Legal News

New blood is at the helm of consumer protection at the Federal Trade Commission (FTC), and the agency's approach to behavioral advertising may change. Existing rules which require disclosure of the practice may not adequately protect privacy. What's unclear, however, is what new rules should replace them.

Behavioral advertising is advertising that uses data regarding people's past behaviors in order to bring them targeted advertisements. Your grocery store card is one example. That beer and bag of chips you bought last night might well determine what coupons show up on the back of your next receipt.

For the most part, however, we are talking about online behavioral advertising -- where information about a web user (web surfing history, data on their computer, etc.) is used to determine which ads the user sees. Websites can also track information about a user and make money by selling the data to third party web advertisers.

The practice is widespread, with proponents arguing that it lowers the cost of web content by allowing advertisers to pay a premium for ads that more efficiently reach their desired customers. They also argue that consumers are better served by getting ads relevant to their desires.

Privacy advocates, on the other hand, argue that web users aren't always aware of what data about them is being collected, how it is used, or who will be able to use it.

Currently, federal regulations require that websites tracking user data fully disclose that they are doing so. However, this disclosure often is hidden within the fine print of a website's usage policy or user agreement.

Recently, as described in a column by Professor Anita Ramasastry, the FTC came down hard on Sears for failing to properly disclose the extent of their user monitoring (which was pretty extreme).

The FTC ordered Sears to beef up disclosure of: 1) all data being collected; 2) how it might be used; and 3) whether it may be used by third parties.

To promote self-regulation, the online advertising industry has beefed up the disclosure called for by its own guidelines.

Some, however, wonder whether disclosure is enough. One other option being thrown around is an "opt-in" requirement.

Currently, the default is that a user's data will be tracked unless they opt-out (for example by not using the website, or by not allowing tracking if the website has such an option). Making users opt-in to the data collection up front might prevent uninformed users from having their data tracked. Users who want to benefit from targeted ads could simply opt-in.

As discussed in a recent interview with the New York Times, the new head of consumer protection at the FTC, David Vladeck sees a possible role for behavioral advertising opt-in regulation, even if it is not required in all cases.

We'll see if anything comes of it.

• Following Your Web Footsteps (PCMag.com)
• Beware of Privacy-Policy Loopholes (PC World)
• Online Fine Print Doesn't Satisfy the FTC's New Consumer Chief (ABA Journal)
• FTC Staff Revises Online Behavioral Advertising Principles (FTC, February 2009)
• Basic Privacy Rights (provided by Knapp & Roberts)