FTC Takes Wait-and-See Attitude Towards IAB Privacy Guidelines

New privacy guidelines put forth by the Interactive Advertising Bureau aren’t exactly well-defined, and the trade group intended it that way. Whether they’ll satisfy the Federal Trade Commission or other government regulators is about as open-ended as the standards themselves.

“They’re intentionally broad because we wanted to make sure they were universally applicable to all business models,” said Mike Zaneis, the IAB’s VP, public policy. “We will continue our work and look to see where we can apply these principles to the industry.”

It’s kind of a typical ‘do not disturb,’ ‘be nice’ kind of thing,” said Allen Stern media director at Agency.com of the new guidelines.

The five standards deal with providing notice on consumer data collection and usage, information security, and business accountability to consumers. In announcing the guidelines, IAB president and CEO Randall Rothenberg compared the new principles with the Federal Trade Commission’s guidelines on notice and consumer choice, suggesting, “the FTC is too rigid on the matters of notice and choice. Our principles strike the appropriate balance between protecting consumers’ security and allowing industry to provide the free services and content they desire.”

The FTC has fixed a watchful eye on the Internet ad industry, particularly when it comes to use of private consumer data for advertising. The agency held a forum specifically on behavioral targeting last year and has proposed guidelines for companies operating in the sector. In response to requests for more time, the FTC has extended the period for comment on those guidelines to April 11.

“We are hoping the IAB submits comment in response to our calls for comment,” said Jessica Rich, assistant director of the FTC’s division of privacy and identity protection. Rich said the IAB has yet to present comments on the behavioral guidelines. The FTC would “like to see much more detail” from the IAB, “so we can have a really meaningful discussion,” she added, noting the FTC won’t pass judgment on the IAB guidelines at this time. The IAB said it would be submitting comments to the FTC soon.

The IAB’s guide calls for companies to explain their collection and storage of consumer information “in a consumer-friendly manner” in privacy policies or elsewhere, and provide “meaningful notice” of how and for what advertising purposes consumer data are gathered. Choice regarding data collection for advertising such as opt-out capabilities should also be offered to consumers, “where appropriate,” according to the IAB.

The group also suggested its members — primarily online publishers — should ensure they and their partners take “reasonable security” precautions for data used in advertising. In addition, the IAB said companies should be accountable to consumers who have complaints and concerns, and should educate them about the benefits of online advertising.

Zaneis admitted the issues covered in the IAB’s umbrella set of principles are “not necessarily new or groundbreaking.” Indeed, the IAB released relatively broad guidelines as far back as 2000 calling for companies to reveal in their privacy policies what Personally Identifiable Information, or PII they collect and how it’s used or might be shared with third parties, in addition to choices available to consumers for the use and distribution of their PII.

One main difference between the much older standards and the latest guidelines is the new set covers “information for interactive advertising purposes,” rather than just PII. Much of the information used for Web ad targeting, including behavioral targeting, is non-PII.

Big names like AOL, Facebook, Google, IAC, Microsoft Digital Advertising Solutions, and NBC Universal Digital Media signed off on the new guidelines, as did ValueClick, which was penalized by the FTC for allegedly using consumer data inappropriately.

The proposed FTC guidelines call for all sites collecting data for behavioral targeting to notify consumers that data is being collected for such purposes and allow them to easily choose whether their data should be used in that way. Other proposed FTC standards are less specific. Even the commission said its initial principles are intended to be broad enough to be relevant to any firm doing behavioral targeting.

“We’re hoping the FTC will move towards a little bit of flexibility,” said Zaneis. “Context matters,” he added, noting the FTC needs to “reflect the reality of the industry.”

Though that reality involves rapid changes to technologies, company goals, and business models, it also increasingly entails the threat of more U.S. and European government intervention. In addition to the FTC’s recent focus on the industry, various U.S. Senate and House committees dealing with technology, antitrust, and the Internet have held or have expressed interest in holding hearings dealing with consumer privacy and the Internet advertising industry.

Privacy group Center for Digital Democracy was quick to pan the IAB’s new principles, claiming they should call for disclosure of all consumer data collection. The group’s executive director Jeff Chester stated, “IAB members are trying to hide behind the same failed approach [that has] led to governmental inquiries in the US and the EU.”

“I don’t think that [the IAB] really care yet,” about the regulatory threat, said Agency.com’s Stern. “I think they’ve had their way doing what they want to do,” he added, referring to the FTC’s approval of Google’s DoubleClick acquisition. “It’s been good business and so there’s really no motivation to really change it.”

“You can’t make a quality judgment about the weakness or strength” of the IAB’s new standards, said Zaneis, when asked whether industry groups like the IAB run the risk of spurring more government regulation if their own self-regulatory efforts don’t seem tough enough. “We need to make sure we’re bringing in everybody,” he continued, adding the guidelines are “important because they apply to everybody in the industry.”

The IAB recently has presented far more specific standards for data security and consumer data usage for lead generation advertising.

“The goal of these is to start from a platform… and then, down the road, build more specificity,” said Alan Chapell, president of privacy consulting outfit Chappell and Associates, who represented client companies on the IAB Policy Development Task Force and Policy Council, the group that developed the IAB guidelines.

UPDATE: Although originally categorized in this story as having been penalized for allegedly collecting or using consumer data inappropriately, Azoogle Ads, a supporter of the new IAB guidelines, was fined for allegedly failing to disclose the true cost of mobile ringtones in online ads.