The way the cookie crumbles

Share This Page

Following the ongoing discussion about behavioral advertising?  The FTC’s first online behavioral advertising case against a network advertiser offers insights into the agency's approach.

Chitika, Inc. acts as a go-between for websites and advertisers, delivering — according to the company’s site — three billion ad impressions a month.  How does that work?  According to the FTC, Chitika buys online ad space and contracts with advertisers to place ads on those sites. Chitika also places cookies on consumers’ browsers, tracking what they search for and the sites they visit.  Based on consumers' browsing history, Chitika serves up ads that correlate to their interests.

Chitika said in its privacy policy that it collects data about consumers’ preferences, but allows them to opt out of having cookies placed on their browsers and getting targeted ads.  People who clicked on the Opt-Out button in the privacy policy got the message “You are currently opted out.”

But according to the FTC, from at least May 2008 through February 2010, Chitika’s opt-out lasted only 10 days. After that, Chitika went back to placing tracking cookies — and serving up targeted ads — on the computers of people who had opted out.  That, said the FTC, rendered Chitika’s claims deceptive.

The settlement with Chitika contains a number of key provisions:

  • Chitika can’t misrepresent its data collection practices and the extent to which consumers are able to control how their information is collected, used, or shared.
  • Chitika has to take steps to improve the transparency of what it does and consumers’ ability to control the collection of consumer data for online behavioral advertising. For example, Chitika must place a clear and prominent notice with a hyperlink on its homepage that says “We collect information about your activities on certain websites to send you targeted advertisements. To opt out of Chitika’s targeted ads, click here.”
  • When people choose to opt out, Chitika has to honor that request for at least five years.
  • Near the opt-out mechanism, Chitika has to explain what it’s up to: 1) that it collects information about consumers’ online activities to deliver targeted ads; 2) that if consumers opt out, Chitika won’t collect information to serve up ads; 3) whether consumers are currently opted in or opted out of tracking; and 4) that consumers’ choice is specific to the browser they use. In other words, if they switch browsers or devices, they’ll have to opt out again.

Another order provision addresses consumers the FTC says have been left with the misimpression that they’re opted out.  For one year, Chitika has to have a prominent notice and hyperlink that says “If you opted out of our targeted ads before March 1, 2010, the opt-out has expired and you must opt out again to avoid targeted ads.” An additional provision requires that any behaviorally targeted ad Chitika serves has to have a hyperlink that says "Opt out?" that takes people to the required opt-out mechanism.  When the cursor hovers over the hyperlink, a box has to clearly and prominently say “Opt out of Chitika’s targeted ads.”


Can Spam Act - If you are sending purely educational information about Federal Legislation, no sales, no relationship, no promotion of any product - does the Act require you put your address in the email? The email goes to workers needing to comply with the Federal law. Thank you.
Hi, Sue. Thanks for your question. The definition of "commercial email" under the CAN-SPAM is any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service, including an email that promotes content on a commercial website. Of course, there's no way to answer your question without having all the facts, but that definition seems like the best place to start. By the way, The CAN-SPAM Act: A Compliance Guide for Business may offer more info on the subject.

Add new comment

Comment Policy

Privacy Act Statement

It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system (PDF), and user names also are part of the FTC’s computer user records system (PDF). We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.