In December, 2007, the Federal Trade Commission issued proposed voluntary guidelines for online behavioral advertising. (Online behavioral advertising refers to the tracking of a consumer's activities online over time in order to deliver advertising targeted to the individual consumer's interests.) At that time, the FTC stated that it favored a self-regulatory approach to online behavioral advertising and encouraged the advertising industry to develop guidelines and a mechanism for monitoring compliance. The FTC issued revised guidelines in February of this year, and in July, five advertising and consumer groups issued their own voluntary guidelines for online behavioral advertising (hereinafter called Industry Guidelines). (We summarized the FTC's revised principles in a previous client alert.)
The seven principles in the Industry Guidelines address Education, Transparency, Consumer Control, Data Security, Material Changes, Sensitive Data and Accountability.
The voluntary Industry Guidelines largely mirror the FTC's guidelines. The Industry Guidelines provide an opt-out structure for the collection and use of data for online behavioral advertising purposes, with two exceptions. An opt-in structure is proposed for the collection and use of sensitive data (i.e., data from children under 13 and financial and medical data) and data collected or used by service providers. In addition, all entities should obtain consent before applying any material change to their online behavioral advertising data collection and use policies prior to such change. The Industry Guidelines also call for clear and conspicuous notice about online behavioral advertising practices and an easy to use mechanism for exercising choice, but do not require specific kinds of language or mechanisms. Finally, the Industry Guidelines indicate that the industry will develop a self-regulatory enforcement program that will include monitoring, a way for consumers, competitors and government agencies to submit complaints, and public reporting of non-compliance.
The Industry Guidelines do not apply to contextual advertising (i.e., advertising based on the content of the web page being visited, a consumer's current visit to a web page, or a search query) or a web site's collection of viewing behavior solely for its own uses.
The Industry Guidelines recognize that several different kinds of entities are engaged in online behavioral advertising, that consumers are not always aware of the presence or actions of these entities, and that some entities (such as Internet service providers) have access to more consumer data than other entities. These entities include First Parties (the owner of a web site, or the web site of an Affiliate, where data is collected regarding web viewing behaviors, by the First Party on behalf of itself, its Affiliates and/or its advertising partners), Affiliates (an entity that controls, is controlled by, or is under common control with, another entity), Third Parties (an entity engaging in online behavioral advertising on a non-Affiliate's web site), and Service Providers (an entity that collects and uses data from all or substantially all URLs traversed by a web browser across web sites for online behavioral advertising in the course of the entity's activities as a provider of Internet access service, a toolbar, an Internet browser, or comparable desktop application or client software and not for its other applications and activities).
The Guidelines provide different notice, choice and data security requirements for each kind of entity. For example, Third Parties and Service Providers should provide notice which discloses:
(a) The types of data collected online, including any personally identifiable information for online behavioral advertising purposes;
(b) The uses of such data, including whether the data will be transferred to a non-Affiliate for online behavioral advertising purposes;
(c) An easy to use mechanism for exercising choice with respect to the collection and use of the data for online behavioral advertising purposes or to the transfer of such data to a non-Affiliate for such purpose; and
(d) The fact that the entity adheres to the Industry Guidelines.
In addition, Third Parties should also provide "enhanced notice" in one of two ways: (1) by providing a link to their notice of their data collection practices (with the link appearing in or around the advertisement delivered on the web page where data is collected or on the web page where the data is collected if there is an arrangement with the First Party for the provision of such notice) or (2) by being identified in a list of Third Parties maintained on an industry-developed web site (that is linked from the Third Party's notice) or, if agreed to by the First Party, in the disclosure on the web page where data is collected for online behavioral advertising purposes.
Online behavioral advertising is clearly a hot button issue right now. Congress held hearings on this issue earlier this summer, and Rep. Rick Boucher is expected to introduce legislation governing online behavioral advertising by the end of September. Jon Leibowitz, the recently-appointed chairman of the FTC, said in an interview "It's not clear that [marketers] are moving far enough or fast enough, even though they're making some progress," and that he supports making more of the targeted ads on the Internet "opt-in". It remains to be seen whether these Guidelines will satisfy Congress and the FTC, or if Congress and the FTC see a need for federal legislation regulating online behavioral advertising. A copy of the Self-Regulatory Principles for Online Behavioral Advertising can be found on the Loeb & Loeb LLP web site here.