The FTC Privacy Report

In December of 2010, the Federal Trade Commission (FTC) issued its much anticipated staff privacy report, entitled "Protecting Consumer Privacy in an Era of Rapid Change" (Report). In it, the FTC set forth a proposed framework for how businesses should address consumer privacy and established best practices on a myriad of issues. One of the more controversial topics in the Report is online behavioral advertising (OBA).

Over the last decade, the FTC has examined the consumer privacy issues raised by OBA, which involves tracking consumers' Internet activities (e.g., Web pages visited, searches conducted) to deliver advertisements targeted to particular interests. In recent years, technological advances have allowed Website advertising companies to create profiles about online consumers' tastes, needs and purchasing habits. These types of profiles enable virtually instantaneous decisions to be made about the types of ads that will match specific interests.

Although a few states have passed legislation restricting OBA activities, currently there is no comprehensive federal law on the subject. In 2007 and again in 2009, the FTC issued "Self-Regulatory Principles" for OBA. As the name makes clear, these FTC principles are non-binding guidelines aimed at encouraging industry to "do the right thing."

Industry's self-regulatory efforts have been met with mixed reviews. Over the last few years, as OBA has become more prevalent, so have consumers' concerns about how companies are using data collected online. (In May of 2010, the Ponemon Institute conducted a survey finding that although 63 percent of companies rated OBA as their most effective form of marketing, 98 percent restricted OBA due to privacy concerns).

The Report noted that while some industry members have taken "positive steps toward improving consumer control" (e.g., opt-out mechanisms), industry efforts as a whole to implement choice "have fallen short." The FTC suggested that the "most practical" way to offer consumers a "uniform and comprehensive" choice mechanism is through a universal Do Not Track mechanism. Do Not Track would likely involve "placing a setting similar to a persistent cookie on a consumer's browser and conveying that setting to sites that the browser visits, to signal whether or not the consumer wants to be tracked or receive targeted advertisements."

The Report did note that any such mechanism should not "undermine the benefits" offered by OBA, such as funding online content and services and providing relevant advertisements that many consumers want. It also stressed that any such mechanism must be understandable and simple. The FTC advised that Do Not Track could be accomplished either through legislation or "robust, enforceable self-regulation."

Many central issues were left open, however, such as how this mechanism would work operationally, how it would be offered, which entities would actually be covered, and which technologies would be used to implement it. Likewise, it is not clear how a consumer — rather than a consumer's computer or IP address which might be shared with others — would be identified and authenticated.

The FTC Seeks Comments

Recognizing the complexity of such a mechanism, the Report sought comments on a variety of related issues, such as:

  • How should a universal choice mechanism be designed for consumers to control OBA?
  • How can such a mechanism be offered to consumers and publicized?
  • How can such a mechanism be designed to be clear, easy-to-find, usable, and understandable to consumers?
  • What are the potential costs/benefits?
  • How many consumers would likely choose to avoid OBA?
  • How many consumers have already utilized the industry opt-out tools currently provided?
  • What is the likely impact if large numbers of consumers opt out and how would it affect online publishers/advertisers and consumers?
  • In addition to the option to opt out of receiving ads completely, should the mechanism also include an option that allows consumers more granular control over the types of advertising they want to receive and the type of data they are willing to have collected about them?
  • Should this mechanism be extended to include behavioral advertising for mobile applications?
  • If the private sector does not implement an effective Do Not Track mechanism, should the FTC recommend legislation requiring Do Not Track?

Summary of Comments Received by FTC

The FTC received 446 comments. While some comments were "neutral," the majority were either strongly for or against the creation of a Do Not Track mechanism.

Many commentators argued that the proposed Do Not Track mechanism is not needed since existing selfregulatory programs already do the job. For example, various organizations, such as the Direct Marketing Association (DMA), the American Association of Advertising Agencies (AAAA) and others have introduced a selfregulatory program for OBA that encourages businesses to add an advertising opt-out icon to their websites. The icon should link consumers to sites where they can opt out of online tracking (not all ad networks are currently part of the program, however). Some commentators argued that the federal government should not undercut the industry's commitment to a self-regulatory program by creating a duplicative Do Not Track mechanism and that such a mechanism "would reverse the substantial progress made in the last 15 months and could signal to consumers that they should not trust the business community or online behavioral advertising as a whole."

Likewise, while agreeing with the Report's general notions of greater consumer education and transparency, Office Depot's global head of e-commerce disagreed with the proposed broad implementation structure of the Do Not Track mechanism. "I think the aspiration of getting to these goals is good, but the simplistic solution of an on-off switch will enormously disrupt the consumer experience with their favorite vendors [and] ... would take us back five years ago and make the experience far less personal." Others questioned how robust online content and services, currently supported by advertising and marketing, would continue.

The consumer advocacy groups, on the other hand, generally argued that highly sophisticated and invisible online tracking activities dictate that the FTC step in and help protect consumers with stronger privacy safeguards. One commenter noted that the average website incorporates 64 independent mechanisms for tracking visitors over time and across websites, and that the "vast majority" of Americans oppose this practice. The Center for Digital Democracy (CDD) and U.S. PIRG submitted a joint filing which provided a detailed view of this complex tracking machine.

Many advocacy groups commented that a consumer's ability to opt-out of the data collection process entirely via the Do Not Track mechanism is a crucial component to ensure proper privacy protection. Countering the advertising industry's claims that increased privacy regulations would hurt consumers' online experiences, these groups argued that increased privacy protection would lead to greater consumer confidence — thereby causing consumers to be more active in the online marketplace.

Key Takeaways

The Report was intended to create the opening round with respect to OBA, not the final word. The number of issues on which the Report sought comment makes this clear. The volume and scope of comments filed in response to the Report illustrate that OBA is a polarizing issue and the stakes are high. Many issues remain to be resolved, particularly with respect to a potential Do Not Track mandate. The FTC will need time to review all the comments, which should provide a better understanding of and appreciation for the marketplace realities faced by the online businesses and consumers' desires and concerns with respect to OBA. A revised report, which is likely to have far-reaching implications, will likely be released later this year.

We will continue to watch for developments in this area.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.