| November 30, 1999 Secretary
Introduction The Magazine Publishers of America (MPA) is pleased to respond to the request for public comment on the Online Profiling Project - a joint effort by the National Telecommunications and Information Administration and the Federal Trade Commission. MPA is the principal trade association of the consumer magazine industry, representing more than 200 publishers of more than 1250 of the most-recognized magazines in the United States. Our membership also includes over 50 international magazine companies. Many of our members are involved in new media magazine endeavors in addition to their traditional print offerings and some of those members use the services of ad server companies to help procure and target advertising for their web sites. The Benefits of Online Profiling Despite the reaction that some may have to the term "profiling", the concept of collecting information on what interests people online and using that information to tailor people's online experiences is sound. Online profiling allows companies to match both content and advertising to what consumers are interested in seeing. For content, for example, web site operators can rearrange web site offerings so that information most of interest to the consumer is at the top of the page. Similarly, web sites operated by magazine publishers may feature a selection of demographic editions that appeal to a variety of interest groups. For advertising, online profiling benefits consumers by removing some of the potential advertising "clutter" and letting them focus on products and services in areas in which they have expressed an interest. Furthermore, online profiling allows advertisers to control and limit the frequency with which a web site visitor sees an ad banner. This makes advertising on the Internet less intrusive by insuring that visitors are not overwhelmed with repeat advertising messages. There is another major, although, indirect benefit to consumers from the use of information about visitors' online activities to target advertising campaigns. Through targeting, ad campaigns become more cost-effective and deliver better value to advertisers. Advertisers can ensure that their ads are seen by individuals with an interest in their type of product or service. Consumers, better able to focus on relevant products and services, are more likely to respond favorably to advertising campaigns. If advertising on the Internet is effective, it will grow and be able to continue to fund the content on the Internet, which until now has mostly been available without charge. It is a great benefit to consumers for the content on the Internet to be free. With appropriate information disclosure through the well-accepted privacy principles of "notice and choice", we are confident most consumers will want both the individual benefit of targeted information and the collective benefit of free content. This is confirmed by the results of the consumer survey conducted by Privacy and American Business on behalf of Doubleclick, Inc., one of the ad server companies. This survey found that 61 % of Internet users have a positive reaction toward receiving banner ads tailored to their personal interests rather than receiving random ads. These Internet users understand, and are comfortable with, the fact that information about their visits is needed to facilitate such personalization of ads. The Privacy and American Business survey found that 58 % of Internet users would agree to having their visits to web sites used to personalize banner ads to them, as long as they were provided with notice and an opt-out opportunity. Self-Regulation is the Right Approach to Dealing with Privacy and Transparency Issues Related to Online Profiling We appreciate the Federal Trade Commission and Department of Commerce's vigilance in staying on top of late-breaking developments on the Internet and examining developing practices in light of their privacy implications. The Internet is such a rapidly changing medium and privacy practices need to evolve at the same pace. In light of the need to respond quickly, we especially value the FTC and Department of Commerce's continuing commitment to a self-regulatory framework as a flexible and efficient approach to privacy protection. We welcome the agencies' ongoing examination of the various ways in which web site operators collect information about web site visitors and activity online and how web site operators can and should offer choice to consumers. The method the FTC and NTIA are now using - public workshops to explore both costs and benefits of emerging technologies with privacy implications - is exactly what is needed. Contacting companies when the FTC senses privacy is at risk and allowing the companies to craft a responsive self-regulatory approach benefits all involved -- consumers are protected, companies retain their ability to use the Internet to its fullest potential, and the government is able to leverage resources by relying on private sector organizations to monitor, audit, and enforce online privacy protection measures. We believe that the record shows that in the rapidly changing technology environment of the Internet, self-regulation is working well. When the FTC conducted its first privacy survey of web sites in early 1998, the results were not good - only 14 % of the sites gave users notice of how they handled personal information. A year later, a second survey, conducted by Mary Culnan, a Georgetown University researcher, found dramatic improvement - this time 66 % of the sites gave users notice of how they handled personal data. In this instance, the ad server companies that are instrumental in tracking online activity and creating online profiles have also stepped up to the self-regulatory challenge. These companies have committed to providing notice to consumers of information collection at web sites and, where personal information is collected, providing consumers with the ability to opt-out of collection and use of their data. Ten of the companies have banded together to form the Network Advertising Initiative. This Initiative will include a web site where consumers can learn more about ad targeting and online profiling technology. The web site will also contain links to the individual companies web sites, where extensive privacy policies explain the methods used and types of information collected in ad delivery, from clickstream data, and from online registrations. Where personally identifiable information is collected or combined with non-personally identifiable information, these companies offer visitors an opportunity to opt-out. Some of the companies go even further and offer opt-out for non-personally identifiable information. The Role for Web Site Publishers One of the concerns expressed by the FTC and NTIA is that visitors to web sites are not aware of ad server companies and the fact that the ad servers are compiling information about their online activities. While we believe that consumers are not uncomfortable with the concept of targeting for both advertising and editorial content, we believe they should be informed when a third-party ad server is compiling information over a network of web sites. At the workshop on November 8, the Direct Marketing Association unveiled changes to its privacy policy generator program. This program, available on the DMA web site, can be used by any web site operator to craft an appropriate privacy policy reflecting the information collection practices of that site. The new changes to the DMA privacy policy generator cover both the use of cookies by the web site as well as relationships with third-party ad servers. Using this tool or on their own, web sites can now inform visitors in their posted privacy notice about arrangements with ad server companies, the types of information collected by the web site as well as a general description of the data collected by the ad server company, and how to visit the ad servers web site to learn more about their privacy policy. MPA believes that web sites that use ad servers should notify consumers of the fact that the ad serving company may collect information and for what purpose and provide a mechanism for consumers to access the ad server company's privacy policy. This can be accomplished either by printing the Internet address of the ad server company in the web site's privacy policy or by providing a hyperlink from the web site's privacy policy to the ad server's privacy policy or the common web site of the network Advertising Initiative. We intend to send a notice to our membership to this effect. The Role for Ad Server Companies Ad server companies have the responsibility to ensure that their web sites and posted privacy policies accurately and completely inform consumers of their data collection policies. If the sites collect personally-identifiable information or combine information in ways that could be construed as personally-identifiable, consumers should be allowed to opt-out of such data collection. We do not believe that further governmental action is warranted at this time. Given the satisfactory progress in self-regulation of privacy on the Internet, the FTC and NTIA should allow web site operators and ad server companies to take responsibility to ensure that consumers receive notice of the data collection policies of both parties and an opportunity to opt out of collection and use of their personally identifiable information. Thank you for your consideration of our comments. Rita D. Cohen |