'Day of Reckoning' May Come to Online Ad Sector, Says FTC Commissioner

Revised behavioral advertising principles released by the Federal Trade Commission today may seem like a relatively minor step in its ongoing involvement with the online ad industry. However, statements from two commissioners who voted in favor of the revisions indicate a strong attitude in favor of regulation and legislation lurks beneath the FTC’s pro-self-regulation veneer.

Commissioner Jon Leibowitz, deeply involved in the FTC’s ongoing inspection of online advertising, warned in a statement, “A day of reckoning may be fast approaching.” “The jury is still out about whether [self-regulation] alone will effectively balance companies’ marketing and data collection practices with consumers’ privacy interests,” he wrote. Leibowitz has been named as the likely next chairman of the FTC; that role is currently filled by William Kovacic.

Commissioner Pamela Jones Harbour stressed the need for privacy legislation, and deemed the online ad industry’s self-regulatory efforts ineffective. “In practice, industry-driven self-regulation in the privacy arena has been characterized by inactivity,” wrote Harbour in a 12-page statement. Regarding various self-regulatory measures, she noted, “Multiple sets of conflicting principles do nothing to move past the status quo, and provide an inadequate basis for the Commission to condone a self-regulatory approach.”

Harbour, whose term expires this September, was the lone dissenter in the FTC’s approval of Google’s acquisition of DoubleClick. Her qualms about that deal, as well as continued self-regulation of online advertising, seem to center on the notion that a market for data has developed separately from the services that employ such data. The economic recession could exacerbate misuse of data, she suggested in her statement. “[I]n difficult economic times, when pressure mounts to extract the greatest possible value from every asset, some firms may be tempted to stray further into the zone of uncertainty between acceptable and unacceptable uses of consumer data.”

Harbour stressed the need for “comprehensive federal privacy legislation” to “unify and supplement the current piecemeal approach to privacy in the United States, while also acknowledging the global nature of information flows and the international diversity of approaches to these critical issues.”

Bureau of Consumer Protection Staff Member Jessica Rich reiterated the possibility of data privacy related legislation. “We expect when the Congress is finished [with current economic recovery-related legislation…it will return to privacy,” she told ClickZ News.

The FTC has fixed an eye on behavioral advertising in particular in recent years. In November 2007, the commission held a two-day forum focused on the topic. Today’s revised principles follow its proposed guidelines for behavioral advertising, released in December 2007, which were subject to public comment.

The new document takes into consideration several of those comments, including those submitted by industry representatives and privacy advocates. The original proposed guidelines called for disclosure regarding behavioral ad-related data collection, the ability for consumers to choose whether to allow that data collection, and corporate adherence to previous promises regarding the use of consumer data.

The new principles clarify when disclosure of data retrieval is necessary, noting that companies collecting data outside a Web site should provide relevant disclosure and choice in a clear, conspicuous manner. Also added to the previous guidelines is the suggestion that companies store data “only as long as is necessary to fulfill a legitimate business or law enforcement need.” In addition, when employing data for new, previously undisclosed uses, firms should abide by former promises made regarding the data and require “affirmative express consent” for new data uses.

“The Federal Trade Commission fell down on the job,” said World Privacy Forum executive director Pam Dixon during a press conference call this afternoon. Dixon’s damnation reflected the consensus of several groups concerned about the privacy implications of online data collection and security.

The commission also clarified that the principles pertain to ads targeted using behavioral data, not to advertising targeted by first-parties, or contextually-targeted advertising. Yet, in his separate statement, Leibowitz wrote, “All companies must keep their promises about how they will use consumers’ information. If they fail to do so — whether first party or third party, online or offline — we will go after them.”

Today’s FTC report indicates the commission may no longer distinguish between Personally Identifiable Information (PII) and Non-Personally Identifiable Information (PII) in relation to online data. Responding to suggestions from privacy advocates that the FTC’s guidelines for self-regulation apply to PII as well as non-PII, the report states “the traditional notion of what constitutes PII versus non-PII is becoming less and less meaningful and should not, by itself, determine the protections provided for consumer data.”

It states the best approach is to treat all data equally that could be associated with a consumer or a device, either at the time of collection or at some future date.

“In this context at least, the distinction between Personally Identifiable Information and Non-Personally Identifiable Information is not that meaningful anymore when you can develop a detailed profile of [a consumer] which can then be identifiable of them down the road,” said Rich. She suggested consumers “would care” if non-PII data is paired with identifiable information “that could later be associated with the consumer.”

The FTC suggested the online ad industry “ensure” its self-regulatory efforts “include meaningful enforcement.” In response to the FTC report, the Interactive Advertising Bureau released a statement reaffirming its commitment to developing behavioral ad privacy principles, noting its collaborative work with the American Association of Advertising Agencies, the Association of National Advertisers, the Direct Marketing Association, and The Council of Better Business Bureaus. The IAB has hinted at implementing enforcement mechanisms for industry self-regulations, but has yet to do so.

UPDATE: This story originally incorrectly reported that the role of FTC chairman is currently not filled. However, William Kovacic holds that seat.