The Federal Trade Commission (FTC) has just issued proposed self-regulatory principles to address what they perceive to be privacy concerns raised by “behavioral advertising.” Behavioral advertising is broadly defined in the proposal as “tracking of a consumer’s activities online – including the searches the consumer has conducted, the Web pages visited, and the content viewed – in order to deliver advertising targeted to the individual consumer’s interests.” The staffproposed principles were issued as a follow-up to the FTC’s 2006 public “Tech-ade” hearings as well as the FTC’s recent Town Hall “Ehavioral Advertising: Tracking, Targeting, and Technology.”

The FTC has requested comments on the principles from all interested parties by February 22, 2008. It should be noted that the draft principles were released on the same day the FTC approved the Google-DoubleClick merger; some analysts speculate that the principles are in part in response to consumer advocate opposition of the merger, primarily on privacy grounds.

When introducing the draft principles, the FTC staff recognized the consumer benefits associated with behavioral advertising, but also noted (1) the lack of consumer awareness about the practice; (2) business and community group desire for transparency and consumer autonomy for data collected about consumers’ online behavior; and (3) the danger of unforeseen uses of such data. These premises underlie the following principles outlined in the staff proposal: 

  • Disclosure: All Web sites should provide a “clear, consumer-friendly, and prominent statement” about any data collected to provide targeted ads. Web sites should allow consumers to easily exercise the option of whether they want to permit such collection. 
  • Security: Companies that collect or store behavioral advertising-related data should protect the data with reasonable security measures and retain data only as long as is necessary to fulfill a legitimate business or law enforcement need. Staff specifically requested comment with respect to the feasibility and desirability of reduced data retention time limits. 
  • Material Changes to Privacy Policies: Companies should obtain “affirmative express consent” from consumers before using their consumer data in a manner “materially” different from any company promise made at the time of the data collection. 
  • Sensitive Data Collection: Companies should limit collection of sensitive data (an undefined term for which the FTC also seeks comment) for behavioral advertising to consumers who have provided affirmative express consent to receive such advertising.

Alternatively, the FTC asked whether the use of sensitive data should be prohibited in behavioral advertising overall.

Finally, the FTC included a request for additional information about whether companies currently use tracking data for purposes other than behavioral advertising and if such practices should be subject to heightened protection. Interestingly, with respect to this single issue, the FTC asked for comment on whether there is a distinction with respect to the concerns raised by use of personally identifiably information (i.e., information that can be associated with a particular individual such as name and contact information) versus non-personally identifiable information. The remaining principles do not note any such distinction or recognize the need for different standards for personally identifiable information or non-personally identifiable information. Not differentiating between personally identifiable and non-personally identifiable information is a systemic shift for the FTC in the area of online privacy.

The scope of these staff-drafted principles are quite broad. If not narrowed following public comments, these principles could create significant additional obligations for online activities. Even though the principles are only "suggestions" from FTC staff, the final principles will indicate what staff considers to be "appropriate" with regard to behavioral advertising and online activities. The proposed self-regulatory structure could affect any company that engages in Internet advertising or allows online advertising to be served on its Web site. This is particularly true for companies that currently, or plan to, engage in any online tracking of consumer behavior or allow third parties to do so on their Web sites for use in ad delivery (whether only on their own Web site or across third party sites).

One of the unresolved questions for any company with an online privacy policy is the practicality of obtaining “affirmative express consent” before making material changes to the way consumer data is used. FTC staff specifically noted that this principle would also apply in a corporate merger if the transaction would affect the way the consumer information is collected, used, or shared. While many companies already provide individual notice for major privacy policy changes, the proposal’s suggestion that individual notice must be given for any material change in data use and that opt-in consent should be obtained may ignore the nature of online activity and the potentially cumbersome reality of notifying all site visitors of any change in data collection and use practices. The lack of clarity of what would constitute “material” changes may make this principle particularly troubling for online companies. This draft principle on material changes will likely be the subject a great deal of industry comments and proposals for modification, although as drafted this provision is likely strongly supported by consumer activists.

Notably these principles place stricter limits on behavioral advertising than other forms of online activity. Thus, while the FTC notes the benefits of online targeting, staff is clearly responding to calls from consumer groups to limit the practice. However, the principles are vague (likely deliberately) and ripe for industry comment. Comments are due on February 22, 2008; Hogan & Hartson can assist in the preparation of comments as needed.