacy Manager.
Resonate offers users the ability to opt-out of Resonate advertising cookies through the following processes:
- Opt out of advertising at: http://www.resonate.com/privacy-policy/opt-out-success/
- Click on the “Ad Choices” logo in the corner of an ad served by Resonate; and
- Resonate participates in the Digital Advertising Alliance (DAA), which provides consumers with the ability to opt-out of data collection for behavioral advertising by all companies who participate in the DAA, including Resonate.
Targeting, Retargeting and Conversion Tracking and the Ability for Other Advertisers to Improve Targeting Based on Data from this Advertising Campaign
Potential Risk:
Advertising technologies used by Resonate allow it to target advertising behaviorally, by tracking users across multiple sites and over time, and the resulting combined information could reveal patterns in behavior that the user may not want to disclose to Resonate. The consumer may consider their web behavior to be sensitive by the user. These patterns in behavior could also enable and improve targeting by other advertisers who are Resonate customers, who may wish to target customers within the health insurance sector.
Additional Information:
Resonate advertising services targets consumers based on information collected through technologies like cookies and pixels. Behavioral targeting deploys ads to consumers whose on-site actions match specific attributes considered desirable by online advertisers. Behavioral targeting is a technique used to determine relevant recipients for ads, by inferring these interests based on information collected about a particular consumer’s online web browsing behaviors, on various websites, over time. Retargeting is a form of behavioral targeting used by online advertisers to present ads to users who have previously visited a particular site. In addition, ads served by Resonate will use conversion tracking, which allows advertisers to measure the impact of their advertisements by reporting on whether users who view or interact with an ad later visit a particular site or perform desired actions on that site, such as signing up for a program or requesting further information.
Behavioral targeting, retargeting and conversion tracking enable CMS to improve the performance of ads by delivering them to relevant audiences and measuring their effect. CMS uses retargeting to send advertisements information to consumers who have previously visited HealthCare.gov, for example, advertisements reminding consumers of relevant deadlines.
Mitigation:
Resonate does not share data solely about consumers who visit HealthCare.gov with any other advertisers. Resonate does not collect or share data that is specific solely to a CMS campaign for the purposes of creating or refining audience targeting. Resonate collects aggregated level “interaction” data to identify consumers that are most likely to interact with an ad from a specific industry (for example, health insurance) for the purposes of improving the ability for advertisers to reach consumers who are more likely to that ad relevant. Resonate does not allow for the sole targeting of consumers who have specifically interacted with an ad from CMS by other Resonate customers.
When a user is routed to HealthCare.gov by clicking on a CMS advertisement displayed through Resonate, and the Tealium iQ Privacy Manager is present on HealthCare.gov, users are able to control which cookies they want to accept from HealthCare.gov. Tealium iQ Privacy Manager can be accessed through information provided on the privacy policy on HealthCare.gov. There is a large green “Modify Privacy Options” button that turns off the sharing of data for advertising purposes that can be accessed through the HealthCare.gov privacy policy.
The ability to control which cookies users want to accept is only valid when Tealium iQ Privacy Manager is installed on the website. Another alternative is for users to disable cookies through their web browser. Separately, CMS includes the Digital Advertising Alliance AdChoices icon on all targeted digital advertising. The AdChoices icon is an industry standard tool that allows users to opt out of being tracked for advertising purposes, like the Tealium iQ Privacy Manager.
Resonate offers users the ability to opt-out of Resonate advertising cookies through the following processes:
- Opt-out of advertising at: https://rocketfuel.com/opt-out/;
- Click on the “Ad Choices” logo in the corner of an ad served by Resonate;
Resonate participates in the Digital Advertising Alliance (DAA), which provides consumers with the ability to opt-out of data collection for behavioral advertising by all companies who participate in the DAA, including Resonate.