ADOTAS — Although the FTC allows self-regulation by companies which practice behavioral targeting, it wants companies to do a better job of protecting consumers.
If behavioral targeting practitioners do not inform consumers of being behaviorally targeted or misuse the information they collect, Congressional legislation or FTC regulation could be passed. Previously on Adotas, we covered how the FTC is monitoring behavioral advertising.
The group that is currently guiding self-regulation of behavioral advertising includes the Interactive Advertising Bureau, the American Association of Advertising Agencies (4A’s), the Direct Marketing Association, the Association of National Advertisers, the Council of Better Business Bureaus (BBB), and various businesses, consumers, and stakeholders. The main concern of this cross-industry group is that the proposed principles would constrain access to information that would be beneficial to internet marketers.
Companies like Google and Yahoo also have a say, according to FTC Director Charles Harwood. Facebook, for instance, argues the need for distinction between personal and non-personally identifiable information. The company is in favor of transparent data collection and control of what happens when the data is collected. Meanwhile, Google calls for the creation of privacy laws that would build consumer trust.
The FTC encourages the existence of privacy statements on all Internet websites where any information is collected. According to Harwood, companies must adhere to their own policies. If the manner in which data is collected changes, consumers should be notified and required to provide affirmative consent before further information can collected.
“Where we found that policy is misrepresented in a company’s actual practices,” said Harwood, “the FTC has filed lawsuits to require the company to post an accurate policy and to implement strict standards to ensure that company adheres to the policy.”
Behavioral Targeting
Is opting in or opting out of behavioral advertising an effective means of privacy control? Harwood thinks it’s more complicated. It may be ineffective if consumers do not know what they opt into or opt out of. When consumers opt out, they think they are opting out of all tracking activities, which may not be the case. To consumer advocates, they may really just be opting out of better targeted ads.
So what is FTC’s take on this? It’s inherent in the guidelines that consumers should have the choice of deciding whether they want their information collected, said Harwood, but he also noted that companies do not want to give consumers that option. If companies told consumers they do not have a choice, whether or not it is a violation of the FTC Act depends on the information collected.
In FTC guidelines, certain kinds of PII (personally identifiable information) should be collected only if consumers opt in about consumers are required to be manually opted into. Some information should not be collected at all, said Harwood, such as medical information and information about children unless parents are involved. The NAI (Network Advertising Initiative) agrees, and proposes that information of children under 13 not be used for behavioral targeting. This is currently permitted with parental consent.
The lack of transparency from companies about how information is used collected is an issue that concerns frustrates the FTC. Beyond serving behaviorally targeted ads, companies may not be are not disclosing other uses of the information that they collect, said Harwood. Perhaps the data is combined with other sensitive PII, or even being used to engage in price discrimination, which potentially violates the FTC Act.
According to Harwood, Chairman Jon Leibowitz has indicated the FTC may issue a CIDs (civil investigative demand), a type of subpoena, to help FTC understand how behavioral targeting data is combined with other data for uses beyond serving ads. The FTC can seek court enforcement for failure to respond may lead to fines and imprisonment.
The FTC may pursue voluntary standards, but it is up to the industry to keep itself in check. Within the February 2009 release, Leibowitz stated that the “industry needs to do a better job of meaningful, rigorous self-regulation or it will certainly invite legislation by Congress and a more regulatory approach by our Commission.
Put simply, this could be the last clear chance to show that self-regulation can – and will – effectively protect consumers’ privacy in a dynamic online marketplace.”
