title: The FTC principles --

The FTC principles for behavioral advertising - an OK solution to the wrong problem

By: Scott Bradner

Recently the US Federal Trade Commission (FTC) published a somewhat tweaked set of principles that they intend to be guidelines for self regulation for companies collecting information on the actions and activities of Internet users for the purpose of providing advertising to those users. I expect that the FTC does not feel that they have the authority to make any binding rules without Congressional action. But, even agreeing with that limitation, these principles are underwhelming and, as demonstrated by Google, are quite limited in usefulness even where companies claim to meet them.

The four FTC principles are at the end of a FTC Staff Report titled "Self-Regulatory Principles For Online Behavioral Advertising." (http://www.ftc.gov/os/2009/02/P085400behavadreport.pdf) They basically try to encourage good behavior on the part of companies engaged in behavioral advertising. The principles are:

1/ transparency and customer control - web sites collecting data to be used in behavioral advertising should tell users that they are collecting and enable a user to opt-out

2/ reasonable security, and limited data retention for customer data - anyone collecting such data should provide reasonable security for it and only retain the data as long as needed to meet the business need

3/ affirmative express consent for material changes to existing privacy promises - new privacy policy should not control use of data collected under previous privacy policy without user opt-in

4/ affirmative express consent to use sensitive data for behavioral advertising - should not use sensitive data (like SSNs) without user opt-in

These principles are OK, not great, but they have no teeth - they are completely voluntary and there is little if any real penalty if a company decides to ignore one or more of them. The FTC might ask them pretty please to stop but that's about it.

My biggest problem with the new FTC principles is that they represent yet another point solution to a symptom rather than anything addressing the underlying cause. Why should principles such as these be limited to the specific case of behavioral advertising? Why shouldn't we have principles that apply to any and all information about me that someone else gets a hold of in any way?

The FTC principles also have generally been diluted in favor of the advertising industry rather than being shaped primarily by your or my best interests. I note that the FTC staff lists industry representatives first when they talk about who they talked to. The principles are not all one sided, they do include some things that the industry objected to but not all that many.

Google has expressed support for the FTC's action (http://googlepublicpolicy.blogspot.com/2009/02/reaction-to-ftcs-advertising-privacy.html) but may be a very good example of what is lacking in these principles. As I mentioned in last week's column, Google is less than forthcoming when addressing the transparency requirement. I have not been able to figure out just what they collect about me and my actions with their various tools (including the basic search engine, Google Analytics, Google earth, and Google Latitude).

After last week's column I was contacted by someone from Google to say that my fears about Latitude were overblown because they only keep a single location, the last one they received, for the people who have enabled location sharing via Latitude. That is good news. When I asked where on the Google web page they say that the response was that it was towards the end of a video they posed to You Tube. This is a perfect example of what is wrong with the FTC principles -- Google cannot even get it together enough to put good privacy news on its web page in a way that the user can find and understand it.

disclaimer: Understanding underlying principles is a goal of any good educational intuition but I know of no Harvard view on this example so the above is my principled review.