Federal Trade Commission Issues Report on Online Profiling

The Federal Trade Commission today issued the second part of its report on online profiling by network advertisers. The Commission unanimously applauded the Network Advertising Initiative (NAI) for developing an innovative self-regulatory proposal which addresses the privacy concerns consumers have about online profiling. This report follows an initial report released on June 13, 2000, which described the nature of online profiling practices, consumer privacy concerns about these practices, and the Commission's efforts to address these concerns.

The report also calls for Congress to enact legislation to provide privacy protection for consumers with regard to such online profiling practices. Such legislation would serve to complement the NAI self-regulatory structure by guaranteeing compliance by non-member network advertising companies.

"This report reflects the Commission's view that industry self-regulation must play a central part in protecting consumer online privacy," said Jodie Bernstein, Director of the FTC's Bureau of Consumer Protection. "NAI played a valuable and constructive role in developing these Principles which serve as the basis for protecting consumer privacy in this area. I applaud their willingness to take significant steps in this area, and hope that the entire online industry follows their lead," Bernstein added.

However, according to Bernstein, there is still a need for legislative action in this area. "NAI constitutes over 90% of the network advertising industry. Legislative action is necessary to ensure the remaining 10% will comply with the protections outlined in NAI's Principles and to guarantee full compliance by all Web sites.

The NAI members have agreed to put their self-regulatory principles into effect immediately while Congress considers the Commission's recommendations concerning online profiling.

As the first part of the report released in June explained, many banner ads displayed on Web pages are not selected and delivered by the Web site visited by a consumer, but by network advertising companies that manage and provide advertising for numerous unrelated Web sites.

In general, these network advertising companies do not merely supply banner ads; they also gather data - in a practice called online profiling which is invisible to Web surfers.

Although the information gathered by network advertisers is often anonymous, in some cases, the profiles derived from tracking consumer's activities on the Web are linked or merged with personally identifiable information. This consumer data can also be combined with data on the consumer's offline purchases, or information collected directly from consumers through surveys and registration forms.

Because of the impact of this practice on consumer privacy, the FTC and the United States Department of Commerce jointly sponsored a Public Workshop on Online Profiling in November 1999. At that Workshop, industry members announced the formation of the Network Advertising Initiative (NAI), an organization comprised of the leading Internet Network Advertisers - 24/7 Media, AdForce, AdKnowledge, Avenue A, Burst! Media, DoubleClick, Engage, and MatchLogic - to develop a framework for self-regulation of the online profiling industry. Following the workshop, the NAI companies submitted drafts of self-regulatory principles for consideration by FTC and Department of Commerce staff. After lengthy discussions, a set of principles have emerged that the Commission finds will reasonably implement the fair information practice principles of notice, choice, access, and security which have guided the Commission with respect to online privacy issues.

The NAI Principles address the four information practice principles in the following ways:

Notice: Consumers will receive notice of network advertisers' profiling activities on host Web sites and have the ability to choose not to participate in profiling. If personally identifiable information is collected, "robust" notice (appearing at the time and place of information collection) will be required before the personal data is entered. Where non-personally identifiable information (or "clickstream" data) is collected for profiling, clear and conspicuous notice will be in the host Web site's privacy policy. Under the NAI Principles, NAI companies will contractually require that host Web sites provide these disclosures and will make reasonable efforts to enforce those requirements.

Choice: Once informed about the network advertiser's information collection practices, consumers should be able to decide whether to participate in profiling.

Under the NAI Principles, the choice method depends on the type of information collected and the consumers' knowledge about, and level of control over, the original collection of information. Any linkage of previously collected non-personally identifiable data to personally identifiable data cannot take place without the affirmative consent ("opt-in") of the consumer. "Robust" notice and opt-out choice is required for prospective uses of personally identifiable information. Use of non-personally identifiable information would require opt-out choice.

Access: The NAI Principles promise that consumers will be given reasonable access to personally identifiable information and other information that is associated with personally identifiable information retained by a network advertiser for profiling.

Security: Under the NAI proposal, network advertisers will make reasonable efforts to protect the data they collect for profiling purposes from loss, misuse, alteration, destruction, or improper access.

In addition, under the NAI principles, network advertisers have committed to working with an independent third party enforcement program, such as a seal program, to ensure compliance with the Principles. If no such program is available within six months, the NAI companies will submit to independent compliance audits, the results of which will be made publicly available.

The Commission vote to issue the report was 4-1, with Commissioner Leary concurring in part and dissenting in part, and Commissioner Orson Swindle dissenting.

Commissioner Swindle dissented from the report. He "wholeheartedly endorse[d] the language in the Commission's report commending NAI" for its self-regulatory principles. However, he dissented from the report because of its "recommendation that, despite NAI's laudable self-regulatory efforts, legislation is needed as a "backstop." The legislative recommendation calls for mandating the same "overly burdensome and unwarranted" four fair information practices that the Commission recently recommended be imposed to address online privacy. Moreover, Commissioner Swindle objected to imposing such "burdensome regulation on an entire industry to address the 10% of advertisers who are not members of NAI," which is a group of advertisers that the Commission "can neither define nor identify." According to Commissioner Swindle, "[w]e should not recommend legislation and regulation if we cannot demonstrate that the problems they are intended to resolve are real and significant." Finally, Commissioner Swindle posed the question of why the majority was unwilling to give recent "promising developments" in self-regulation and technology "a chance before resorting to the heavy hand of government intervention."

Commissioner Mozelle W. Thompson praised the NAI Principles and the report's recommendations, but called on the network advertising industry to educate consumers about the benefits of data collection. In his statement, the Commissioner said "this program alone will not provide all that consumers need and want in this area. Members of the profiling industry need to do more than derive self-benefit from gathering information from consumers that they follow around the World Wide Web. They must incorporate their self-regulatory program into a plan to demonstrate how consumers will benefit from information gathering and profiling. This undertaking is important both to consumers and to the future of the industry."

In his statement, Commissioner Thomas B. Leary endorsed the report's recommendations relating to the NAI Principles, safe harbor protections for such principles, and the call for some "backstop legislation." However, Leary added that "for the reasons expressed in my separate statement relating to online privacy generally, I believe that legislation should focus on adequate 'Notice' and not mandate across-the-board standards for other elements of the so-called 'fair information practices.'"

Commissioner Leary concluded by saying that "[n]otwithstanding these reservations, I have voted for this Report. Unlike the earlier, more general Commission Report on Privacy Online, this Report contains more points with which I concur than points from which I dissent. This Report focuses on a particularly serious issue that applies uniquely to the online world and it gives appropriate recognition to a comprehensive self-regulatory scheme. In these circumstances, the particular legislative proposals that I consider overbroad have a relatively limited impact. I am optimistic that further dialogue will continue to narrow our remaining points of disagreement."

Copies of the report and the Commissioner's separate statements are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580; toll-free: 877-FTC-HELP (877-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.

(FTC Matter No. P994809)