FTC Staff Revises Online Behavioral Advertising Principles

Federal Trade Commission staff today issued a report describing its ongoing examination of online behavioral advertising and setting forth revisions to proposed principles to govern self-regulatory efforts in this area. The key issue concerns how online advertisers can best protect consumers’ privacy while collecting information about their online activities.

Over the last decade, the FTC has periodically examined the consumer privacy issues raised by online behavioral advertising – which is the practice of tracking an individual’s online activities in order to deliver advertising tailored to his or her interests. The FTC examined this practice most recently at its November 2007 “Behavioral Advertising” Town Hall. The following month, in response to public discussion about the need to address privacy concerns in this area, FTC staff issued a set of proposed principles to encourage and guide industry self-regulation for public comment. Today’s report, titled “Self-Regulatory Principles for Online Behavioral Advertising,” summarizes and responds to the main issues raised by more than 60 comments received. It also sets forth revised principles.

The report discusses the potential benefits of behavioral advertising to consumers, including the free online content that advertising generally supports and personalization that many consumers appear to value. It also discusses the privacy concerns that the practice raises, including the invisibility of the data collection to consumers and the risk that the information collected – including sensitive information regarding health, finances, or children – could fall into the wrong hands or be used for unanticipated purposes. Consistent with the FTC’s overall approach to consumer privacy, the report seeks to balance the potential benefits of behavioral advertising against the privacy concerns it raises, and to encourage privacy protections while maintaining a competitive marketplace.

The report points out that most of the public comments the FTC received concern the scope of the proposed principles. For example, commenters discussed whether it is necessary to provide privacy protections for data that is not personally identifiable. In response, the report states that privacy protections should cover any data that reasonably can be associated with a particular consumer or computer or other device.

Also, commenters questioned the need to apply the principles to (1) “first party” behavioral advertising, in which a Web site collects consumer information to deliver targeted advertising at its site, but does not share any of that information with third parties, and (2) contextual advertising, which targets advertisements based on the Web page a consumer is viewing or a search query the consumer has made, and involves little or no data storage. The report concludes that fewer privacy concerns may be associated with “first-party” and “contextual” advertising than with other behavioral advertising, and concludes that it is not necessary to include such advertising within the scope of the principles. The report notes, however, that regardless of the scope of the principles, companies must still comply with all applicable privacy laws, some of which may impose requirements that are similar to those established by the principles.

The report also provides additional guidance regarding each of the four principles and sets forth revised principles reflecting this guidance. The first principle – transparency and consumer control – remains unchanged from the proposed principles. Accordingly, Web sites are expected to provide clear and prominent notice regarding behavioral advertising, as well as an easily accessible way for consumers to choose whether to have their information collected for such purpose. Noting that privacy policies posted on companies’ Web sites often are long and difficult to understand, the report encourages firms to design creative and effective disclosure mechanisms that are separate from their privacy policies. The report also states that companies that collect information outside the traditional Web site context – for example, through a mobile device or by an Internet Service Provider – should develop disclosure mechanisms that are meaningful and effective for these contexts.

In addition, the report continues to urge companies to provide reasonable security for any data they collect for behavioral advertising and to retain data only as long as it is needed to fulfill a legitimate business or law enforcement need.

As to the material change principle, the report clarifies that its focus is on retroactive changes – for example, material changes to a privacy policy that affect information a company collected prior to the changes. Accordingly, the principle has been revised to reflect that clarification. The report recognizes that prospective changes require a more flexible approach, and that depending on the circumstances, some form of prominent notice and opt-out choice may be sufficient.

Finally, due to the heightened privacy concerns raised by the collection and use of consumers’ sensitive data, the report continues to urge companies to obtain affirmative express consent before collecting such data for behavioral advertising. The report states that FTC staff has traditionally considered financial information, information about children, health
information, and Social Security numbers to be sensitive, but encourages stakeholders to develop more specific standards to address this issue.

Today’s report is the next step in an ongoing process to examine online behavioral advertising that involves the FTC, industry, consumer and privacy organizations, and individual consumers. The report notes that significant work in this area remains, and that FTC staff will continue the public dialogue regarding the privacy issues raised by behavioral advertising. In the coming year, staff also will evaluate self-regulatory programs and will conduct investigations, where appropriate, to determine whether practices in this industry violate Section 5 of the FTC Act. The Commission vote to approve the report was 4-0, with separate concurring statements from Commissioners Jon Leibowitz and Pamela Jones Harbour:

“This staff report, while commendable, focuses too narrowly,” Harbour said. “Threats to consumer privacy abound, both online and offline, and behavioral advertising represents just one aspect of a multifaceted privacy conundrum surrounding data collection and use. I would prefer that the Commission take a more comprehensive approach to privacy, and evaluate behavioral advertising within that broader context.”

“Industry needs to do a better job of meaningful, rigorous self-regulation, or it will certainly invite legislation by Congress and a more regulatory approach by our Commission,” Leibowitz said. “Put simply, this could be the last clear chance to show that self-regulation can – and will – effectively protect consumers’ privacy in a dynamic online marketplace.”

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC ’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 1,500 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s Web site provides free information on a variety of consumer topics.