Targeting online advertising based on the behavior of Internet users—i.e., "behavioral targeting"—remains on the hot seat in Washington. As reported in previous articles (www.wileyrein.com/cdt_truste and www.wileyrein.com/ftc_report), the basic concern is that many users are unaware of both the practice itself and of the extent of their "profiles" that have been created by advertising networks.

Regulatory Background

For more than a decade, the federal government has taken a hands-off approach to regulating behavioral targeting, relying instead on the industry to regulate itself. More recently, however, both the Federal Trade Commission (FTC) (www.wileyrein.com/ftc_report) and Congress have shown signs of losing patience with what they consider to be the industry's inadequate performance to date. Both increased regulation and legislation are realistic prospects.

The prospect of new regulatory or statutory restrictions greatly concerns many industry participants, who have responded with a number of proposals for improving self-regulation. Most recently, a group consisting of the American Association of Advertising Agencies, the Association of National Advertisers, the Council of Better Business Bureaus, the Direct Marketing Association and the Interactive Advertising Bureau announced new "Self-Regulatory Principles for Online Behavioral Advertising." The newly announced principles are based on recommendations issued by the FTC staff this past February.

The Seven Principles

There are seven principles, each establishing objectives for businesses in the behavioral targeting "ecosystem":

The Education Principle: The parties plan to launch an industry-developed website to give consumers more information about online targeting. They also announced an online educational campaign.

The Transparency Principle: Advertising networks and websites should use better techniques, such as additional links, to disclose to consumers what data tracking and collection practices are taking place. These will include more clear and prominent links at websites from which data are collected, using common wording and a common link/icon that it is hoped consumers will learn to recognize. The targeted ads themselves may also include the links.

The Consumer Control Principle: Advertising networks are to develop new ways of giving users "choice" as to what data are collected, used and/or transferred to third parties. These are to be found either in the ad itself or on the website at which data are collected; at the ad networks' websites; or at an industry website. The principles forbid "Service Providers"—essentially, cable or broadband access providers that collect or use data "from all or substantially all URLs traversed by a web browser" but also toolbar providers—from collecting or using data for behavioral targeting without the user's consent. By imposing greater requirements on Internet access providers than on individual websites, the principles give a nod to members of Congress who believe that Deep Packet Inspection at the Internet access level is an unreasonable practice.

The Data Security Principle: The parties call on entities to provide reasonable security for data collected and used for online behavioral targeting, and to not retain data longer than necessary to meet a legitimate business need or required by law.

The Material Changes Principle: Entities should obtain user consent before making changes in online behavioral advertising data collection and use policies that are less privacy-protective than the policies in effect.

The Sensitive Data Principle: This principle requires heightened levels of consent for data about children under 13, financial accounts, Social Security numbers, pharmaceutical prescriptions and medical records.

The Accountability Principle: The DMA will add these principles to its self-regulatory model, and the Better Business Bureau (BBB) will develop a new program around these principles.

Implications for Business

Businesses involved in behavioral targeting should review these principles carefully and consider what effect implementing them or similar proposals would have on their operations. They should also bear in mind that these or similar ideas may become mandatory if regulators or legislators believe industry efforts are inadequate.

As of this writing, no major behavioral targeting bill has yet been introduced in Congress, although the subject remains the focus of considerable legislative attention. However, whether adoption of these principles will succeed in deterring new regulations or legislation remains to be seen. Watch to see whether these or similar principles become widely followed and enforced. The Direct Marketing Association may make them more widely known among marketers by incorporating them into its self-regulatory program. The BBB's involvement likewise will help, but is limited to the businesses that participate in its program.

The law governing behavioral targeting remains far from settled. In the meantime, businesses involved with behavioral targeting, whether as publisher, advertiser, network or another part of the "ecosystem," should stay in close contact with legal counsel to ensure that their operations remain compliant.