US trade bodies agree to self-regulate behavioural advertising

Together the trade bodies represent more than 5,000 companies. But a consumer group has criticised the new plans, saying that they fail to address the central problem, which it identifies as the collection of too much data.

Behavioural advertising involves tracking consumers' online activities in order to deliver tailored advertising. The practice is often invisible to consumers but allows businesses to target their ads more effectively.

Trade bodies the American Association of Advertising Agencies (4A’s), the Association of National Advertisers (ANA), the Direct Marketing Association (DMA) and the Interactive Advertising Bureau (IAB) worked with the Council of Better Business Bureaus (CBBB) to develop the Self-Regulatory Principles for Online Behavioural Advertising which they plan to implement at the beginning of 2010.

The FTC welcomed the plans.

“I am gratified that a group of influential associations – representing a significant component of the internet community – has responded to so many of the privacy concerns raised by my colleagues and myself,” said Commissioner Pamela Jones Harbour. “These associations have invested substantial efforts to actually deliver a draft set of privacy principles, which have the potential to dramatically advance the cause of consumer privacy," she said.

The seven principles

• The Education Principle calls for organisations to participate in efforts to educate individuals and businesses about online behavioural advertising.
• The Transparency Principle calls for clearer and easily accessible disclosures to consumers about data collection and use practices associated with online behavioural advertising. "It will result in new, enhanced notice on the page where data is collected through links embedded in or around advertisements, or on the web page itself," according to the groups.
• The Consumer Control Principle provides consumers with an expanded ability to choose whether data is collected and used for online behavioural advertising purposes. This choice will be available through a link from the notice provided on the web page where data is collected. The Consumer Control Principle requires “service providers”, a term that includes internet access service providers and providers of desktop applications software such as web browser “tool bars” to obtain the consent of users before engaging in online behavioural advertising, and take steps to de-identify the data used for such purposes.
• The Data Security Principle calls for organisations to provide reasonable security for, and limited retention of data, collected and used for online behavioural advertising purposes.
• The Material Changes Principle calls on organisations to obtain consent for any material change to their online behavioural advertising data collection and use policies and practices to data collected prior to such change.
• The Sensitive Data Principle recognises that data collected from children and used for online behavioural advertising merits heightened protection, and requires parental consent for behavioural advertising to consumers known to be under 13 on child-directed websites. This Principle also provides heightened protections to certain health and financial data when attributable to a specific individual.
• The Accountability Principle calls for development of programs to further advance these Principles, including programs to monitor and report instances of uncorrected non-compliance with these Principles to appropriate government agencies. The CBBB and DMA have been asked and agreed to work cooperatively to establish accountability mechanisms under the Principles.

Criticism

Consumer rights body the Center for Digital Democracy said that the groups have failed to develop adequate safeguards.

Executive Director Jeff Chester called the proposals "are way too little and far too late."

"This move by the online ad industry is an attempt, of course, to quell the growing bi-partisan calls in Congress to enact meaningful digital privacy and consumer protection laws," he said.

"The principles are inadequate, even beyond their self-regulatory approach that condones, in effect, the 'corporate fox guarding the digital data henhouse', he said. ”Effective government regulation is required to protect consumers."

Chester accused the industry of embracing a definition of behavioral targeting and profiling that is at odds with how the practice actually works.

"Before any data is collected from consumers, they need to be candidly informed about the process – such as the creation and evolution of their profile; how tracking and data gathering occurs site to site; what data can be added to their profile from outside databases; the role that data targeting plays on so-called first-party websites, etc," he said.

"In addition, the highest possible consumer safeguards are necessary when financial and health data are involved. Under the loosey-goosey trade industry principles, however, only 'certain health and financial data' are to be treated as a 'sensitive' category," said Chester. "This would permit widespread data collection involving personal information regarding our health and financial concerns. The new principles, moreover, fail to protect the privacy of teenagers; nor do they seriously address children’s privacy."

"More links to better-written privacy statements don’t address the central problem: the collection of more and more user data for profiling and targeting purposes," he said. "There needs to be quick Congressional action placing limits on the collection, use and retention of consumer data; opt-in control over profile information; and the creation of a meaningful sensitive data category."

Meanwhile, the Consumer Federation of America has called for a do-not-track registry similar to the do-not-call registries that exist in the US and UK, so consumers can declare once that they do not want to be tracked rather than having to tell various organisations.