The Federal Trade Commission (FTC) recently issued a staff report titled “Self-Regulatory Principles for Online Behavioral Advertising” that describes its examination of online behavioral advertising and revises the self-regulatory principles for this advertising (Principles) that were first presented in December 2007. The staff report, which was released on February 12, 2009, summarizes and responds to the comments the FTC received to this initial release of the proposed Principles and discusses the pros and cons of online behavioral advertising.   

“Online behavioral advertising” is defined as the practice of tracking a consumer’s online activities in order to deliver advertising that is targeted to that consumer’s interests.  In the report, the FTC recognizes that this type of advertising can have a potential value to consumers because it may result in free online content for consumers and allows for the personalized delivery of such content. The FTC weighs these benefits against the privacy concerns that behavioral advertising raises.  These concerns include the invisibility of the data collection to consumers and the risk that the data collected would be used for unanticipated purposes. 

The FTC received 63 comments from 87 interested parties, including individual companies, business groups, academics, consumer and privacy advocates and individuals. Many of the commentators addressed the scope of the Principles and whether they should apply to “first party” and “contextual” advertising models.

As a result, the report narrows what is included within the definition of “online behavioral advertising” in two significant ways. First, it explains that “first party” behavioral advertising, which is advertising by a single Web site, is more likely to be consistent with consumer expectations and therefore less likely to cause a consumer harm. This means that Web sites that gather, use and share data to provide a consumer with a personalized experience on a single Web site are excluded from the report’s definition of “online behavioral advertisers.”  Thus, Web sites using data for product recommendations, tailored content, shopping cart services, fraud detection and security delivered on a single Web site – not across multiple platforms – are exempt from the applicability of the Principles.

Second, the report excludes “contextual advertising” from the definition of “online behavioral advertising” because it is less invasive than other forms of advertising. “Contextual advertising” is defined as advertising that is served based on a consumer’s current visit to a single Web page or a single search query and involves no retention of data about the consumer’s online activities beyond what is necessary for the immediate delivery of the advertisement. The FTC stated that consumers may value the delivery of these ads and notes that they involve only a “minimal privacy intrusion.”  

The report also addresses the applicability of the Principles to personally identifiable information (e.g., a person’s name and email address) (PII) and non-personally identifiable information (e.g., an IP address) (non-PII). The report explains that both PII and non-PII raise privacy issues. Most notably, the FTC explains that companies are now linking and merging PII with non-PII, which makes the   non-PII personally identifiable. The FTC also comments that new technologies may make it easier for an individual to identify a consumer based on information that is traditionally considered non-PII. For example, soon companies may be able to link an IP address to an individual consumer. Considering the potential merger of this data, the report concludes that the best approach is to include within the Principles’ scope any data collected for online behavioral advertising that reasonably could be associated with a particular consumer or with a particular computer or device. Thus, the Principles apply to non-PII, as well as PII. This is a significant clarification since much of the “behavioral” data collected by Web sites, such as cookies and IP addresses, has been traditionally considered non-PII. Now, this type of data may fall within the purview of the applicability of the Principles if it could “reasonably be associated” with an individual, or their computer or mobile device. 

With respect to the Principles themselves, the report makes the following comments and clarifications: 

• Principle 1: “Transparency and Consumer Control.” This Principle addresses the notification to consumers about a Web site’s practices with respect to behavioral advertising. The report states that Web sites involved in behavioral advertising must provide prominent, clear, concise and consumer-friendly notice to individuals about these practices and offer consumers the ability to choose whether to allow the collection and use of their data for behavioral advertising. In keeping with its commentary regarding non-PII, the report clarifies that Web sites should give consumers a choice about the collection of their data for behavioral advertising if that data could “reasonably be associated with a particular consumer, computer or device.” Thus, this notice and choice obligation is not limited to PII, but it could also include non-PII.  Further, due to this clarification, the notice and choice obligation now also applies in the context of mobile technologies. The Principle also provides that companies should give consumers a clear, easy-to-use and accessible method for exercising their options regarding the collected data. 

• Principle 2: “Reasonable Security and Limited Data Retention for Consumer Data.” The second Principle calls upon companies collecting and storing consumer data for behavioral advertising to provide reasonable security for that data. The report does not give clear guidance on the mode of securing the data, but explains that the protections given to the data shall depend on the sensitivity of the data, the nature of the company’s business operations, the types of risks a company faces and the reasonable protections available to a company. The report also maintains that companies should retain data only as long as necessary for a legitimate business purpose.

• Principle 3: “Affirmative Express Consent for Material Changes to Existing Privacy Promises.” The report explains that a “fundamental FTC law and policy” is that companies must deliver on promises they make to consumers regarding the collection, use and disclosure of their information. Thus, the report emphasizes that a company may not use a consumer’s data in a manner that is materially different from promises the company made when it collected the data, unless, of course, it receives the consumer’s “affirmative express consent.” Specifically, the report explains that a company must obtain a consumer’s affirmative and express consent when the company makes a “material” and “retroactive” change to its data collection practices.   A material change may include a situation where a company is using data for different purposes than described at the time of collection or when a party discloses data to parties not covered at the time of collection. A retroactive change is a change that applies to previously collected data. Thus, in order to comply with this Principle, a company that decides to share existing customer data with a party not covered in its privacy policy at the time of the data collection would have to obtain each affected consumer’s express “opt-in” to the new disclosure. However, for new customers, the company would only have to give those customers the right to “opt-out” (which could be covered by the company’s privacy policy).

• Principle 4: “Affirmative Express Consent to (or Prohibition Against) Using Sensitive Data for Behavioral Advertising.” This Principle states that companies should only collect sensitive data for behavioral advertising after they obtain the “affirmative express consent” from the consumer. The report does not explicitly define “sensitive data,” but explains that “financial data, data about children, health information, precise geographic location information, and social security numbers” are examples of sensitive data. The report encourages the industry to continue to develop more specific standards to address this issue. 

For a complete copy of the report, please click here.  In the alternative, contact Anthony V. Lupo or Sarah Bruno with questions.

Anthony V. Lupo
lupo.anthony@arentfox.com
202.857.6353

Sarah L. Bruno
bruno.sarah@arentfox.com
202.775.5760