FTC regulation of behavioral advertising

“The Federal Trade Commission has been involved in addressing online privacy issues for almost as long as there has been an online marketplace.”[2] The FTC is now responsible for the enforcement of a number of sector-specific privacy statues, including the Gramm-Leach-Bliley Act, the Children's Online Privacy Protection Act, the CAN-SPAM Act of 2003, and the Telemarketing and Consumer Fraud and Abuse Prevention Act (“Do Not Call Rule”).

In 1995,[3] 1996,[3] and 1997[4] the FTC held public workshops exploring consumer data privacy issues. At these workshops, online advertising industry advocates pressed for self-regulation, while privacy advocates argued that self-regulation could only be successful when backed up by “legally enforceable rights to information privacy”.[5] Industry lobbyists argued for opt-out, which allows companies to use personal information for the purposes stated in a privacy policy or other form of notification, unless the consumer “opts-out” and notifies the company not to use the personal information in a certain manner, such as for marketing. Privacy advocates argued for prior affirmative consent, and suggested that software could be used by consumers to communicate their privacy preferences automatically.[5]

In 1998, the FTC released a report in which it undertook a comprehensive review of commercial websites’ disclosures of their privacy practices and laid out the Fair Information Practice Principles (FIPPs). The report concluded that, “[a]s evidenced by the Commission’s survey results, and despite the Commission’s three-year privacy initiative supporting a self-regulatory response to consumers’ privacy concerns, the vast majority of online businesses have yet to adopt even the most fundamental fair information practice (notice/awareness)”.[6]

The FTC held a further public workshop in 1999,[7] and in May 2000, released a report which for the first time recommended that Congress pass online privacy legislation to create a basic level of data privacy protection for consumer-oriented commercial web sites.[8]

In July 2000, the FTC recommended for the first time that legislation should be passed to protect Internet user’s privacy vis-à-vis online profiling.[9] The FTC further stated that “backstop legislation addressing online profiling is still required to fully ensure that consumers’ privacy is protected online” and recommended that [technology neutral] legislation be passed that created a basic level of privacy protection for users of “consumer-oriented commercial websites with respect to profiling”.[10] Under the FTC’s 2000 proposal, all online advertising networks and consumer-oriented commercial websites that allowed the collection of information from or about consumers would be required to implement and comply with the FIPPs.[9]

Congress did not enact the FTC’s recommended legislation, and another decade would pass before the FTC again proposed legislation to regulate OBA.[11]

FTC Commissioner Timothy Muris turned the FTC’s attention away from online privacy and OBA regulation in 2001, stating, “[t]he slowing of the growth of the Internet emphasizes the need to understand the cost of online privacy legislation…At this time, we need more law enforcement, not more laws”.[12]

In 2006 the FTC once again took up the mantle of online privacy protection at the November 2006 FTC forum, “Tech-ade”, which examined the “key technological and business developments that will shape consumers’ core experiences in the coming ten years”.[13] Participants at the forum described how technological advances in online profiling (now called “behavioral” advertising, targeting, or marketing), had allowed the practice to become more widespread and efficient.[14]

Building on the Tech-ade hearings, the FTC hosted a town hall meeting in November 2007 focused specifically on the privacy implications of behavioral advertising practices called, “Ehavioral Advertising: Tracking, Targeting, and Technology”.[15] The public meeting was prompted, in part, by the growth of behavioral advertising and the interest of large Internet companies in using such techniques to deliver narrowly targeted ads. These developments included Google’s plans to acquire DoubleClick, AOL’s interest in Tacoda, and Microsoft and Yahoo’s continued expansion of their own behavioral advertising products.[16] They also included a presentation by eBay with a live demonstration of the ebay.com website, highlighting the first on ad links enabling consumers to opt out of behavioral ads via an eBay program called AdChoice.

In December 2007, the FTC promulgated a set of proposed “Principles” intended to provide a basis for the online advertising industry’s self-regulatory efforts to address privacy concerns.[17] The Principles “call for companies to obtain affirmative express consent from consumers before they use data in a manner that is materially different than promised at the time of collection and before they collect and use 'sensitive' consumer data for behavioral advertising”.[18]

The FTC followed up this 2007 report with a further report in 2009, which further clarified the self-regulatory principles.[19] At the time, a coalition of consumer groups proposed a “Do Not Track List” in their comments to the 2007 town hall meeting.[20]

In a December 2010 report, the FTC proposed a new regulatory framework for consumer data privacy, including a proposal for a “Do Not Track” mechanism which would allow Internet users to opt out of OBA.[11]

In the report the FTC describes the limitations of the existing notice and choice model, which it states, “have become increasingly apparent in recent years”.[21] The FTC states that the notice and choice-based model, “encourages companies to develop privacy notices describing their information collection and use practices to consumers, so that consumers can make informed choices”.[22] However, “the notice-and-choice model, as implemented, has led to long, incomprehensible privacy policies that consumers typically do not read, let alone understand. Likewise, the harm-based model has been criticized for failing to recognize a wider range of privacy-related concerns, including reputational harm or the fear of being monitored”.[22]

In order to address the issues with the notice-and-choice-based model, the FTC’s proposed privacy framework calls on companies to provide consumers with a meaningful choice in regards to OBA tracking, but sets forth “a limited set of data practices for which choice is not necessary” called “commonly accepted practices”.[23] The commonly accepted practices include: Product and service fulfillment, internal operations, fraud prevention, legal compliance and first-party marketing, including contextual marketing.[24]

OBA, along with deep packet inspection (DPI), are specifically noted as not “commonly accepted practices”.[25] Furthermore, the report states that the FTC supports prior “affirmative express consent” in regards to the collection of “sensitive information” (children, financial and medical information, precise geolocation data) for OBA.[26]