FTC Proposes Behavioral Advertising Privacy Principles

To address consumer privacy concerns associated with Behavioral Targeting FTC proposed privacy principals.

The purpose of this proposal is to encourage more meaningful and enforceable self-regulation to address the privacy concerns raised with respect to behavioral advertising. In developing the principles, FTC staff was mindful of the need to maintain vigorous competition in online advertising as well as the importance of accommodating the wide variety of business models that exist in this area,” according to its proposal “Behavioral Advertising: Moving the Discussion Forward to Possible Self-Regulatory Principles. The proposal states that behavioral advertising provides benefits to consumers in the form of free content and personalized advertising but notes that this practice is largely invisible and unknown to consumers.

Below are the principal they proposed:

• Every Web site where data is collected for behavioral advertising should provide a clear, consumer-friendly, and prominent statement that data is being collected to provide ads targeted to the consumer and give consumers the ability to choose whether or not to have their information collected for such purpose.
  
  Sooner or later that is going to be almost every site that you encounter. Since there is no common definition of Behavioral Targeting any targeting (since it will uses onsite behavior, geo or any data collected from users ) can be considered behavioral targeting.
  
  Give consumers the ability to choose whether or not to have their information collected for such purpose - it is not clear if they mean opt-in or opt-out.
  
  I am in favor of providing an opt-in instead of opt-out. In my post on Google and Doubleclick privacy concerns, I wrote:
  I believe that if consumers are provided proper education (I will write about consumer benefits in one of my future posts) than they can infect benefit from Behavioral Targeting. It will be a win-win situation for all the parties involved. Proper education and disclosures by advertisers, publishers and networks will ease the concerns regarding Behavioral Targeting. Consumers have the right to opt out of Behavioral Targeting but what is lacking is proper education on how to do so. The networks currently opt-in users by default; however, in my opinion the proper process should be opt-out by default and opt-in if user chooses to opt-in, just like we do for emails and newsletters. This process will move the burden from users to the advertisers, publishers and networks.
  



• Any company that collects or stores consumer data for behavioral advertising should provide reasonable security for that data and should retain data only as long as is necessary to fulfill a legitimate business or law enforcement need.
  
  “Reasonable” is very vague since every company can define it’s own explanation of reasonable.
  
  


• Companies should obtain affirmative express consent from affected consumers before using data in a manner materially different from promises the company made when it collected the data.
  
  This is to safeguard against changing privacy policies. Since almost all the privacy policies have a clause which says something like “We reserve the right to change this privacy policy. New privacy will be posted on this page”. It is hard for consumers to keep track of what has changed since they agreed to the privacy policy.
  


• To address the concern that sensitive data – medical information or children’s activities online, for example – may be used in behavioral advertising, FTC staff proposes:
  
  
  • Companies should only collect sensitive data for behavioral advertising if they obtain affirmative express consent from the consumer to receive such advertising.
  
  
  • FTC staff also seeks comment on what constitutes “sensitive data” and whether the use of sensitive data should be prohibited, rather than subject to consumer choice.
  
  
  
  My opinion: Sensitive data should be prohibited. However it won’t be easy to define what constitutes sensitive data especially when it has to apply to various countries and cultures. Sensitive information in one country might not be sensitive in another country or culture.
  

Comments? Questions?