After European Union set new rules on online advertising, U.S. Federal Trade Commissions published these days a proposed set of privacy principles governing online behavioral advertising.
The FTC’s privacy program seeks to balance support for such innovation in consumer services and products photo-sharing, blogging, the creation of virtual communities, and robust search, with the need to protect against harms to consumers’ privacy.
On November 1 and 2, 2007 the FTC hosted a Town Hall entitled “Behavioral Advertising: Tracking, Targeting, and Technology.” The event brought together interested parties to discuss the privacy issues raised by online behavioral advertising. The FTC selected the Town Hall format to convey the importance of launching a continuing dialogue and debate about the key issues. To prepare for the event and supplement the record, the FTC sought public comment on the issues.
FTC has applied a broad definition of online “behavioral advertising,” one meant to encompass the various tracking activities engaged in by diverse companies across the Web. Thus, “behavioral advertising” means the tracking of a consumer’s activities online including the searches the consumer has conducted, the web pages visited, and the content viewed in order to deliver advertising targeted to the individual consumer’s interests.
FTC staff has proposed some governing principles for behavioral advertising and now seeks comment on the principles from interested parties. The principles are intended to address the unique concerns expressed about behavioral advertising and thus are limited to these practices. The purpose of this proposal is to encourage more meaningful and enforceable self-regulation to address the privacy concerns raised with respect to behavioral advertising.
The proposed principles are the following:
- Transparency and consumer control
Every website where data is collected for behavioral advertising should provide a clear, concise, consumer-friendly, and prominent statement that (1) data about consumers’ activities online is being collected at the site for use in providing advertising about products and services tailored to individual consumers’ interests, and (2) consumers can choose whether or not to have their information collected for such purpose. The website should also provide consumers with a clear, easy-to-use, and accessible method for exercising this option.
- Reasonable security, and limited data retention, for consumer data
Any company that collects and/or stores consumer data for behavioral advertising should provide reasonable security for that data. Consistent with the data security laws and the FTC’s data security enforcement actions, such protections should be based on the sensitivity of the data, the nature of a company’s business operations, the types of risks a company faces, and the reasonable protections available to a company.
- Affirmative express consent for material changes to existing privacy promises
As the FTC has made clear in its enforcement and outreach efforts, a company must keep any promises that it makes with respect to how it will handle or protect consumer data, even if it decides to change its policies at a later date. Therefore, before a company can use data in a manner materially different from promises the company made when it collected the data, it should obtain affirmative express consent from affected consumers. This principle would apply in a corporate merger situation to the extent that the merger creates material changes in the way the companies collect, use, and share data.
- Affirmative express consent to (or prohibition against) using sensitive data for behavioral advertising
Companies should only collect sensitive data for behavioral advertising if they obtain affirmative express consent from the consumer to receive such advertising. FTC staff seeks specific input on (1) what classes of information should be considered sensitive, and (2) whether using sensitive data for behavioral targeting should not be permitted, rather than subject to consumer choice.
- Using tracking data for purposes other than behavioral advertising
“It’s good that the FTC is shining a spotlight on this industry,” Peter Swire, a senior fellow at the Center for American Progress. “Online advertising is in its second boom. They’re trying lots of new techniques; some of those techniques have privacy problems.”
The Center for Democracy and Technology (CDT), an organization focused on online privacy and civil liberties, asked FTC for releasing its privacy principles. The release of the privacy principles should send a signal to online advertisers, said Leslie Harris, CDT’s president.