FTC Staff Report Reaffirms Self Regulation of Online Behavioral Advertising

This posting was written by Jeffrey May, Editor of CCH Trade Regulation Reporter.

The Federal Trade Commission staff has issued a report seeking to encourage meaningful self regulation of online behavioral advertising—the practice of tracking an individual’s online activities in order to deliver advertising tailored to the individual’s interests.

The agency is calling on marketers that collect information about consumers’ online activities to refrain from engaging in conduct that raises genuine consumer privacy concerns. At the same time, the FTC seeks to avoid interfering with practices—or stifling innovation—where privacy concerns are minimal.

The February 12 report, available here on the FTC website, is part of an ongoing examination of online behavioral advertising by the FTC. In December 2007, the agency issued a set of proposed principles to encourage and guide industry self regulation for public comment.

The four principles provide for transparency and consumer control and reasonable security for consumer data, according to the agency. Further, they call on companies to obtain consent from consumers before they use behavioral data in a manner that is materially different from promises made when the information was collected and before they collect and use sensitive consumer data for behavioral advertising.

In response to the request for comments on the proposed principles, 63 comments were received. The staff has now revised some of the principles and narrowed their scope in light of the comments.

Transparency and Consumer Control

Under the first principle—transparency and consumer control—Web sites are expected to provide clear and prominent notice regarding behavioral advertising, as well as an easily accessible way for consumers to choose whether to have their information collected for such purpose. The report encourages firms to design creative and effective disclosure mechanisms that are separate from their privacy policies. The revised principle recommends that, for data collection outside the traditional website context, companies should develop alternative methods of disclosure and consumer choice.

Reasonable Security, Limited Data Retention

The second proposed principle calls upon companies to provide reasonable security for, and limited retention of, consumer data collected for behavioral advertising purposes. The protections should be based on the sensitivity of the data and the nature of a company's business operations, the types of risks a company faces, and the reasonable protections available to a company. The principle was amended to specify that companies should not retain data longer than necessary to fulfill legitimate business needs.

Consent for Changes to Privacy Promises

The third principle calls upon companies to obtain affirmative express consent before they use data in a manner that is materially different from the promises the company made at the time of collection. The staff revised the material change principle to make clear that it applies to retroactive changes only.

Consent to Use of Sensitive Data

The fourth principle states that companies should collect sensitive data only for behavioral advertising after they obtain affirmative express consent from the consumer to receive the advertising. Despite feedback from a number of commenters, the staff continues to believe that affirmative express consent is warranted, according to the report.

“First-Party” and “Contextual” Advertising

The staff agreed with comments that the principles should be narrowed to exclude “first-party” and “contextual” advertising from the scope of the principles. First party behavioral advertising involves a Web site’s collection of consumer information to deliver targeted advertising at its site without sharing of information with third parties. Contextual advertising is advertising based on the Web page a consumer is viewing or a search query the consumer has made, and involves little or no data storage.

According to the staff report, fewer privacy concerns are associated with first-party and contextual advertising than with other behavioral advertising. Thus, it is not necessary to include such advertising within the scope of the principles.

Compliance with Existing Privacy Laws

The report cautioned, however, that companies must still comply with all applicable privacy laws, some of which may impose requirements that are similar to those established by the principles. A number of the agency’s actions raising consumer privacy issues have involved companies’ alleged failures to live up to promises they made regarding the privacy and confidentiality of the consumer information they collect.

Most recently, the FTC issued a complaint and proposed consent order against geeks.com, an online seller of computer supplies and other consumer electronics, for allegedly failing to provide reasonable security to protect sensitive customer data, despite claims that it took reasonable and appropriate measures to protect personal information from unauthorized access (CCH Trade Regulation Reporter ¶16,260).

Separate Concurring Statements

Both Commissioners Jon Leibowitz and Pamela Jones Harbour voted in favor of issuing the staff report. However, they issued concurring statements.

Commissioner Leibowitz cautioned that the report's endorsement of self-regulation should not be viewed as a regulatory retreat by the agency or an imprimatur for current business practice. He said: “this could be the last clear chance to show that self-regulation can—and will—effectively protect consumers' privacy in a dynamic online marketplace.”

Commissioner Harbour said that she had hoped that the Commission would take a more comprehensive approach to privacy and evaluate behavioral advertising within that broader context. She suggested that the staff complete by Summer 2010 a report that evaluates the efficacy of self-regulation in the realm of behavioral advertising. In light of a number of unanswered questioned and the need for a comprehensive approach, Commissioner Harbour said that “a legislative approach to behavioral advertising is not prudent at this time.”

The staff report on Self-Regulatory Principles for Online Behavioral Advertising and the separate commissioner statements appear at CCH Trade Regulation Reporter ¶50,240.