Behavioral marketing, generally speaking, means targeting consumers with online ads or marketing information based on what they do online. Using anonymized data, ISPs, site owners or ad networks are able to provide content more relevant to the interests of an individual, making ads more effective. A growing privacy concern surrounds the collection and storage for behavioral marketing purposes of personal data which, though anonymized, might create the potential for acquisition and de-anonymization by government or wrongdoers.
The technologies for behavioral marketing range from contextual single website targeting (like the suggestions on Amazon.com) to ad networks using cookies, to the use by ISPs of deep packet inspection ("DPI") methodologies. In this context, DPI examines data in a packet as it passes an inspection point, searching for predefined criteria which allow the creation of anonymized user profiles to serve targeted advertisements through ad networks.
Testing of behavioral tracking technology in the United States by a few regional ISPs led to Congressional hearings in 2008. Members of
Congress expressed concern over whether consumers were receiving adequate notice of the tracking and whether they were given effective choice about whether to be tracked. Large ISPs AT&T, Verizon, Time-Warner Cable, and Comcast each committed that, to the extent they were to engage in DPI behavioral tracking, they would only do it on the basis of affirmative consumer consent following full notice. The suggestion was made that DPI behavioral marketing should not be singled out since other technologies for behavioral marketing had a similar potential to collect personal information and implicate privacy, showing the need for a level playing field of protections.
In February 2009, the Staff of the U.S. Federal Trade Commission issued a Report with Principles for Behavioral Advertising. As the FTC explained, the Report "discusses the potential benefits of behavioral advertising to consumers, including the free online content that advertising generally supports and personalization that many consumers appear to value. It also discusses the privacy concerns that the practice raises, including the invisibility of the data collection to consumers and the risk that the information collected - including sensitive information regarding health, finances, or children - could fall into the wrong hands or be used for unanticipated purposes. Consistent with the FTC's overall approach to consumer privacy, the report seeks to balance the potential benefits of behavioral advertising against the privacy concerns it raises, and to encourage [industry to develop leading practices for] privacy protections while maintaining a competitive marketplace."
Despite the FTC call for industry self-regulation, further hearings on behavioral marketing by ISPs were held in April 2009 by the House Subcommittee on Communications, Technology and the Internet whose Chairman Congressman Rick Boucher (D-VA) has announced his intention to introduce legislation this year to address consumer privacy on the Internet. Even at the state level, there have been calls for legislation, such as in New York where Assemblyman Richard Brodsky has reintroduced his Online Consumer Protection Act, limiting the collection and use of personal data.
In addition, concerns about behavioral advertising has spawned civil litigation. A class action lawsuit was brought against behavioral advertising company NebuAd and several regional ISPs that tested NebuAd's service in 2007 and 2008. The case alleges that NebuAd acquired DPI information from the ISPs without consumer consent in violation of federal and California law.
Heightened attention to telecoms involved in behavioral advertising has also arisen in Europe. In 2008, the UK Information Commissioner's Office ("ICO") ruled that British Telecom may continue a trial of behavioral tracking technology provided by Phorm so long as it only involved consumers who affirmatively opted-in to the service. Notably, British Telecom acknowledged that it had been conducting a trial of the Phorm service since 2006 without consumer consent. However, the European Commission has taken exception to the Phorm service and initiated proceedings alleging that the UK has failed to properly implement several EU data privacy directives that should otherwise preclude the use of Phorm's services by British Telecom.
Without question, the debate over behavioral advertising and its impact on personal privacy, and what the limits should be, will continue well into 2009 and beyond.