The nation's largest media and marketing trade associations introduced a set of self-regulatory principles on Thursday to enhance privacy protection for consumers surfing the Web.
Among other things, advertisers and Web sites will be required to clearly inform consumers about the data-collection practices they use. The new guidelines also will enable online users to exercise control over their personal information.
"This historic collaboration represents businesses and trade associations working together to advance the public interest," said Interactive Advertising Bureau CEO Randall Rothenberg. "We are acting early and aggressively on their concerns, to reinforce their trust in this vital medium that contributes so significantly to the U.S. economy."
Changing the Status Quo
The new set of principles represents the behavioral advertising industry's direct response to mounting criticism from members of Congress and the Federal Trade Commission. Earlier this year, FTC Chairman Jon Leibowitz warned the industry that it needed to do a better job of delivering meaningful, rigorous self-regulation.
"Put simply, this could be the last clear chance to show that self-regulation can -- and will -- effectively protect consumers' privacy in a dynamic online marketplace," Leibowitz said.
Self-regulation, if it works, can be the fastest and best way to change the status quo, Leibowitz noted. "If there isn't an appropriately vigorous response, my sense is that Congress and the commission may move toward a more regulatory model," Leibowitz said.
The industry has incorporated many of the ideas that consumer advocacy watchdogs such as the Center for Democracy and Technology have suggested. On the upside, noted CDT Chief Computer Scientist Alissa Cooper, the guidelines include a robust framework for providing notice outside of privacy policies, and lay the groundwork for the use of a uniform link or icon that would appear on any Web site or advertisement where data is collected or used for behavioral advertising.
"The principles explicitly address business models that may rely on the collection of all or substantially all of a consumer's Web traffic for behavioral advertising -- including ISP-based models," Cooper said. "And the principles provide for strong enforcement through existing and to-be-created compliance programs."
However, Cooper said the nation's largest media and marketing trade associations haven't gone far enough toward protecting consumers.
"The notion of 'sensitive information' needed to cover a broad array of data types, including health information and location data," Cooper said. "The advertiser principles cover only a very limited subset of medical information and leave out location data altogether."
Cooper also observed that the new principles say nothing about providing consumers with access to the behavioral data collected about them. "Google has demonstrated that providing profile access is possible, and we would expect the rest of the industry to follow suit," Cooper said.
The real test for these principles, say privacy advocates, lies not in their ability to withstand the scrutiny of Congress, the FTC and consumer watchdogs, but in how the advertising industry itself implements them. "Six months from now is when we'll know how good or bad these guidelines really are," Cooper said.
Google said one of the key strengths of the new set of advertising principles is the fact that they apply to a broad range of companies participating in online advertising, including advertisers, publishers and ad networks.
"Of course, for any self-regulatory effort to be effective, there has to be some kind of enforcement process," said Google's Managing Policy Counsel Pablo Chavez. "Between now and early 2010 -- when the principles are expected to be implemented -- the Better Business Bureau and Direct Marketing Association, two of the groups involved, will work to set up that process to make sure it has real teeth."