Congressman, privacy groups challenge FTC Web-ad policy
The Federal Trade Commission released its principles for self-regulation of online ad targeting, but privacy groups and some lawmakers are unhappy with them.
A government regulatory agency said Thursday that it will continue to push for better self-regulation of online behavioral advertising, but privacy advocates--as well as a key congressman who plans to introduce data collection legislation soon--say self-regulation will not sufficiently protect consumers.
After considering public comments over the past two months, the Federal Trade Commission on Thursday released a revised set of four principles to guide self-regulation of online targeted ads. Yet the changes to the principles are minimal, privacy advocates say, and may even create more loopholes for online companies collecting behavioral data. Critics also charge the guidelines punt the important task of defining certain terms related to online advertising to the industry and public interest groups.
The following are the four principles:
• Web sites should prominently note their behavioral advertising practices and give consumers an accessible way to opt out of such programs. Companies are encouraged to make these notifications separate from general privacy policies. Companies that collect information through mobile devices or other means should ensure they have sufficient disclosure mechanisms.
• Companies are encouraged to maintain reasonable security and retention practices with respect to the data they collect.
• Companies are also encouraged to inform consumers of retroactive material changes to their data collection policies.
• And companies are encouraged to receive express consent from consumers before collecting "sensitive data," such as information about children, health information, and Social Security numbers.
The revised principles were issued with a report (PDF) that responds to comments the agency received on the topic. The commission voted 4 to 0 to approve the report, but two commissioners suggested the issue is far from resolved.
"Industry needs to do a better job of meaningful, rigorous self-regulation, or it will certainly invite legislation by Congress and a more regulatory approach by our commission," Commissioner Jon Leibowitz said. "Put simply, this could be the last clear chance to show that self-regulation can--and will--effectively protect consumers' privacy in a dynamic online marketplace."
Rep. Rick Boucher (D-Va.), who chairs the Internet subcommittee in the House Energy and Commerce Committee, said he intends to reintroduce data collection legislation in the "not-too-distant" future.
"I think self-regulation is helpful, and responsible Web sites will abide by (the principles), but self-regulation is not sufficient, in my opinion," Boucher told CNET News.
He said he and Rep. Cliff Stearns (R-Fla.), who is the ranking Republican on the Internet subcommittee, will introduce bipartisan legislation similar to a bill introduced in 2002, called the Consumer Privacy Protection Act, to ensure online companies notify consumers whenever behavioral or personal data is being collected.
"I think if we empower (Internet) users in this way, it would lead to greater consumer confidence, leading to more electronic commerce," Boucher said.
The congressman said his subcommittee will work in conjunction with the House Energy and Commerce's consumer protection subcommittee to put together a new version of the bill. The FTC and the Federal Commissions Commission would likely share authority enforcing it.
No big changes
The principles announced by the FTC are unlikely to result in any significant changes in online tracking, privacy advocates said, though they are broad enough to address practices such as Google's method of partially basing search results on a user's search history. Google applauded the revised principles.
"The FTC principles underscore that in a fast-evolving space like the Internet, a self-regulatory approach is the best way to protect consumers and promote innovation," Pablo Chavez, Google senior policy counsel, said on Google's public policy blog. "Google will continue to engage in efforts to develop strong self-regulatory principles and will continue to advocate for comprehensive federal privacy legislation."
Mike Cassidy, CEO of Undertone Networks, a premium online advertising network, also said that the revised principles are unlikely to change much.
"But I'm also of the belief not a lot needs to be changed," Cassidy said. "As a U.S. citizen, I think the government's got better things to do," such as addressing the current economic recession.
The provisions found in the so-called "stimulus" bill Congress is finalizing only make the need for regulation more important, argued Pam Dixon, executive director of the World Privacy Forum.
The FTC's principles are coming out "at the same time the stimulus package is going to fund millions of dollars of health care data moving online," Dixon said. "It's not a good intersection. I was hoping for more."
She said self-regulatory efforts such as the Network Advertising Initiative--to which both Google and Undertone Networks belong-- have been a "demonstrated failure."
Insufficient protection for "sensitive information" and kids
The NAI, she said, has insufficiently defined medical information in its own guidelines--yet the FTC on Wednesday called on industry groups and and privacy advocates to develop its own specific standards to address so-called "sensitive information."
"In terms of sensitive information, the FTC did a punt on this," Dixon said.
Furthermore, by neglecting to define "children," or address the fact that children are not able to give meaningful consent to data collection, the FTC "failed to protect kids from online predatory practices," said Corie Wright, a lawyer for Georgetown's Institute for Public Representation. Children, she said, are "increasingly becoming really attractive targets for marketers."
To the extent that any online behavioral targeting may amount to unfair or deceptive practices, the FTC will investigate them, said Jessica Rich from the FTC's Bureau of Consumer Protection. Meanwhile, the FTC will continue to evaluate this year self-regulatory programs like the NAI.
Jeff Chester, executive director of the Center for Digital Democracy said the agency has not taken a more proactive approach to regulating online targeting because of the Bush administration's preference for self-regulation.
"I see this document as the last official act of the Bush administration," he said, noting that President Obama has not yet appointed a new FTC chairman.
Congressman Boucher said he trusts Obama's judgment on the decision.
"I deeply respect his values and I'm confident he'll appoint a person of outstanding ability who shares his goals for consumer protection," he said.