Citation[]
FTC Staff Report: Self-Regulatory Principles for Online Behavioral Advertising (Feb. 2009) (full-text).
Background[]
Over the last decade, the FTC has periodically examined the consumer privacy issues raised by online behavioral advertising — which is the practice of tracking an individual's online activities in order to deliver advertising tailored to his or her interests.
In November 2007, the FTC held a two-day “Town Hall,” which brought together numerous interested parties to discuss online behavioral advertising in a public forum. Participants at the Town Hall discussed the the potential benefits of the practice to consumers, including the free online content that online advertising generally supports, the personalized advertising that many consumers may value, and a potential reduction in unwanted advertising.
They also discussed the privacy concerns that the practice raises, including the invisibility of the data collection to consumers; the shortcomings of current disclosures about the practice; the potential to develop and store detailed profiles about consumers; and the risk that data collected for behavioral advertising — including sensitive data regarding health, finances, or children — could fall into the wrong hands or be used for unanticipated purposes.
The following month, in response to public discussion about the need to address privacy concerns in this area, FTC staff issued a set of proposed principles to encourage and guide industry self-regulation for public comment. This report summarized and responded to the main issues raised by more than 60 comments received. It also set forth revised principles.
Summary[]
On Federal 12, 2009, the Federal Trade Commission staff issued this report describing its ongoing examination of online behavioral advertising and setting forth revisions to proposed principles to govern self-regulatory efforts in this area. The key issue concerns how online advertisers can best protect consumers' privacy while collecting information about their online activities.
The report discusses the potential benefits of online behavioral advertising to consumers, including the free online content that advertising generally supports and personalization that many consumers appear to value. It also discusses the privacy concerns that the practice raises, including the invisibility of the data collection to consumers and the risk that the information collected — including sensitive information regarding health, finances, or children — could fall into the wrong hands or be used for unanticipated purposes. Consistent with the FTC's overall approach to consumer privacy, the report seeks to balance the potential benefits of online behavioral advertising against the privacy concerns it raises, and to encourage privacy protections while maintaining a competitive marketplace.
The report points out that most of the public comments the FTC received concern the scope of the proposed principles. For example, commenters discussed whether it is necessary to provide privacy protections for data that is not personally identifiable. In response, the report states that privacy protections should cover any data that reasonably can be associated with a particular consumer or computer or other device.
Also, commenters questioned the need to apply the principles to (1) "first party" behavioral advertising, in which a website collects consumer information to deliver targeted advertising at its site, but does not share any of that information with third parties, and (2) contextual advertising, which targets advertisements based on the Web page a consumer is viewing or a search query the consumer has made, and involves little or no data storage.
The report concludes that fewer privacy concerns may be associated with "first-party" and contextual advertising than with other behavioral advertising, and concludes that it is not necessary to include such advertising within the scope of the principles. The report notes, however, that regardless of the scope of the principles, companies must still comply with all applicable privacy laws, some of which may impose requirements that are similar to those established by the principles.
The report also provides additional guidance regarding each of the four principles and sets forth revised principles reflecting this guidance. The first principle — transparency and consumer control — remains unchanged from the proposed principles. Accordingly, websites are expected to provide clear and prominent notice regarding behavioral advertising, as well as an easily accessible way for consumers to choose whether to have their information collected for such purpose. Noting that privacy policies posted on companies' websites often are long and difficult to understand, the report encourages firms to design creative and effective disclosure mechanisms that are separate from their privacy policies. The report also states that companies that collect information outside the traditional website context — for example, through a mobile device or by an Internet service provider — should develop disclosure mechanisms that are meaningful and effective for these contexts.
In addition, the report continues to urge companies to provide reasonable security for any data they collect for behavioral advertising and to retain data only as long as it is needed to fulfill a legitimate business or law enforcement need.
As to the material change principle, the report clarifies that its focus is on retroactive changes — for example, material changes to a privacy policy that affect information a company collected prior to the changes. Accordingly, the principle has been revised to reflect that clarification. The report recognizes that prospective changes require a more flexible approach, and that depending on the circumstances, some form of prominent notice and opt-out choice may be sufficient.
Finally, due to the heightened privacy concerns raised by the collection and use of consumers' sensitive data, the report continues to urge companies to obtain affirmative express consent before collecting such data for behavioral advertising. The report states that FTC staff has traditionally considered financial information, information about children, health information, and Social Security numbers to be sensitive, but encourages stakeholders to develop more specific standards to address this issue.
The report was part of an ongoing process to examine online behavioral advertising that involves the FTC, industry, consumer and privacy organizations, and individual consumers. The report noted that significant work in this area remains, and that FTC staff will continue the public dialogue regarding the privacy issues raised by behavioral advertising.