Neither a Retreat Nor an Imprimatur
The online advertising industry took a collective deep breath Thursday as the Federal Trade Commission issued its much-anticipated report outlining self-regulatory guidelines for the online behavioral advertising. Although behavioral ad networks already follow their own voluntary guidelines in the Network Advertising Initiative (which was updated just two months ago), we think it’s pretty clear from the report, and from comments from the Commission, that the FTC does not find existing self-regulatory efforts to be sufficient. As Commissioner Jon Leibowitz noted in his statement endorsing the report, this could be the industry’s "last clear chance to show that self-regulation can – and will – effectively protect consumers’ privacy." In her concurring statement, Commissioner Pamela Jones Harbour noted legislation’s place in a "comprehensive privacy agenda" and expressed doubts about the efficacy of self-regulation. Having a regulatory agency issue self-regulatory guidelines is essentially the last step before regulation comes into play. The question is whether the industry will step up. The FTC report raises the self-regulatory bar in a number of ways. The FTC wrote its principles to apply to all behavioral advertising data that "reasonably could be associated with a particular consumer or with a particular computer or device." The FTC rightly notes that the line between Personally Identifiable Information (PII) and non-PII is blurring, and we’re glad to see them shirk antiquated definitions of PII in favor of an approach more tailored to the realities of online data collection. The standard that the FTC sets out for disclosure is also higher than anything in existing self-regulation. We’re hopeful that online ad companies will apply their immense creative and innovative skill in designing "clear, concise, consumer-friendly and prominent" disclosures about behavioral advertising — outside of their privacy policies – as recommended by the FTC. The FTC has exempted contextual advertising, narrowly defined, from its guidelines. Some ambiguity remains about exactly what constitutes contextual advertising: the discussion in the report limits the definition to "the delivery of ads based upon a consumer’s current visit to a single web page or a single search query, without the collection and retention of data about the consumer’s online activities over time," but the definition in the principles themselves lacks the language about collection and retention. The narrower definition leaves a broad array of practices to be covered under the FTC regime, which is what we and many others submitting comments to the agency wanted to see. Lastly, the guidelines require affirmative, express consumer consent for behavioral advertising that makes use of sensitive information. Read that sentence again. The FTC’s view is that, at the very least, sensitive information includes health information, financial information, social security numbers, precise geographic location information, and information about children. This list is very similar to the one we suggested to them in our comments about the draft principles. One Step Forward, Two Steps Back Unfortunately, the principles also come up short on several accounts, especially on what the Commission decided not to address. Perhaps most disappointing is that the FTC did not directly address behavioral advertising that makes use of Internet traffic data from ISPs. We had urged the FTC to adopt an affirmative, express consent standard for this model, but the principles merely say that "alternative methods" of disclosure and choice need to be developed for ISP behavioral advertising or similar models that collect equal amounts of data on consumer. We were hoping for a stronger standard. The FTC also side-stepped the issue of requiring consumer choice mechanisms to be more effective than they have been to date. The majority of the online ad industry still relies on the much-derided opt-out cookie to effectuate consumer choice, and we had hoped the FTC would intervene to spur the development of more robust controls. Instead, the FTC punted this responsibility, encouraging "interested parties to examine this issue." Finally, when the FTC guidelines were first introduced in draft form, the staff asked for input about secondary uses of behavioral data. Citing a lack of responses, the FTC report makes no recommendations in this area. Commissioners Leibowitz and Harbour both suggest that the agency may need to use its subpoena authority to further investigate this issue, and we hope to see the agency use its full arsenal of investigative tools to uncover how behavioral data is used beyond the advertising context. Commissioner Leibowitz explained that the FTC report should be "viewed neither as a regulatory retreat by the Agency nor as an imprimatur for current business practice." While the guidelines represent progress, much work lies ahead – certainly for online companies, but also for the FTC and Congress, both of which we hope to see employing regulatory tools where self-regulation falls short. Our collective exhalation is merely the first step.