Online Behavioral Advertising Moving the…

                       Online Behavioral Advertising
    Moving the Discussion Forward to Possible Self-Regulatory Principles

Background

        Since the 1990's, the Federal Trade Commission and its staff have engaged in
investigations, law enforcement, studies, and other policy developments to protect consumer
privacy in the online environment. The FTC's work in this area is part of its broader,
longstanding program to address privacy concerns in both the online and offline markets. In the
online environment, innovation in consumer services and products ­ photo-sharing, blogging, the
creation of virtual communities, and robust search, to name but a few ­ has significantly
enhanced consumers' use of the Web. The FTC's privacy program seeks to balance support for
such innovation with the need to protect against harms to consumers' privacy.

        In November 2006, the FTC held three days of public hearings, "Protecting Consumers in
the Next Tech-ade," to examine anticipated technological developments that could raise
consumer protection policy issues over the next decade.1 Online behavioral advertising ­ the
practice of tracking consumers' activities online to target advertising ­ received considerable
attention at the hearings. In the year since Tech-ade, the FTC staff has continued to examine
online behavioral advertising. Among other things, to explore issues raised by consumer
advocates and others,2 the staff has held many dozens of meetings with consumer representatives,
industry members, academics, technologists, and others to gain a better understanding of current
and anticipated online advertising models.3

        Most recently, on November 1 and 2, 2007, building on the Tech-ade hearings, the FTC
hosted a Town Hall entitled "Ehavioral Advertising: Tracking, Targeting, and Technology." The
event brought together interested parties to discuss the privacy issues raised by online behavioral
advertising. The FTC selected the Town Hall format to convey the importance of launching a
continuing dialogue and debate about the key issues. To prepare for the event and supplement
the record, the FTC sought public comment on the issues.4


       1
           See http://www.ftc.gov/bcp/workshops/techade/index.html.
       2
        See, e.g., Center for Digital Democracy and U.S. Public Interest Research Group
Complaint and Request for Inquiry and Injunctive Relief Concerning Unfair and Deceptive
Online Marketing Practices (Nov. 1, 2006),
http://www.democraticmedia.org/files/pdf/FTCadprivacy.pdf.
       3
         The FTC examined similar issues in 2000, when it held a workshop (jointly with the
Department of Commerce) to examine online profiling, an early form of behavioral advertising
that has evolved considerably since that time. See
http://www.ftc.gov/opa/1999/09/profiling.shtm.
       4
           See http://www.ftc.gov/os/comments/behavioraladvertising/index.shtm.
        In examining the practices, the FTC has applied a broad definition of online "behavioral
advertising," one meant to encompass the various tracking activities engaged in by diverse
companies across the Web. Thus, for purposes of this discussion, online "behavioral
advertising" means the tracking of a consumer's activities online ­ including the searches the
consumer has conducted, the web pages visited, and the content viewed ­ in order to deliver
advertising targeted to the individual consumer's interests.

         In advance of the Town Hall, the FTC identified certain key questions related to
behavioral advertising for discussion by participants. These questions included what consumers
know about the practice, whether consumer disclosures in this area are necessary and effective,
how data collected for behavioral advertising is used and protected, and what standards do or
should govern the practice as we move into the future. In addition, a number of industry groups,
consumer advocates, and individual companies developed proposals and recommendations
regarding the privacy issues raised by behavioral advertising. These include a Do Not Track
proposal, submitted by a coalition of consumer groups; several reports discussing and critiquing
the current practices and self-regulatory initiatives in this area; and a variety of industry
initiatives to address the privacy issues raised.5 From all of these discussions and activities,
certain core issues and concerns have emerged.

         First, while behavioral advertising provides benefits to consumers in the form of free web
content and personalized ads that many consumers value, the practice itself is largely invisible
and unknown to consumers. The benefits include, for example, access to newspapers and
information from around the world, provided free because it is subsidized by online advertising;
tailored ads that facilitate comparison shopping for the specific products that consumers want;
and, potentially, a reduction in ads that are irrelevant to consumers' interests and that may
therefore be unwelcome. Although many consumers value these benefits, few appear to
understand the role that data collection plays in providing them. Second, business and consumer
groups alike cherish the values of transparency and consumer autonomy, and view them as
critical to the development and maintenance of consumer trust in the online marketplace. Third,
regardless of whether one views behavioral advertising as beneficial, benign, or harmful, there
are reasonable concerns about the possibility of consumer data collected for this purpose falling
into the wrong hands or being used for unanticipated purposes.


       5
         See, e.g., Center for Democracy and Technology et al., Consumer Rights and Protections
in the Behavioral Advertising Sector (Do Not Track proposal) (Oct. 31, 2007),
http://www.cdt.org/press/20071031press.php; World Privacy Forum, The Network Advertising
Initiative: Failing at Consumer Protection and at Self-Regulation (Nov. 2, 2007),
http://www.worldprivacyforum.org; Press Release, AOL, AOL Launches Innovative Privacy
Education Program for Behaviorally Targeted Advertising (Oct. 31, 2007),
http://press.aol.com/article_display.cfm?article_id=1327.



                                                 2
        Given the importance of these issues, FTC staff has proposed some governing principles
for behavioral advertising and now seeks comment on the principles from interested parties. The
principles are intended to address the unique concerns expressed about behavioral advertising
and thus are limited to these practices. The purpose of this proposal is to encourage more
meaningful and enforceable self-regulation to address the privacy concerns raised with respect to
behavioral advertising. In developing the principles, FTC staff was mindful of the need to
maintain vigorous competition in online advertising as well as the importance of accommodating
the wide variety of business models that exist in this area. The staff intentionally drafted the
principles in general terms to encourage comment and discussion by all interested parties and
further development of the principles based on the comments.

Proposed Principles

1.       Transparency and consumer control

Issue:

·        Interested parties cite the need for greater transparency and consumer control to address
         the privacy issues raised by behavioral advertising. Many criticize existing disclosures as
         difficult to understand, inaccessible, and overly technical and long. They also stated that,
         with clearer disclosures, consumers can make more informed decisions about whether or
         not they want personalized advertising or, alternatively, whether they would prefer not to
         do business at particular websites. At the same time, panelists recognized that many
         consumers do not read privacy policies and raised a genuine question about consumers'
         willingness and ability to read and understand long disclosures about privacy.

Proposed Principle:

·        Every website where data is collected for behavioral advertising should provide a clear,
         concise, consumer-friendly, and prominent statement that (1) data about consumers'
         activities online is being collected at the site for use in providing advertising about
         products and services tailored to individual consumers' interests, and (2) consumers can
         choose whether or not to have their information collected for such purpose.6 The website
         should also provide consumers with a clear, easy-to-use, and accessible method for
         exercising this option.




         6
        Many FTC laws, rules, and policies require clear and conspicuous disclosures to prevent
deception and possible consumer harm. For more information and guidance on the use of such
disclosures in online advertising, see Dot Com Disclosures, Information About Online
Advertising, http://www.ftc.gov/bcp/conline/pubs/buspubs/dotcom/index.shtml (May 2000).

                                                  3
2.       Reasonable security, and limited data retention, for consumer data

Issue:

·        Stakeholders express concern that data collected for behavioral advertising may not be
         adequately secured and could find its way into the hands of criminals or other
         wrongdoers. They stated that appropriate security measures therefore are needed to
         minimize the risk of unauthorized access. On the other hand, some of the data that is
         collected may not be traceable to any individual consumer or computer, and therefore
         may do little harm if obtained by a wrongdoer.

Proposed Principle:

·        Any company that collects and/or stores consumer data for behavioral advertising should
         provide reasonable security for that data. Consistent with the data security laws and the
         FTC's data security enforcement actions, such protections should be based on the
         sensitivity of the data, the nature of a company's business operations, the types of risks a
         company faces, and the reasonable protections available to a company.7

Issue:

·        Stakeholders express concern about the length of time that companies are retaining
         consumer data collected for behavioral advertising. The longer that data is stored in
         company databases, the greater the risks to the data. On the other hand, there may be
         good reasons for retaining data, such as maintaining and improving customer service or
         tracking criminal activities on the website.

Proposed Principle:

·        Companies should retain data only as long as is necessary to fulfill a legitimate business
         or law enforcement need.8 FTC staff commends recent efforts by some industry members
         to reduce the time period for which they are retaining data. However, FTC staff seeks
         comment on whether companies can and should reduce their retention periods further.




         7
         For more information on the FTC's data security program and data security enforcement
actions, see http://www.ftc.gov/privacy/privacyinitiatives/promises_enf.html.
         8
        FTC enforcement actions and educational materials have highlighted the risk of storing
consumer data longer than it is reasonably needed. See, e.g., DSW Inc., Docket No. C-4157
(Dec. 1, 2005), http://www.ftc.gov/opa/2005/12/dsw.shtm; Protecting Personal Information: A
Guide for Business, http://www.ftc.gov/infosecurity.

                                                   4
3.       Affirmative express consent for material changes to existing privacy promises

Issue:

·        Industry and consumer representatives alike state that the privacy policy ­ a set of
         commitments about how information is handled ­ not only is an important tool for
         providing information to consumers, but also serves to promote accountability among
         businesses. It is widely recognized, however, that businesses may have a legitimate need
         to change their privacy policies from time to time.

Proposed Principle:

·        As the FTC has made clear in its enforcement and outreach efforts, a company must keep
         any promises that it makes with respect to how it will handle or protect consumer data,
         even if it decides to change its policies at a later date.9 Therefore, before a company can
         use data in a manner materially different from promises the company made when it
         collected the data, it should obtain affirmative express consent from affected consumers.
         This principle would apply in a corporate merger situation to the extent that the merger
         creates material changes in the way the companies collect, use, and share data.

4.       Affirmative express consent to (or prohibition against) using sensitive data for
         behavioral advertising

Issue:

·        Stakeholders express concern about the use of sensitive data (for example, information
         about health conditions, sexual orientation, or children's activities online) to target
         advertising, particularly when the data can be traced back to a particular individual. They
         state that consumers may not welcome such advertising even if the information is not
         personally identifiable; they may view it as invasive or, in a household where multiple
         users access one computer, it may reveal confidential information about an individual to
         other members.10 At the same time, panelists recognized that some consumers may view
         personalized advertising and content as a desirable source of education about their
         medical conditions or personal concerns.

         9
         See, e.g, Gateway Learning Corp., Docket No. C-4120 (Sept. 10, 2004),
http://www.ftc.gov/opa/2004/07/gateway.shtm (company made material changes to its privacy
policy and allegedly applied such changes to data collected under the old policy; opt-in required
for future such changes).
         10
          At least one self-regulatory program currently prohibits the use of sensitive personally
identifiable data and has stated its intention to expand its guidance on the issue. See NAI
Principles, http://www.networkadvertising.org/networks/principles.asp.

                                                  5
Proposed Principle:

·        Companies should only collect sensitive data for behavioral advertising if they obtain
         affirmative express consent from the consumer to receive such advertising. FTC staff
         seeks specific input on (1) what classes of information should be considered sensitive,
         and (2) whether using sensitive data for behavioral targeting should not be permitted,
         rather than subject to consumer choice.

5.       Call for additional information: Using tracking data for purposes other than
         behavioral advertising

Issue:

·        Interested parties express concern that consumer tracking data collected and stored for
         behavioral advertising could be used for other potentially harmful purposes. To the
         extent that the collection of data for behavioral advertising is invisible to consumers, such
         secondary uses of the data may be especially so. Further, such uses may be contrary to
         consumers' reasonable expectations as they navigate the web. On the other hand, there
         may be secondary uses of data that provide benefits to consumers. For example,
         companies may use data to develop new products that appeal to their customer base or to
         enhance existing products and services that they offer.

Additional Information Needed:

·        FTC staff seeks additional information about the potential uses of tracking data beyond
         behavioral advertising and, in particular: (1) which secondary uses raise concerns,
         (2) whether companies are in fact using data for these secondary purposes, (3) whether
         the concerns about secondary uses are limited to the use of personally identifiable data or
         also extend to non-personally identifiable data, and (4) whether secondary uses, if they
         occur, merit some form of heightened protection.

Next Steps: Request for Comment

·        FTC staff seeks comment and discussion on the appropriateness and feasibility of these
         principles for both consumers and businesses, including the costs and benefits of offering
         choice for behavioral advertising. FTC staff recognizes that, to the extent that behavioral
         advertising supports free web content and other benefits, the choice by consumers not to
         participate could reduce the availability of such benefits. FTC staff welcomes comment
         on these and other issues raised by the proposed principles.

·        Comments should be sent by Friday, February 22, 2008, to: Secretary, Federal Trade
         Commission, Room H-135 (Annex N), 600 Pennsylvania Avenue, N.W., Washington,

                                                   6
       D.C. 20580, or BehavioralMarketingPrinciples@ftc.gov. The comments will be posted
       on the FTC's behavioral advertising web page for possible use in the development of self-
       regulatory programs.11

        These principles represent FTC staff's efforts to identify common themes and possible
norms to govern behavioral advertising. They draw upon the issues and concerns raised at the
Town Hall, the complaints and proposals submitted beforehand and afterwards, and the research
and many dozens of interviews that FTC staff conducted in preparation for the event. In
proposing these principles, FTC staff notes that it in no way intends to foreclose (1) other ideas
suggested and being considered to address behavioral advertising, or (2) use of the FTC's
enforcement or regulatory authority, including its authority to challenge unfair or deceptive
practices under Section 5 of the FTC Act.




       11
            See http://www.ftc.gov/bcp/workshops/ehavioral/index.shtml.

                                                 7