At the end of December 2007, the Federal Trade Commission published a set of Proposed Principles to govern behavioral advertising (“Principles”). Online “behavioral advertising” or “behavioral marketing” or “behavioral targeting” combines:

• Tracking consumer’s activities online, including the searches the consumer has conducted, the web pages visited, and the content viewed. This is now generally accomplished through the use of “web beacons” – also known as “web tags”, “clear GIFs”, “action tags” or “web bugs”; and
• Delivering advertising targeted to the individual consumer’s interests. This can be accomplished through serving advertisements to a user while the user navigates a site. It can also take the form of personalized promotional emails sent to that user.

The use of web beacons and other tracking technologies is not new. These technologies have been in place for more than five years. What is new is the substantial improvement in the precision and quality of the data collected.

However, the more accurate the data, the higher the risk of invasion of an individual’s privacy. Since the early days of the use of web tracking technologies, industry groups, consumer advocates, and individual companies have developed proposals and recommendations regarding the privacy issues raised by behavioral advertising, including a Do Not Track proposal.

The Principles recently published by the FTC encourage meaningful and enforceable self-regulation to address the privacy concerns raised with respect to behavioral advertising. In its announcement of the Principles, the FTC indicated that it intended to outline a framework to protect against harms to consumers’ privacy while continuing to support innovation in consumer services and products.

The FTC remains mindful of the importance of accommodating the wide variety of business models that exist in this area. On the other hand, the use of tracking technologies itself is largely invisible and unknown to consumers. Consumers cannot see web beacons, and have no way to control them, or block them. As a result, tracking technologies may lead to intrusion into a customer’s private affairs, and abuse and misuse of sensitive personal information.

Web Beacons

Tracking technologies (also named action tags, web beacons, clear GIFs, web tags, web bugs) are different from cookies.

Web beacons are inconspicuous to the user. They consist of a small string of software code, typically 1-by-1 pixel in size, that is placed on a webpage or an email message to track pages viewed or emails opened. Their size makes them invisible to the user. Cookies, on the other hand, are easily identified on a user’s computer. Go to the “Preferences” section of your browser. Open the tab “Privacy”, then click on “show cookies”. A list of cookies is displayed.

A user can also set her browser to accept or reject all cookies, or only cookies from specified sites. Cookies can be deleted. In your browser’s dashboard, click one of the two buttons under the list of cookies. You can delete all or only selected cookies. Thus, the user keeps some control over cookies. Not with web beacons. Web beacons cannot be removed or deactivated by the user because they do not reside on the user’s computer.

Web beacons can be used for reporting site traffic, counting unique visitors, or to audit advertising. With the advent of technology, they are now also able to record almost every move of a website user, such as the areas of a page that the user has downloaded or printed, or the ads on which the user has clicked. As a result, web beacons are considered more invasive, and are viewed as a greater threat to users’ privacy than cookies.

Further, to the extent that they may also collect sensitive information about a user’s lifestyle or concerns (such as frequent visits to medical sites), their use also creates substantial security implications. The data collected about the specific uses of a site may contain sensitive information, which may have to be guarded with substantial security measures.

How Behavioral Marketing Occurs

Behavioral marketing requires several components. In many cases, there is a combination of web tracking technologies and cookie technologies. The user is identified through cookies. The use of the site is tracked through web beacons. The collected data may include personal information (such as the user’s email) or not.

Once the information is collected, the company analyses this data. If no personal information was collected, the information may be used to manage the site, identify the pages with greater traffic, and the items of interest that are viewed for a longer period.

If personal information has been collected, the user is recognized when she returns to the site – through the IP address of her computer, or through a cookie placed on her computer. In this case, the site (or a network advertising company) then serves the user advertisements that are based on the profile associated with the user’s IP address. These personalized advertisements take into account the interest (or alleged interests) of the user, which were identified through the analysis of the prior visits of the user associated with that cookie.

In certain cases, the information collected through web tracking may include contact information, such as the user’s email address or user ID. The network advertising company may combine the user’s profile and the contact information that it holds about the user, in order to create personalized promotional emails to be sent to the user, with proposals and promotions tailored to the interest of the user. For example, the user who has shown interest for golf games may be sent an email advertisement with a promotion for a vacation in a gold resort.

Benefits and Risks of Behavioral Marketing

Behavioral marketing may offer substantial benefits to customers. For example, it may be instrumental in the provision of free web content or access to newspapers and information, which are provided free because they are subsidized by online advertising.

In addition, behavioral marketing allows for the generation of personalized ads. The customer might be more receptive to advertisements that are based on the customer’s profile. A customer interested in golf will likely be less annoyed by ads featuring Tiger Woods, than by those that sell diet pills or cell phone service.

On the other hand, behavioral marketing is based on the use of data that have been collected without the user’s knowledge because web beacons are inconspicuous. The perspective of being monitored anywhere and everywhere on the web makes web surfing much less enjoyable.

Principles Proposed by the Federal Trade Commission

The FTC Principles provide an attempt to funnel the tremendous development of behavioral marketing and limit the possible attacks on customer privacy. The Principles create a framework for the collection of information through web beacons, and the use of this information to serve targeted, personalized advertisements and other unsolicited communications to a user, that allows some control by the users. The Principles are consistent with prior decisions made by the FTC in other similar circumstances, such as in the Gateway Learning case (which is cited in the FTC’s comments to the Principles). The proposed Principles require:

• Transparency

A website where data is collected for behavioral advertising should provide a clear, concise, consumer-friendly, and prominent statement that data about consumers’ activities online is being collected at the site for use in providing advertising about products and services tailored to individual consumers’ interests.

• Consumer control; Opt-out

The statement should also provide that consumers can choose whether or not to have their information collected for such purpose. The website should also provide consumers with a clear, easy-to-use, and accessible method for exercising this option.

• Reasonable security

A company that collects and/or stores consumer data for behavioral advertising should provide reasonable security for that data. Such protections should be based on the sensitivity of the data, the nature of a company’s business operations, the types of risks a company faces, and the reasonable protections available to a company.

• Limited data retention

The company should retain data only as long as is necessary to fulfill a legitimate business or law enforcement need.

• Affirmative express consent for material changes to existing privacy promises

A company must keep any promises that it makes with respect to how it will handle or protect consumer data, even if it decides to change its policies at a later date. Therefore, before a company can use data in a manner materially different from promises the company made when it collected the data, it should obtain affirmative express consent from affected consumers.

• Affirmative express consent to (or prohibition against) using sensitive data for behavioral advertising

A company should only collect sensitive data for behavioral advertising if it obtains affirmative express consent from the consumer to receive such advertising.

The FTC seeks comment on the appropriateness and feasibility of these Principles. Comments must be sent to the Federal Trade Commission by Friday, February 22, 2008.

The Principles are generally consistent with Fair Information Principles and best practices. The most important requirement is that efforts should be made to ensure that users are made aware, in clear terms, of the use of tracking technologies, and that users should affirmatively consent to the uses of these technologies.

The Principles require a clear, concise, consumer-friendly, and prominent statement that data about consumers’ activities online is being collected at the site for use in providing advertising about products and services tailored to individual consumers’ interests. The website must clearly inform users that they can choose whether or not to have their information collected for such purpose. The website must also provide an accessible method for exercising this option.

Finally, the Principles stress the importance of obtaining the user’s affirmative express consent to a material change in its policies. Therefore, before a company can use data in a manner materially different from promises the company made when it collected the data, it should obtain affirmative express consent from the affected consumers.

Suggested measures

Companies contemplating to use technologies on their websites should evaluate their impact on the visitors of their website and the types of disclosures and consent that might be needed in order to proceed. While the FTC Principles are not yet final, and are open for comments, they are a clear indication of the FTC’s position with respect to these technologies. The FTC has proactively used its powers under Section 5 of the FTC Act to prosecute companies for their data protection practices.

The Principles provide a clear statement of what rules might be used in the near future to evaluate the adequacy of tracking technology uses. To the extent possible, companies should consider following the course of action provided in the Principles in order to be prepared for the possible adoption of the proposed terms.

The Principles would require that website visitors be made aware of the use of the technologies, and that the user affirmatively consent to the use of these technologies since in most cases, it would constitute a material change from prior information practices. The Principles would also require that the information collected through tracking technologies be protected with reasonable security measures, and be used only for as long as necessary for the company’s needs. These actions are consistent with Fair Information Practices that have been used in many parts of the work since the early 1970’s, and best practices that have emerged from the evolution of privacy concepts in this country and elsewhere.

Until the proposed FTC Principles are finalized and formally adopted, companies that intend to use tracking technologies in a manner different from that which might be described in their website privacy statements should consider the following actions:

• Notice: Inform users about the use of tracking technologies, what information will be collected, how it will be used, and to whom the information will be disclosed. Explain the use of tracking technologies and the subsequent uses of information collected through tracking technologies. Provide the information in clear and conspicuous language before the information is collected.
• Choice: Inform the individuals of the choices and means your company offers individuals for limiting the use and disclosures of their information; offer individuals the opportunity to chose whether their personal information may be collected, or used, and provide a clear and conspicuous, readily available mechanism to exercise the choice. Note that the proposed Principles currently provide for opt-in consent.
• Sensitive information: Do not use sensitive information of individuals without their affirmative or explicit consent. Note that the proposed Principles currently provide for opt-in consent.
• Limited Use: Limit the use of the information collected through tracking technologies to the purposes identified in the disclosures. The Principles provide that data should be retained only as necessary to fulfill a legitimate business need.
• Security: Take reasonable precaution to protect information collected through tracking technologies against loss, misuse, unauthorized access, disclosure, or alteration, as appropriate, given the potential sensitivity of the information.

Further, since the use of tracking technologies and the collected information is likely to constitute a change from prior practices, ensure that the users are made aware of the change to prior practices. The Principles clearly indicate that the FTC believes that the use of tracking technology constitutes a material change to a company’s practices. Consistent with its prior rulings, the FTC suggests that the materiality of the change requires that you obtain affirmative express consent to the new use of visitors and members’ information.

To do so, conspicuously post a notice of the upcoming changes to the privacy policy on the website. Ensure that users have a reasonable time to become aware of the change before the launch. Provide users with the option to choose not to have their use of your website tracked through web tracking technologies

Conclusion

The use of web beacons and other tracking technologies is not new; they have been in place for more than five years. However, recent improvements to the technology allow better precision and quality of the data collected. With better data, advertisers can identify with greater certainty the interest, preferences, and needs of users. With more targeted messages, they hope to increase the rate of return of their marketing campaigns.

With the increased quality of data, more accurate personal information may be collected. If accurate personal data about an individual can be collected regularly without the individual’s knowledge or consent, the privacy (and potentially the security) of that individual are at risk. Companies who want to be privacy leaders should implement promptly clear and conspicuous policies that are consistent with the proposed FTC Principles and give users of their website the right and ability to consent to the use of these technologies to collect personal information.