Online advertising, and behavioral targeting in particular, have been the subject of considerable public policy discussion over the past two years. Several factors make policy-setting in the area of behavioral targeting particularly problematic. One is identifying the privacy interest at stake. Another is the view that information about a consumer's purchases and interests is a trade secret of the business (not of the consumer) and that the use of that information to serve customers is a good business practice that is commonplace in the offline world.

Adding to the complexity is the dizzying array of players in the relevant markets: content providers, affiliated sites, advertisers, advertising networks, providers of analytic services, Internet services providers and, in some scenarios, "look up" services. Each has access to different information about users, as well as different relationships with users. These factors have long complicated efforts to fashion a regulatory or legislative response.

In addition to the FTC staff's recent Staff Report on Self-Regulatory Principles for Online Behavioral Advertising (www.ftc.gov/os/2009/02/P085400behavadreport.pdf), discussed in this issue, several industry participants have recently published approaches intended to address the area in a variety of ways. One proposal—by the Network Advertising Initiative—which addressed the issue from the perspective of the network advertising companies—was discussed in last month's Privacy In Focus (www.wileyrein.com/behavioral_adv).

Since then, two other groups—TRUSTe and the Center for Democracy and Technology (CDT)—have issued significant contributions to the discussion. TRUSTe is the nation's leading privacy seal organization, providing services to businesses and consumers at more than 3,400 websites. CDT is a public policy think tank dedicated to studying and advancing democratic values in the digital age.

The TRUSTe Whitepaper

The TRUSTe whitepaper, entitled "Online Behavioral Advertising: A Checklist of Practices That Impact Consumer Trust" (www.truste.com/about/online_behavioral_advertising.php), poses the problem directly:

"The collection of data through behavioral advertising allows trusted companies to market to the actual interests of their customers and website visitors, benefiting consumers, enhancing their online experience, and increasing advertising revenue."

As TRUSTe notes, this advertising helps to support the free content widely available online. However, TRUSTe cautions that "these benefits to consumers and businesses are bounded by the need for online trust in information management processes, business accountability, and respect for consumer privacy."

The TRUSTe whitepaper is intended to provide a framework for analyzing the issue and a practical assessment tool that may help websites understand their own practices. The whitepaper provides an overview of the online behavioral advertising business environment, noting the different roles and business purposes of advertisers, advertising networks, websites, analytics companies and others. It also summarizes some of the technologies commonly used in providing behavioral targeting.

TRUSTe then provides a checklist for businesses to use in evaluating their own practices. The checklist consists of questions that delve into how a website collects and uses data for advertising purposes, as well as what and where disclosures are made concerning those practices. Questions also address data retention and security issues, the use of "cookies" and similar technologies, and other risk issues. Overall, the TRUSTe whitepaper provides a useful tool for persons seeking to learn more about online advertising and for businesses wanting a quick check of their own website practices.

The CDT Whitepaper

The CDT "Threshold Analysis for Online Advertising Practices" (www.cdt.org/privacy/20090128threshold.pdf) provides another such tool. The CDT whitepaper is the product of a yearlong collaboration among a number of industry participants reflecting a variety of viewpoints. The CDT whitepaper provides a framework for describing online targeted advertising practices and for evaluating those practices according to Fair Information Practices. For each practice, the CDT tool calls for consideration of a series of issues, such as the identity of the entities that collect and use data to target advertising, the "nexus" between the consumer and each entity, how "identifiable" and specific are the data, and the length of the period for which data are retained. There is no "right" or "wrong" score—the purpose of the tool is to help companies evaluate their actual, or contemplated, practices against generally recognized Fair Information Practices.

Both the TRUSTe and CDT documents are "living" documents in the sense that they are expected to be revised as business practices consumer expectations, and legal regimes change over time. Neither document has legal standing; they are not regulations or regulatory "safe harbors," although the TRUSTe principles are closely aligned with the requirements of that company's seal programs. The real value of these documents is in the useful assistance that they may provide in helping businesses and policymakers think through the difficult issues arising from online advertising.

Other groups are continuing to work on this issue, and further developments this year and next are likely. Businesses contemplating the use or expansion of behavior targeting online advertising techniques should pay careful attention to policy and legal developments that may affect those plans.