The Federal Trade Commission convened a "Town Hall" in early November to discuss "behavioral advertising." Behavioral advertising—labeled a "white hot" issue by FTC Commissioner Jon Leibowitz—is the practice of targeting advertising to Internet users based on their presumed interests as deduced from "clickstream" data recording the websites they visit and the webpages they view.

The two-day event was the first time that the FTC formally had revisited online profiling and advertising following the Network Advertising Initiative's adoption of related principles in 2000. Since that time, technologies and marketing models have grown more sophisticated, an entire new marketing industry—search—has sprung up, and numerous behavioral tracking firms are merging with larger companies, led by the proposed acquisition of DoubleClick by Google. Although no proposed regulatory changes emerged from the Town Hall, the mere fact of its having been convened suggests that the FTC consumer protection authorities may not be satisfied with the status quo. Businesses planning to rely increasingly on behavioral targeting to sharpen their online advertising would be well advised to watch for future developments.

An Online Technology

Behavioral targeting is particularly well-suited for the online world. Computer technology enables Internet services to monitor a particular consumer's activity both within and across websites in a relatively detailed manner. Thus, for example, behavioral targeting may result in a website user receiving advertising based on sites that she previously visited, areas of the current site she has visited in the past or, in some scenarios, purchases made. While behavioral targeting may occur in the real-world environment (e.g., the kindly country store proprietor who knows what his "regulars" have bought in the past), tracking in the online world can be both more comprehensive and less noticeable.

Behavioral tracking can occur on a non-personally identifiable basis. That is, a network advertiser can track a web user's activities across a network of sites and thereby develop a fairly detailed profile without knowing the user's identity. Of course, if such clickstream data is linked to personally identifiable data, which itself can be supplemented by information from data brokers, then the profile can become even more closely refined—perhaps too much so for some tastes.

The Network Advertising Initiative principles, adopted seven years ago, established "best principles" for the conduct of network advertising that contain specific provisions addressing the linking of non-personally identifiable information with personally identifiable data. Other groups, such as the Direct Marketing Association and the Internet Advertising Bureau, also have recommended "best practices" for targeting. The November FTC workshop could be regarded as partly involving an assessment of how well the industry's principles have worked. Over the two days of the event, it became evident that there is quite a gulf between the expectations of the marketing industry and those representing consumers.

Views Expressed

Marketing industry representatives touted the advantages of behavioral targeting. They generally regard it as a means of avoiding bombarding users with useless or irrelevant ads. Noting the recent trend away from "for pay" websites, they stressed that optimized advertising offers substantial potential for advertising-supported websites.

Representatives of consumer and privacy organizations presented quite a different view, expressing concerns about individuals "being tracked" without their knowledge and the development of detailed personal profiles in the possession of entities unknown to the tracked person. There were complaints that website privacy policies consist largely of unreadable legalese. Perhaps the paramount concern expressed was that profiles are being compiled surreptitiously without the knowledge or consent of the individual being profiled.

Some voiced criticism of the self-regulatory approach that has prevailed in the past, contending that self-regulation is largely unknown to users, ineffective and, perhaps most important, limited in use because self-regulatory standards apply only to the companies that are members of the self-regulating organizations. The reach of self-regulation does not extend to "outlier" companies that do not participate in self-regulatory programs.

FTC Perspectives

From the FTC's perspective, the issue is not whether behavioral targeting is a desirable practice or not. Instead, as a consumer protection agency, the FTC looks for consumer harm, which in turn can prove relevant to whether a business practice is deemed "unfair" or "deceptive" under Section 5 of the Federal Trade Commission Act. The "harm" most frequently cited by consumer representatives is the compilation of detailed profiles without the user's knowledge, sometimes expressed as a concern over "loss of control" of information about oneself.

The lack of knowledge on the part of Internet users focuses attention on the adequacy of the privacy notices commonly found on websites. One issue that may receive attention in the future is improving the clarity of current "notice" practices. A number of speakers contended that privacy policies today are seldom read and, because they often are heavily lawyered, even less understood. Additionally, in the case of network advertisers, users may have great difficulty identifying the network provider whose privacy policy is most relevant.

The FTC recently completed an effort to recommend improvements designed to simplify and clarify the privacy notices required under the Gramm-Leach-Bliley Act, leading to a March 2007 interagency notice of proposed rulemaking on a simplified forum of notice. The agency may seek to repeat that effort for online statements. However, whether a simplified approach could accommodate the myriad of online business practices without curtailing innovative business models is unclear.

Receiving some media attention was a "Do Not Track" proposal modeled on the national Do Not Call registry for telemarketing. The concept is that an individual could direct that his or her online visits not be tracked. Such a proposal may have some technological challenges to surmount. Assuming those were met, however, one wonders whether a consumer would have to choose between (1) tracking and detailed profiling; or (2) no tracking and a heightened frustration from receiving "irrelevant" ads. Perhaps consumers do not mind targeted content so long as they have a feeling of control.

Next Steps

"What's" next? The FTC Town Hall was not the start of a formal process with predictable steps. However, the FTC now has a record upon which it can base recommendations to Congress or issue proposals to improve privacy notices. It is also possible that the agency will invoke its enforcement authority in an effort to craft improved practices through investigations and consent decrees, much as it has in the area of data security. Stay tuned, because the attractiveness to advertisers of behavioral targeting and the privacy concerns expressed by consumers together suggest that the issues are far from resolved.