On November 1st and 2nd, the Federal Trade Commission (FTC) hosted a 2-day workshop "to address the consumer protection issues raised by the practice of tracking consumers’ activities online to target advertising – or ‘behavioral advertising.’"

A copy of the Agenda (which includes all the presentations made) can be found at: http://www.ftc.gov/bcp/workshops/ehavioral/agenda.pdf.

For companies that collect, use or maintain a consumer’s activities online – whether by employing third-party network advertisers, providing contextual or behavioral advertising solely within their own or related websites, or even possibly displaying non-advertising information (such as news stories or business intelligence) — the Town Hall discussions and potential follow-on actions by the FTC and Congress are worth careful monitoring. There are several areas where further investigations, and even enforcement actions, may be likely.

For the FTC, Internet advertising includes "the searches the consumer has conducted, the Web pages visited, and the content the consumer has viewed. The information is then used to target advertising to the consumer that is intended to reflect the consumer’s interests, and thus increase the effectiveness of the advertising." The FTC examined similar issues in June of 2000, when it held a public workshop and issued two reports on the practice of online profiling. (See Online Profiling: A Federal Trade Commission Report to Congress found at: www.ftc.gov/os/2000/06/onlineprofilingreportjune2000.pdf.) Because the FTC believes that "technology advances and the evolution of business models since that time have raised concerns by consumer advocates, privacy experts, and others about the implications of data collection in online advertising now and in the future," the consumer protection agency convened this two-day gathering.

At minimum, companies that utilize behavioral or contextual advertising — whether by employing third-party network advertisers or on their own sites, especially through affiliates sites — need to review their privacy policies to make sure that they accurately reflect their practices involving customer personally identifiable information (PII) for advertising purposes. Because some of the questions raised at the Town Hall touch on data aggregated from various points of collection, use or maintenance, companies should also be sure to review this area of practice as well.

Following is a brief overview of some possible results and industry risks that could emerge from the Town Hall and the FTC’s focus in general (this is not intended to be an exclusive list, nor in any particular order).

Congressional Attention

Our Washington insiders report that the FTC intends to prepare a "staff report" to Congress as a follow-on to the Town Hall. (A "staff report" does not necessarily have to receive formal approval from the FTC.) It can be expected that in preparation of the report, FTC staff may attempt to talk to companies who have been identified as leaders in behavioral targeting. At the Town Hall, FTC staff expressed frustration that more "publishing" companies and brand advertisers did not offer to participate. In addition to being an "education document" (along the lines of the 2000 Report), this report could have recommendations for best practices, and may examine broader issues of collection of consumer information through Internet advertising regimes.

The combination of this workshop and the pending Report will likely prompt further Congressional investigation. Already, some members of Congress are urging action. On the eve of the Town Hall, Congressman Edward Markey (D-MA), a senior member of the House Energy & Commerce Committee, called on the FTC to "promptly investigate the privacy impacts of Internet tracking and targeting techniques to ensure that loss of privacy is not the price consumers must pay to realize the benefits of online commerce." (See "Markey Urges FTC To Protect Consumers From Invasive Web Ads" (Nov. 1, 2007) at: http://markey.house.gov/index.php?option=com_content&task=view&id=3176&Itemid=141.) Hearings could come early in the next Session of Congress.

Further Examination Of Self-Regulatory Efforts

The Town Hall meeting was designed to focus on the strengths and weaknesses of the National Advertising Initiative (NAI) and other privacy self-regulatory models in the advertising and marketing space, as well as the effectiveness of other self-regulatory models. The summary provided at the beginning of this update includes details of those discussions. The NAI notice-and-choice model came under special scrutiny, with consumer advocates arguing that it has failed in a number of ways: consumers are unaware of the existence of NAI and the practices of its members; consumers are not selecting the NAI opt-out cookie, consumers find it difficult to opt-out, the cookie itself is fragile and susceptible to easy deletion, and new technologies may be circumventing the cookie and reducing its effectiveness. In addition, they noted the lack of enforcement as a key problem for self-regulatory models in general, and NAI in particular; and the fact that self-regulatory models are essentially voluntary for companies in participation.

A major announcement by several consumer privacy groups the day before the Town Hall advocating a "Do Not Track" proposal was widely reported in the media and was the subject of several panel discussions. In general, it would require any advertising entity that sets a persistent identifier on a user device to provide to the FTC the domain names of the servers or other devices used to place the identifier. Companies providing web, video, and other forms of browser applications would provide functionality (i.e., a browser feature, plug-in, or extension) that allows users to import or otherwise use the "Do Not Track" List of domain names, keep the list up-to-date, and block domains on the list from tracking their Internet activity. The "Do Not Track" List is envisioned to be available on the FTC Web site for download by consumers who wish to use the list to limit tracking. For more information on the proposal and an illustration, see the following links:

While riding the name recognition of the "Do Not Call" Registry for telemarketing, the "Do Not Track" proposal is quite different and is very much a work in progress with many questions about its operations unanswered. For example, it could require some major technical changes in the way that available browsers currently operate. It is also likely that site-specific websites would be within the scope of this proposal — not just websites that employ third-party network advertisers. This proposal, and similar efforts, can be expected to be examined by the FTC and Congress as part of the "self-regulatory" agenda. If ever adopted, such a registry would likely have a fundamental impact on companies and their Internet presence.

FTC Enforcement Actions

Positioning of comments and statements made at the Town Hall could lead one to reach a conclusion that FTC staff is looking to bring enforcement actions, though the specific scope of such actions remains to be defined. Among the possible areas of further inquiry that may lead to actions are the following:

  • Advertising Targeting or Affecting Children. FTC Commissioner Jon Leibowitz highlighted his concern that "online tracking and targeting is especially worrisome when it involves our children. … When Congress passed the Children’s Online Privacy Protection Act, it clearly recognized that young children deserve special protections in cyberspace. To that end, COPPA imposes certain requirements before websites may collect personal information from children under the age of 13. … But today, is that really enough? … the online ads that target children aren’t always appropriate for their age. They see ads with titles like, "How Long Is Your Next Kiss," and "Touch Me Harder." The FTC’s most recent Report on marketing violent entertainment products to children seems to confirm some disturbing practices in this area. For example, sites like MySpace ran banner ads for R-rated movies, even though the site reaches a large number of children under 17. …We enacted COPPA to place a parental buffer between advertisers and our children — but the rise of sophisticated behavioral marketing techniques is eroding this parental control."

The FTC has a long track record in the area of children’s advertising, underscoring the potential for FTC scrutiny, although children's advertising and "behavioral targeting" are distinct legal and policy areas. It is unclear whether the Commission could actually combat some of these practices by enforcement against companies that are "behavioral targeting." But the discussion at the Town Hall suggests that this could be an area of FTC enforcement action.

  • Inadequate Disclosures of Privacy Policies. The Town Hall brought out a plethora of complaints from privacy advocates. In the context of internet advertising, however, the issue was raised as a question (How much personally identifiable information is actually collected, used or maintained?); as a potential question of whether the current definition of PII is adequate; and whether information that is collected is sold or distributed to third parties.

As Commissioner Leibowitz stated, "I am concerned when my personal information is sold to or shared with third parties — or when my online conduct is monitored across several websites or across different web-based services — especially when there is no effective notice or consent to these practices. And it should really trouble all of us that seemingly anonymous searching and surfing can be traced back to specific individuals — and that not all information that companies have collected about us is secure from data breaches or release."

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.