Enter the Advertisers

Given how much advertising we all see, especially online, you know it means something when the entire advertising industry gets together to make an announcement. Today, the advertising industry, as represented by a cohort of trade associations, joined together to publish their own self-regulatory principles, with an aim toward increasing privacy protection for online behavioral advertising. It’s encouraging to see the advertisers move into the privacy fray here (although not entirely surprising). For nearly a decade, the self-regulatory space has been dominated by the Network Advertising Initiative, which has historically included only third-party ad networks, which comprise just a small sliver of the industry. But when the FTC issued its own suggested self-regulatory principles earlier this year, the guidance from the agency wasn’t limited to any particular advertising sector. The advertising associations appear to have gotten the message, and have tailored their principles in rough accordance with the FTC’s recommendations. The advertiser principles incorporate many of the ideas that we and others have previously suggested to both the FTC and the NAI. The transparency principle includes a robust framework for providing notice outside of privacy policies, and lays the groundwork for development of a uniform link or icon that would appear on any web site or advertisement where data is collected or used for behavioral advertising. The principles explicitly address business models that may rely on the collection of all or substantially all of a consumer’s Web traffic for behavioral advertising (including ISP-based models), requiring a higher standard for choice than is required of the more traditional Web-based model. And the principles provide for strong enforcement through existing and to-be-created compliance programs. In some areas, though, the principles don’t go far enough. For example, we had suggested to both the FTC and the NAI that the notion of "sensitive information" needed to cover a broad array of data types, including health information and location data. The advertiser principles cover only a very limited subset of medical information and leave out location data altogether. The principles are also silent about consumer access to the behavioral data collected about them. Google has demonstrated that providing profile access is possible, and we would expect the rest of the industry to follow suit. But the real test for these principles lies not in their ability to withstand the scrutiny of CDT and others, but in how the advertising industry actually implements them. The advertising and privacy communities have been talking and writing about improving self-regulation for months and years on end. Here at CDT, we’re ready to see how the industry puts all of those words into action. Six months from now is when we’ll know how good or bad these guidelines really are.