FTC Regulation of Behavioral Advertising
Encyclopedia
The United States Federal Trade Commission
(FTC) has been involved in oversight of the behavioral targeting techniques used by online advertisers since the mid-1990s. These techniques, known initially as online profiling, and now known as behavioral targeting
, are used to target online behavioral advertising (OBA) to consumers based on preferences inferred from their online behavior. During the period from the mid-1990s to the present, the FTC held a series of workshops, published a number of reports and gave numerous recommendations regarding both industry self-regulation
and Federal
regulation of OBA. In late 2010, the FTC proposed a legislative framework for US consumer data privacy including a proposal for a “Do Not Track” mechanism. In 2011, a number of bills were introduced into the United States Congress
that would regulate OBA.
, the Children's Online Privacy Protection Act
, the CAN-SPAM Act of 2003
, and the Telemarketing and Consumer Fraud and Abuse Prevention Act
(“Do Not Call Rule”).
In 1995, 1996, and 1997 the FTC held public workshops exploring consumer data privacy issues. At these workshops, online advertising industry advocates pressed for self-regulation, while privacy advocates argued that self-regulation could only be successful when backed up by “legally enforceable rights to information privacy.” Industry lobbyists argued for opt-out
, which allows companies to use personal information for the purposes stated in a privacy policy or other form of notification, unless the consumer “opts-out” and notifies the company not to use the personal information in a certain manner, such as for marketing. Privacy advocates argued for prior affirmative consent, and suggested that software could be used by consumers to communicate their privacy preferences automatically.
In 1998, the FTC released a report in which it undertook a comprehensive review of commercial websites’ disclosures of their privacy practices and laid out the Fair Information Practice Principles
(FIPS). The report concluded that, “[a]s evidenced by the Commission’s survey results, and despite the Commission’s three-year privacy initiative supporting a self-regulatory response to consumers’ privacy concerns, the vast majority of online businesses have yet to adopt even the most fundamental fair information practice (notice/awareness).”
The FTC held a further public workshop in 1999, and in May 2000, released a report which for the first time recommended that Congress pass online privacy legislation to create a basic level of data privacy protection for consumer-oriented commercial Web sites.
In July 2000, the FTC recommended that legislation should be passed to protect Internet user’s privacy with regards to OBA (or online profiling as it was then known) for the first time. The FTC further stated that “backstop legislation addressing online profiling is still required to fully ensure that consumers’ privacy is protected online” and recommended that [technology neutral] legislation be passed that created a basic level of privacy protection for users of “consumer-oriented commercial websites with respect to profiling.” Under the FTC’s 2000 proposal all online advertising networks and consumer oriented commercial websites that allowed the collection of information from or about consumers would be required to implement and comply with the FIPs.
Congress did not enact the FTC’s recommended legislation, and another decade would pass before the FTC again proposed legislation to regulate OBA.
FTC Commissioner Timothy Muris
turned the FTC’s attention away from online privacy and OBA regulation in 2001, stating, “[t]he slowing of the growth of the Internet emphasizes the need to understand the cost of online privacy legislation…. At this time, we need more law enforcement, not more laws.”
Building on the Tech-ade hearings, the FTC hosted a town hall meeting
in November 2007 focused specifically on the privacy implications of behavioral advertising practices called, “Ehavioral Advertising: Tracking, Targeting, and Technology.” The public meeting was prompted, in part, by the growth of behavioral advertising and the interest of large Internet companies in using such techniques to deliver narrowly targeted ads. These developments included Google
’s plans to acquire DoubleClick
, AOL
’s interest in Tacoda
, and Microsoft
and Yahoo’s continued expansion of their own behavioral advertising products.
In December 2007, the FTC promulgated a set of proposed “Principles” intended to provide a basis for the online advertising industry’s self-regulatory efforts to address privacy concerns. The Principles “call for companies to obtain affirmative express consent from consumers before they use data in a manner that is materially different than promised at the time of collection and before they collect and use 'sensitive' consumer data for behavioral advertising.”
The FTC followed up this 2007 report with a further report in 2009, which further clarified the self-regulatory Principles. At the time, a coalition of consumer groups proposed a “Do Not Track List” in their comments to the 2007 town hall meeting.
In the report the FTC describes the limitations of the existing notice and choice model, which it states, “have become increasingly apparent in recent years.” The FTC states that the notice and choice based model, “encourages companies to develop privacy notices describing their information collection and use practices to consumers, so that consumers can make informed choices.” However, “the notice-and-choice model, as implemented, has led to long, incomprehensible privacy policies that consumers typically do not read, let alone understand. Likewise, the harm-based model has been criticized for failing to recognize a wider range of privacy-related concerns, including reputational harm or the fear of being monitored.”
In order to address the issues with the notice-and-choice based model, the FTC’s proposed privacy framework calls on companies to provide consumers with a meaningful choice in regards to OBA tracking, but sets forth “a limited set of data practices for which choice is not necessary” called “commonly accepted practices.” The commonly accepted practices include: Product and service fulfillment, Internal operations, Fraud prevention, Legal compliance and First-party marketing (including contextual marketing).
OBA, along with deep packet inspection
, are noted as specifically not “commonly accepted practices.” Furthermore, the report states that the FTC supports prior “affirmative express consent” in regards to the collection of “sensitive information” (children, financial and medical information, and precise geolocation
data) for OBA.
opt-outs as it is more “clear, easy to locate and effective” and it conveys the user’s choice to opt out of tracking directly to websites.
Commerce Committee
. At the hearing, the FTC recommended imposing more stringent measures to protect Internet users against unauthorized tracking in support of behavioral advertising, including a universal Do Not Track browser setting.
The FTC also announced its first behavioral advertising case, filed against network advertiser Chitika
for using a deceptive opt-out mechanism. As part of the settlement the FTC required that Chitika link all its advertising to an effective opt-out mechanism in future. It has been commented that, “[t]his requirement of a hyperlink embedded in online advertisements is a good indicator of the type of Do Not Track mechanism that will be acceptable to the FTC if 'Do Not Track' becomes mandatory.”
At the same Senate hearing, the Barack Obama
Administration called for a new “Internet user’s bill of rights,” which would give the FTC authority to regulate online behavioral advertising.
(D-CA) introduced the “Do Not Track Me Online Act of 2011,” which would authorize the FTC to promulgate regulations requiring online advertisers and websites to allow users to opt out of having their online activities tracked through the creation of a do-not-track mechanism. The bill gives users the ability to block all collection of data for OBA but gives an exception for commonly accepted practices such as fraud prevention and inventory control. The bill authorizes the FTC to enforce the new regulations by conducting random audits of Web publishers, although the proposed regulations contain an exception for websites that have less than 10,000 visitors per year.
and cosponsor Senator John McCain
introduced the “Commercial Privacy Bill of Rights Act of 2011.”
At the press conference to introduce the bill, Senator Kerry and Senator McCain said that the bill strikes a compromise between business and consumer interests, and noted the bill had the support of Microsoft, Intel, and eBay
.
The bill tasks the FTC with developing rules specifically targeted at OBA, requiring companies to offer consumers “a robust, clear, and conspicuous” opt-out mechanism from the use of their personally-identifiable information by third parties “for behavioral advertising or marketing.”
The bill calls for the FTC to create regulations requiring businesses collecting personally identifiable information, such as names and email addresses, to provide “clear, concise and timely notice” of data collection, use and transfer, along with “a clear and conspicuous mechanism for opt-out consent for any unauthorized use of [consumers'] personally identifiable information.”
The bill contains a provision which would require opt-in consent for the “collection, use or transfer of sensitive personally identifiable information.” Sensitive personally identifiable information is defined as “personally identifiable information which, if lost, compromised, or disclosed without authorization either alone or with other information, carries a significant risk of economic or physical harm” or is related to a particular medical condition, health record or the religious affiliation of an individual.
The bill also tasks the FTC with establishing a voluntary safe harbor
program to review, approve and monitor self-regulatory programs that provide consumers with “clear, conspicuous, persistent and effective” opt-out from online behavioral advertising or location based advertising. Once a self-regulatory program is approved by the FTC and the members of that program are covered by the safe harbor, those members would be exempt from some of the provisions of the bill.
The bill does not include the FTC’s proposed Do Not Track mechanism, which Senator McCain stated at the press conference, “didn't seem to fit in our ability to get a balance for consumer and industry support.”
The bill also does not include a private right of action, leaving enforcement up to the FTC and State Attorney Generals.
Consumer and privacy advocates have stated that the bill was not strong enough and should contain the FTC’s Do Not Track proposal.
Federal Trade Commission
The Federal Trade Commission is an independent agency of the United States government, established in 1914 by the Federal Trade Commission Act...
(FTC) has been involved in oversight of the behavioral targeting techniques used by online advertisers since the mid-1990s. These techniques, known initially as online profiling, and now known as behavioral targeting
Behavioral targeting
Behavioral targeting is a technique used by online publishers and advertisers to increase the effectiveness of their campaigns.Behavioral targeting uses information collected on an individual's web-browsing behavior, such as the pages they have visited or the searches they have made, to select...
, are used to target online behavioral advertising (OBA) to consumers based on preferences inferred from their online behavior. During the period from the mid-1990s to the present, the FTC held a series of workshops, published a number of reports and gave numerous recommendations regarding both industry self-regulation
Self-regulation
The term self-regulation can signify:*Autoregulation*Homeostasis, in systems theory*Self-control, in sociology / psychology*Self-regulated learning, in educational psychology*Self-regulation theory , a system of conscious personal health management...
and Federal
Federal government of the United States
The federal government of the United States is the national government of the constitutional republic of fifty states that is the United States of America. The federal government comprises three distinct branches of government: a legislative, an executive and a judiciary. These branches and...
regulation of OBA. In late 2010, the FTC proposed a legislative framework for US consumer data privacy including a proposal for a “Do Not Track” mechanism. In 2011, a number of bills were introduced into the United States Congress
United States Congress
The United States Congress is the bicameral legislature of the federal government of the United States, consisting of the Senate and the House of Representatives. The Congress meets in the United States Capitol in Washington, D.C....
that would regulate OBA.
Early history
“The Federal Trade Commission has been involved in addressing online privacy issues for almost as long as there has been an online marketplace.” The FTC is now responsible for the enforcement of a number of sector-specific privacy statues, including the Gramm-Leach-Bliley ActGramm-Leach-Bliley Act
The Gramm–Leach–Bliley Act , also known as the Financial Services Modernization Act of 1999, is an act of the 106th United States Congress...
, the Children's Online Privacy Protection Act
Children's Online Privacy Protection Act
The Children's Online Privacy Protection Act of 1998 is a United States federal law, located at .The act, effective April 21, 2000, applies to the online collection of personal information by persons or entities under U.S. jurisdiction from children under 13 years of age...
, the CAN-SPAM Act of 2003
CAN-SPAM Act of 2003
The CAN-SPAM Act of 2003 , signed into law by President George W. Bush on December 16, 2003, establishes the United States' first national standards for the sending of commercial e-mail and requires the Federal Trade Commission to enforce its provisions...
, and the Telemarketing and Consumer Fraud and Abuse Prevention Act
Telemarketing and Consumer Fraud and Abuse Prevention Act
The Telemarketing and Consumer Fraud and Abuse Prevention Act is federal legislation in the United States aimed at protecting consumers from telemarketing deception and abuse.-References:*...
(“Do Not Call Rule”).
In 1995, 1996, and 1997 the FTC held public workshops exploring consumer data privacy issues. At these workshops, online advertising industry advocates pressed for self-regulation, while privacy advocates argued that self-regulation could only be successful when backed up by “legally enforceable rights to information privacy.” Industry lobbyists argued for opt-out
Opt-out
The term opt-out refers to several methods by which individuals can avoid receiving unsolicited product or service information. This ability is usually associated with direct marketing campaigns such as telemarketing, e-mail marketing, or direct mail. A list of those who have opted-out is called a...
, which allows companies to use personal information for the purposes stated in a privacy policy or other form of notification, unless the consumer “opts-out” and notifies the company not to use the personal information in a certain manner, such as for marketing. Privacy advocates argued for prior affirmative consent, and suggested that software could be used by consumers to communicate their privacy preferences automatically.
In 1998, the FTC released a report in which it undertook a comprehensive review of commercial websites’ disclosures of their privacy practices and laid out the Fair Information Practice Principles
FTC Fair Information Practice
The United States Federal Trade Commission's Fair Information Practice Principles are guidelines that represent widely-accepted concepts concerning fair information practice in an electronic marketplace.- Introduction :...
(FIPS). The report concluded that, “[a]s evidenced by the Commission’s survey results, and despite the Commission’s three-year privacy initiative supporting a self-regulatory response to consumers’ privacy concerns, the vast majority of online businesses have yet to adopt even the most fundamental fair information practice (notice/awareness).”
The FTC held a further public workshop in 1999, and in May 2000, released a report which for the first time recommended that Congress pass online privacy legislation to create a basic level of data privacy protection for consumer-oriented commercial Web sites.
In July 2000, the FTC recommended that legislation should be passed to protect Internet user’s privacy with regards to OBA (or online profiling as it was then known) for the first time. The FTC further stated that “backstop legislation addressing online profiling is still required to fully ensure that consumers’ privacy is protected online” and recommended that [technology neutral] legislation be passed that created a basic level of privacy protection for users of “consumer-oriented commercial websites with respect to profiling.” Under the FTC’s 2000 proposal all online advertising networks and consumer oriented commercial websites that allowed the collection of information from or about consumers would be required to implement and comply with the FIPs.
Congress did not enact the FTC’s recommended legislation, and another decade would pass before the FTC again proposed legislation to regulate OBA.
FTC Commissioner Timothy Muris
Timothy Muris
Timothy J. Muris was the chair of the US Federal Trade Commission from 2001 to 2004.He is currently George Mason University Foundation Professor of Law and Of Counsel at O’Melveny & Myers, a law firm....
turned the FTC’s attention away from online privacy and OBA regulation in 2001, stating, “[t]he slowing of the growth of the Internet emphasizes the need to understand the cost of online privacy legislation…. At this time, we need more law enforcement, not more laws.”
Return to regulatory focus
In 2006 the FTC once again took up the mantle of online privacy protection at the November 2006 FTC forum, “Tech-ade,” which examined the “key technological and business developments that will shape consumers’ core experiences in the coming ten years.” Participants at the forum described how technological advances in online profiling (now called “behavioral” advertising, targeting, or marketing), had allowed the practice to become more widespread and efficient.Building on the Tech-ade hearings, the FTC hosted a town hall meeting
Town hall meeting
A town hall meeting is an American English term given to an informal public meeting. Everybody in a town community is invited to attend, not always to voice their opinions, but to hear the responses from public figures and elected officials about shared subjects of interest. Attendees rarely voted...
in November 2007 focused specifically on the privacy implications of behavioral advertising practices called, “Ehavioral Advertising: Tracking, Targeting, and Technology.” The public meeting was prompted, in part, by the growth of behavioral advertising and the interest of large Internet companies in using such techniques to deliver narrowly targeted ads. These developments included Google
Google
Google Inc. is an American multinational public corporation invested in Internet search, cloud computing, and advertising technologies. Google hosts and develops a number of Internet-based services and products, and generates profit primarily from advertising through its AdWords program...
’s plans to acquire DoubleClick
DoubleClick
DoubleClick is a subsidiary of Google that develops and provides Internet ad serving services. Its clients include agencies, marketers and publishers who serve customers like Microsoft, General Motors, Coca-Cola, Motorola, L'Oréal, Palm, Inc., Apple Inc., Visa USA, Nike, Carlsberg among others...
, AOL
AOL
AOL Inc. is an American global Internet services and media company. AOL is headquartered at 770 Broadway in New York. Founded in 1983 as Control Video Corporation, it has franchised its services to companies in several nations around the world or set up international versions of its services...
’s interest in Tacoda
Tacoda
Tacoda was an advertising network company and is based in the United States. It was acquired by AOL on July 23, 2007....
, and Microsoft
Microsoft
Microsoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
and Yahoo’s continued expansion of their own behavioral advertising products.
In December 2007, the FTC promulgated a set of proposed “Principles” intended to provide a basis for the online advertising industry’s self-regulatory efforts to address privacy concerns. The Principles “call for companies to obtain affirmative express consent from consumers before they use data in a manner that is materially different than promised at the time of collection and before they collect and use 'sensitive' consumer data for behavioral advertising.”
The FTC followed up this 2007 report with a further report in 2009, which further clarified the self-regulatory Principles. At the time, a coalition of consumer groups proposed a “Do Not Track List” in their comments to the 2007 town hall meeting.
The FTC’s 2010 report
In a December 2010 report, the FTC proposed a new regulatory framework for consumer data privacy, including a proposal for a “Do Not Track” mechanism which would allow Internet users to opt-out of OBA.In the report the FTC describes the limitations of the existing notice and choice model, which it states, “have become increasingly apparent in recent years.” The FTC states that the notice and choice based model, “encourages companies to develop privacy notices describing their information collection and use practices to consumers, so that consumers can make informed choices.” However, “the notice-and-choice model, as implemented, has led to long, incomprehensible privacy policies that consumers typically do not read, let alone understand. Likewise, the harm-based model has been criticized for failing to recognize a wider range of privacy-related concerns, including reputational harm or the fear of being monitored.”
In order to address the issues with the notice-and-choice based model, the FTC’s proposed privacy framework calls on companies to provide consumers with a meaningful choice in regards to OBA tracking, but sets forth “a limited set of data practices for which choice is not necessary” called “commonly accepted practices.” The commonly accepted practices include: Product and service fulfillment, Internal operations, Fraud prevention, Legal compliance and First-party marketing (including contextual marketing).
OBA, along with deep packet inspection
Deep packet inspection
Deep Packet Inspection is a form of computer network packet filtering that examines the data part of a packet as it passes an inspection point, searching for protocol non-compliance, viruses, spam, intrusions or predefined criteria to decide if the packet can...
, are noted as specifically not “commonly accepted practices.” Furthermore, the report states that the FTC supports prior “affirmative express consent” in regards to the collection of “sensitive information” (children, financial and medical information, and precise geolocation
Geolocation
Geolocation is the identification of the real-world geographic location of an object, such as a radar, mobile phone or an Internet-connected computer terminal...
data) for OBA.
Do Not Track
In the 2010 report, the FTC proposed a “uniform and comprehensive consumer choice mechanism” for OBA, referred to as “Do Not Track.” The FTC states, “[t]he most practical method of providing uniform choice for online behavioral advertising would likely involve placing a setting similar to a persistent cookie on a consumer’s browser and conveying that setting to sites that the browser visits, to signal whether or not the consumer wants to be tracked or receive targeted advertisements.” The FTC believes that a Do Not Track mechanism is preferable to the existing browser based cookieHTTP cookie
A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site...
opt-outs as it is more “clear, easy to locate and effective” and it conveys the user’s choice to opt out of tracking directly to websites.
FTC goes to Congress
On March 16, 2011, the FTC appeared before the United States SenateUnited States Senate
The United States Senate is the upper house of the bicameral legislature of the United States, and together with the United States House of Representatives comprises the United States Congress. The composition and powers of the Senate are established in Article One of the U.S. Constitution. Each...
Commerce Committee
United States Senate Committee on Commerce, Science and Transportation
The United States Senate Committee on Commerce, Science, and Transportation is a standing committee of the United States Senate in charge of all senate matters related to the following subjects:* Coast Guard* Coastal zone management* Communications...
. At the hearing, the FTC recommended imposing more stringent measures to protect Internet users against unauthorized tracking in support of behavioral advertising, including a universal Do Not Track browser setting.
The FTC also announced its first behavioral advertising case, filed against network advertiser Chitika
Chitika
Chitika, Inc. is a search-targeted advertising network and research firm. Based in Westborough, Massachusetts, the company was co-founded in 2003 by Chief Executive Officer Venkat Kolluri and Chief Technology Officer Alden DoRosario, both former Terra Lycos data mining engineers...
for using a deceptive opt-out mechanism. As part of the settlement the FTC required that Chitika link all its advertising to an effective opt-out mechanism in future. It has been commented that, “[t]his requirement of a hyperlink embedded in online advertisements is a good indicator of the type of Do Not Track mechanism that will be acceptable to the FTC if 'Do Not Track' becomes mandatory.”
At the same Senate hearing, the Barack Obama
Barack Obama
Barack Hussein Obama II is the 44th and current President of the United States. He is the first African American to hold the office. Obama previously served as a United States Senator from Illinois, from January 2005 until he resigned following his victory in the 2008 presidential election.Born in...
Administration called for a new “Internet user’s bill of rights,” which would give the FTC authority to regulate online behavioral advertising.
Do Not Track Me Online Act of 2011
Representative Jackie SpeierJackie Speier
Karen Lorraine Jacqueline "Jackie" Speier is the U.S. Representative for , serving since 2008. She is a member of the Democratic Party. The district includes the northern two-thirds of San Mateo County and the southwest quarter of San Francisco.She is also a former member of the California State...
(D-CA) introduced the “Do Not Track Me Online Act of 2011,” which would authorize the FTC to promulgate regulations requiring online advertisers and websites to allow users to opt out of having their online activities tracked through the creation of a do-not-track mechanism. The bill gives users the ability to block all collection of data for OBA but gives an exception for commonly accepted practices such as fraud prevention and inventory control. The bill authorizes the FTC to enforce the new regulations by conducting random audits of Web publishers, although the proposed regulations contain an exception for websites that have less than 10,000 visitors per year.
Kerry/McCain Commercial Privacy Bill of Rights Act of 2011
On April 12, 2011, Senator John KerryJohn Kerry
John Forbes Kerry is the senior United States Senator from Massachusetts, the 10th most senior U.S. Senator and chairman of the Senate Foreign Relations Committee. He was the presidential nominee of the Democratic Party in the 2004 presidential election, but lost to former President George W...
and cosponsor Senator John McCain
John McCain
John Sidney McCain III is the senior United States Senator from Arizona. He was the Republican nominee for president in the 2008 United States election....
introduced the “Commercial Privacy Bill of Rights Act of 2011.”
At the press conference to introduce the bill, Senator Kerry and Senator McCain said that the bill strikes a compromise between business and consumer interests, and noted the bill had the support of Microsoft, Intel, and eBay
EBay
eBay Inc. is an American internet consumer-to-consumer corporation that manages eBay.com, an online auction and shopping website in which people and businesses buy and sell a broad variety of goods and services worldwide...
.
The bill tasks the FTC with developing rules specifically targeted at OBA, requiring companies to offer consumers “a robust, clear, and conspicuous” opt-out mechanism from the use of their personally-identifiable information by third parties “for behavioral advertising or marketing.”
The bill calls for the FTC to create regulations requiring businesses collecting personally identifiable information, such as names and email addresses, to provide “clear, concise and timely notice” of data collection, use and transfer, along with “a clear and conspicuous mechanism for opt-out consent for any unauthorized use of [consumers'] personally identifiable information.”
The bill contains a provision which would require opt-in consent for the “collection, use or transfer of sensitive personally identifiable information.” Sensitive personally identifiable information is defined as “personally identifiable information which, if lost, compromised, or disclosed without authorization either alone or with other information, carries a significant risk of economic or physical harm” or is related to a particular medical condition, health record or the religious affiliation of an individual.
The bill also tasks the FTC with establishing a voluntary safe harbor
Safe harbor
The term safe harbor has several special usages, in an analogy with its literal meaning, that of a harbor or haven which provides safety from weather or attack.-Legal definition:...
program to review, approve and monitor self-regulatory programs that provide consumers with “clear, conspicuous, persistent and effective” opt-out from online behavioral advertising or location based advertising. Once a self-regulatory program is approved by the FTC and the members of that program are covered by the safe harbor, those members would be exempt from some of the provisions of the bill.
The bill does not include the FTC’s proposed Do Not Track mechanism, which Senator McCain stated at the press conference, “didn't seem to fit in our ability to get a balance for consumer and industry support.”
The bill also does not include a private right of action, leaving enforcement up to the FTC and State Attorney Generals.
Consumer and privacy advocates have stated that the bill was not strong enough and should contain the FTC’s Do Not Track proposal.