FTC Releases Revised Principles for Self-Regulation of Online Behavioral Advertising

On February 12, the Federal Trade Commission (“FTC”) released a revised set of four principles for the self-regulation of online behavioral advertising. These principles are aimed at advancing four concepts: (i) transparency and control; (ii) reasonable security and limited data retention; (iii) informing consumers about policy changes; and (iv) consumer consent for use of sensitive data.

Background

Beginning in 1995, the FTC has examined and sought comment regarding the online marketplace and related privacy issues, including online behavioral advertising. Online behavioral advertising refers to the practice of tracking the online activities of internet users and targeting advertising in response to users’ specific interests and online behavior. The privacy concerns related to this practice include the potential for detailed consumer profiling, consumers’ lack of knowledge concerning what personal information is known by advertisers and the risk of misuse of consumer data. At the same time however, as the FTC itself has acknowledged, there are certain ways in which consumers may benefit from behavioral advertising. These potential benefits include having access to free online content supported by behavioral advertising and receiving personalized offers of products and services likely to be of interest. In addition, because online behavioral advertising generates very targeted offers and ads, consumers, through its use, may even see a possible reduction in advertising for products and services for which they have no interest.

In December 2007, the FTC released a set of principles governing online behavioral advertising. The FTC received comments on the principles, and responded to those comments in its FTC Staff Report released February 12, 2009 titled Self-Regulatory Principles For Online Behavioral Advertising (“the Principles”). A discussion of the Principles follows below.

The Principles

Transparency and Consumer Control

This Principle provides that a website utilizing behavioral advertising should provide a clear, concise, consumer-friendly and prominent statement that behavioral data is being collected. Such a statement should also provide that consumers can choose whether or not to participate. Websites are encouraged to provide consumers with a clear method for exercising the opt-out option.

Security and Data Retention Policies

Websites that collect and store user data are encouraged by this Principle to use reasonable security measures to guard that data. Factors to consider in determining the appropriate level of security include the sensitivity of the data, the risks a company faces, the nature of the business and the availability of reasonable protections to the company.

Express Consent for Material Changes

The company should obtain consumer consent before it uses previously collected data in a way that differs materially from the privacy policy that existed at the time the data was collected. For example, if an acquisition prompts a change in the use of collected data, this Principle encourages the surviving corporation to obtain consumer consent for the new policy.

Express Consent to Use of Sensitive Information

The fourth Principle urges companies to collect sensitive data via behavioral advertising only after a consumer expressly consents to its collection. Such data would include, for example, health information, Social Security numbers and information about children.

Conclusion

Although the Principles are advisory, these recent developments in the FTC’s approach to online behavioral advertising have been described by Commissioner Jon Leibowitz as “the last clear chance to show that self-regulation can – and will – effectively protect consumers’ privacy in a dynamic online marketplace.”  In this fluid and ever-changing field, it is important for companies with an Internet presence to be aware of FTC developments in the area. Companies that utilize behavioral advertising should not assume that existing privacy policies and methods of communicating those policies are adequate to address the Principles. Given the FTC’s interest in behavioral advertising and Commissioner Leibowitz’s statements, companies should take a fresh look at their privacy policies and, possibly, the methods by which they communicate those policies to users of their website.

In addition, companies should remain vigilant about additional developments in this area, as there is a possibility that the current emphasis on self-regulation may not continue for very long. With consumer groups and privacy advocates concerned about online advertising and frustrated with the self-regulatory approach, the pressure is mounting for greater regulation in this area. Tougher state regulation remains a very real possibility as well. In the past few years, many states have been focusing on various issues concerning privacy (including efforts directed at data security, RFID privacy and confidentiality of social security numbers), and certain states have already begun to focus on this particular issue. Also, a current class action lawsuit against a behavioral targeting company and multiple Internet service providers may have a major impact on the future of behavioral advertising. It is an issue that merits close attention for 2009, as further developments are likely.