---

Published: April 2008

Recommendations to the FTC on behavioral advertising

Coalition: Privacy

Consumer Action, in conjunction with its Privacy Coalition partners, has asked the Federal Trade Commission to consider enforcement a necessary part of their principles in dealing with online behavioral advertising.

Click here to view the full text of the letter to the Federal Trade Commission 

The Center for Democracy & Technology (CDT), Consumer Action (CA), and Privacy Activism (PA) welcome the opportunity to comment on the FTC’s proposed principles for self-regulation of behavioral advertising. We are pleased that the FTC staff has not foreclosed any regulatory approaches to addressing behavioral advertising concerns despite having issued these principles. We believe that ultimately protecting consumer privacy interests in this space will require a rigorous mix of self-regulation, enforcement of existing law, and a new general privacy law backed up by regulatory enforcement. 

In regards to self-regulation, we are encouraged by the release of these principles. The Commission has sent a clear signal that the industry’s current self-regulatory framework has been insufficient to protect consumers. Practices on the Internet have moved beyond those anticipated by the current self-regulatory regime. Recent CDT research and information reported in the press confirm that the gaps between current self-regulation and current practices are numerous:

• Current self-regulation does not prohibit companies from overriding a consumer’s choice to not be tracked online, and CDT research has revealed that this practice is occurring on the Internet today through the use of “Flash cookies.”
• The Network Advertising Initiative (NAI) allows its members to use non-personally identifiable health information for behavioral advertising, but the large and growing number of consumers who search for health information online likely consider this information to be sensitive.
• Companies in the online advertising industry who are not NAI members are not bound by the NAI’s notice and choice requirements, allowing them to use health data for behavioral advertising without providing notice and choice, among other things. Consumers whose behavioral information is collected by such companies may have no way of knowing about it and no way of opting out.
• New ad networks appear to be using ISP traffic data for behavioral advertising without proper safeguards or user consent. No regulation or self-regulation exists to address the privacy implications of this new model.

Given this changing landscape, the FTC’s proposed principles are a solid first step towards protecting consumer privacy online, but much more work is needed to ensure consumer trust in the important and vibrant online advertising industry that supports Internet content. 

CDT, CA, and PA recommend that the FTC strengthen its proposed transparency principle and make consumer control a separate principle. We also suggest that data retention limits be tied to the purpose for which information was collected, and that the FTC host a workshop to explore the appropriate length of time for retaining behavioral data. We agree with the FTC that behavioral advertising based on sensitive data should require consumer consent, and we suggest that the definition of sensitive data include information about health, finances, sexual behavior, sexual orientation, government-issued identifiers, insurance identifiers, and precise geographic location. Finally, we suggest that more information is needed to understand the secondary uses of behavioral data and how the associated privacy risks should be addressed. 

In the FTC’s response to the public comments, we urge the Commission to clearly state how it will encourage companies to comply with its principles, whether there will be consequences for failure to comply, whether the Commission will publicly report on industry compliance and if so, the form that reporting will take, and whether a timeline will be imposed for company compliance. Without specific guidance to industry on these matters, we fear that the principles will have little impact and that companies will have little incentive to put the interests of consumers above short-term commercial advancements in behavioral advertising. Such a result would further erode user confidence in the commercial Internet’s central business model – advertising-supported content – at the same time that it weakens consumer privacy.

Click here to view the full text of the letter to the Federal Trade Commission

Lead Organization

The Center for Democracy & Technology

Other Organizations

The Center for Democracy & Technology | Privacy Activism

Download PDF

No Download Available