United States: Privacy And Security Alert: FTC Proposes "Self-Regulatory" Principles For Ehavioral Online Advertising

Late in December, the Federal Trade Commission (FTC) released a set of proposed self-regulatory principles designed to address the rapidly evolving practice of "behavioral advertising." The FTC notes that the practice, broadly defined as the "tracking of a consumer's activities online—including the searches the consumer has conducted, the web pages visited, and the content reviewed—in order to deliver advertising targeted to the individual consumer's interests," could pose important consumer privacy issues. Although the FTC proposal is "self-regulatory," the "announced principles are a lot tougher ... than most observers expected," Professor Peter Swire, a noted privacy expert, told Advertising Age. Participants at the recent FTC town hall meeting entitled "Ehavioral Advertising: Tracking, Targeting, and Technology" raised some of the more pervasive issues surrounding behavioral advertising and were summarized in a Mintz Levin Privacy Alert (available here). The FTC's proposed principles provide very general responses to the issues raised at the meeting. The full FTC release, is available here. The FTC's proposal states that behavioral advertising provides benefits to consumers in the form of free content and personalized advertising but notes that this practice is largely invisible and unknown to consumers.

To address issues that emerged from the town hall meeting, the FTC proposed the following "principles":

• Transparency: Any web site that collects data used for behavioral advertising should provide a "clear, consumer-friendly, and prominent statement" that the data is being collected to provide targeted ads. The website must also allow consumers to easily choose whether to permit their information to be used for such purpose.

• Data Security: Any company that collects or stores behavioral-advertising-related data should provide reasonable security and should retain the data only as long as is necessary to fulfill a legitimate business or law enforcement need.

• Material Changes to Existing Privacy Policies: Companies should obtain affirmative express consent prior to using data in a manner materially different from promises made when the company collected the data.

• Consent to Use Sensitive Data: Companies should collect sensitive data for behavioral advertising only after obtaining affirmative consent from the consumer. The FTC is seeking comment on what constitutes sensitive data. The FTC has also inquired into whether sensitive data should be prohibited in behavioral advertising.

The FTC has also requested additional information about whether companies are using tracking data for purposes other than behavioral advertising, and whether such purposes merit some form of heightened protection. In addition, the FTC seeks to determine whether the concerns about secondary uses of data are limited to personally identifiable data (data that can be attributed to a specific person) or non–personally identifiable data.

The decision to intentionally draft these proposed "self-regulatory" principles in very general terms leaves a number of areas unaddressed and wanting for clarification. For instance, the proposal that companies obtain affirmative express consent prior to using data in a manner materially different from promises made when the company collected the data raises very important issues. What kind of burden does that place on a company, and are there limitations to the burden that a company must shoulder in obtaining affirmative express consent? And what is a material change? Naturally, a material change to one company might differ from that of another company.

Alternatively, consider the requirement that any company that collects or stores behavioral-advertising-related data must provide reasonable security and should retain the data only as long as required to fulfill a legitimate business purpose. The FTC does not define what it considers to be reasonable security, nor does it define a legitimate business purpose. As currently written, the proposal leaves these issues unanswered, and creates ambiguities that could pose future legal troubles for companies engaged in online advertising or that permit online advertising on their sites.

The FTC has requested comments on the appropriateness and feasibility of implementing its proposed principles for both consumers and businesses. The principles stand as an initial effort to balance the need to maintain vigorous competition with the need to protect consumers and are only written as suggestions. But if not narrowed as a result of public comment, the FTC will likely implement the very general and ambiguous proposed principles. These principles will undoubtedly have a significant effect on companies engaged in direct or indirect online advertising.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.