It's been called a "virtual privacy time bomb" by a prominent Congressman, something that an FTC commissioner believes should "really trouble all of us" and to which one policy group believes we should have a legal right to examine, correct, and/or delete. What is it?
Answer: Online behavioral marketing data.
And it will continue to be a hot topic for 2008, as the Google – DoubleClick merger progresses, the FTC collects public comment on self-regulatory principles, and New York State bill A09275 (introduced in response to the Facebook controversy) is further considered.
I have a kind of love/hate relationship with online behavioral marketing. Advertising that is better targeted to consumers helps support a lot of Internet web sites that otherwise might charge for their services. And I receive ads targeted to my tastes and preferences (yippee!). But there's something about it that makes me feel uneasy, something that still doesn't quite sit so well.
And thanks to my prior sentence, there may be Pepto-Bismol ads popping up on the web site hosting this blog. Indeed, behavioral advertising is the tracking of a consumer’s activities online – including the searches the consumer has conducted, the Web pages visited, and the content viewed – in order to deliver advertising targeted to the individual consumer’s interests. Google is the 1,000 pound gorilla in this space, as it sells its AdSense service to display targeted ads for content and for search results.
The FTC is currently accepting comments on the FTC’s proposed self-regulatory principles, and these are due by Feb 22. The FTC hasn’t called for specific regulation, but has recommended principles that include:
- transparency and consumer control;
- reasonable security, and limited retention of consumer data;
- affirmative express consent for material changes to existing privacy promises; and
- affirmative express consent (or prohibition against) using sensitive data for behavioral advertising.
The Commission also requested more information on the use of tracking data for purposes other than behavioral advertising.
Many of the public comments from the FTC's public workshop last November on "Ehavioral Advertising" are in favor of regulation. For example, the Center for Digital Democracy and U.S. PIRG call for legislation that would:
- mandate explicit opt-in requirements for any online behavioral data collection;
- give consumers a legal right to examine, correct, and/or delete any online data collected about them; and
- impose limited-time data retention requirements.
Another comment from the World Privacy Forum demeans the Network Advertising Initiative (NAI) – whose members include companies owned by Microsoft & AOL, and Google and Yahoo – as failing at consumer protection and at self-regulation.
The pro-regulatory comments are mostly over the top though. When you read through these comments, they tend to read more like an anti-corporate rant than a documentation of specific harms to consumers. Still, when discussing the kind of data being collected to support targeted ads, it might be worthwhile to draw distinctions among the types of information being harvested.
Perhaps when it comes to tracking medical and financial behaviors, online companies should be providing consumers with better transparency and accountability, especially compared to data collected on general browsing and shopping habits, which is less of a privacy concern.
