For Release: July
27, 2000 Federal Trade Commission Issues Report on
Online Profiling
Commends Network Advertising Initiative's Self Regulatory
Principles
The Federal Trade Commission today issued the second part of its report on online
profiling by network advertisers. The Commission unanimously applauded the Network
Advertising Initiative (NAI) for developing an innovative self-regulatory proposal which
addresses the privacy concerns consumers have about online profiling. This report follows
an initial report released on June 13, 2000, which described the nature of online
profiling practices, consumer privacy concerns about these practices, and the Commission's
efforts to address these concerns.
The report also calls for Congress to enact legislation to provide privacy protection
for consumers with regard to such online profiling practices. Such legislation would serve
to complement the NAI self-regulatory structure by guaranteeing compliance by non-member
network advertising companies.
"This report reflects the Commission's view that industry self-regulation must
play a central part in protecting consumer online privacy," said Jodie Bernstein,
Director of the FTC's Bureau of Consumer Protection. "NAI played a valuable and
constructive role in developing these Principles which serve as the basis for protecting
consumer privacy in this area. I applaud their willingness to take significant steps in
this area, and hope that the entire online industry follows their lead," Bernstein
added.
However, according to Bernstein, there is still a need for legislative action in this
area. "NAI constitutes over 90% of the network advertising industry. Legislative
action is necessary to ensure the remaining 10% will comply with the protections outlined
in NAI's Principles and to guarantee full compliance by all Web sites.
The NAI members have agreed to put their self-regulatory principles into effect
immediately while Congress considers the Commission's recommendations concerning online
profiling.
As the first part of the report released in June explained, many banner ads displayed
on Web pages are not selected and delivered by the Web site visited by a consumer, but by
network advertising companies that manage and provide advertising for numerous unrelated
Web sites.
In general, these network advertising companies do not merely supply banner ads; they
also gather data - in a practice called online profiling which is invisible to Web
surfers.
Although the information gathered by network advertisers is often anonymous, in some
cases, the profiles derived from tracking consumer's activities on the Web are linked or
merged with personally identifiable information. This consumer data can also be combined
with data on the consumer's offline purchases, or information collected directly from
consumers through surveys and registration forms.
Because of the impact of this practice on consumer privacy, the FTC and the United
States Department of Commerce jointly sponsored a Public Workshop on Online Profiling in
November 1999. At that Workshop, industry members announced the formation of the Network
Advertising Initiative (NAI), an organization comprised of the leading Internet Network
Advertisers - 24/7 Media, AdForce, AdKnowledge, Avenue A, Burst! Media, DoubleClick,
Engage, and MatchLogic - to develop a framework for self-regulation of the online
profiling industry. Following the workshop, the NAI companies submitted drafts of
self-regulatory principles for consideration by FTC and Department of Commerce staff.
After lengthy discussions, a set of principles have emerged that the Commission finds will
reasonably implement the fair information practice principles of notice, choice, access,
and security which have guided the Commission with respect to online privacy issues.
The NAI Principles address the four information practice principles in the following
ways:
Notice: Consumers will receive notice of network advertisers'
profiling activities on host Web sites and have the ability to choose not to participate
in profiling. If personally identifiable information is collected, "robust"
notice (appearing at the time and place of information collection) will be required before
the personal data is entered. Where non-personally identifiable information (or
"clickstream" data) is collected for profiling, clear and conspicuous notice
will be in the host Web site's privacy policy. Under the NAI Principles, NAI companies
will contractually require that host Web sites provide these disclosures and will make
reasonable efforts to enforce those requirements.
Choice: Once informed about the network advertiser's information
collection practices, consumers should be able to decide whether to participate in
profiling.
Under the NAI Principles, the choice method depends on the type of information
collected and the consumers' knowledge about, and level of control over, the original
collection of information. Any linkage of previously collected non-personally identifiable
data to personally identifiable data cannot take place without the affirmative consent
("opt-in") of the consumer. "Robust" notice and opt-out choice is
required for prospective uses of personally identifiable information. Use of
non-personally identifiable information would require opt-out choice.
Access: The NAI Principles promise that consumers will be given
reasonable access to personally identifiable information and other information that is
associated with personally identifiable information retained by a network advertiser for
profiling.
Security: Under the NAI proposal, network advertisers will make
reasonable efforts to protect the data they collect for profiling purposes from loss,
misuse, alteration, destruction, or improper access.
In addition, under the NAI principles, network advertisers have committed to working
with an independent third party enforcement program, such as a seal program, to ensure
compliance with the Principles. If no such program is available within six months, the NAI
companies will submit to independent compliance audits, the results of which will be made
publicly available.
The Commission vote to issue the report was 4-1, with Commissioner Leary concurring in
part and dissenting in part, and Commissioner Orson Swindle dissenting.
Commissioner Swindle dissented from the report. He "wholeheartedly endorse[d] the
language in the Commission's report commending NAI" for its self-regulatory
principles. However, he dissented from the report because of its "recommendation
that, despite NAI's laudable self-regulatory efforts, legislation is needed as a
"backstop." The legislative recommendation calls for mandating the same
"overly burdensome and unwarranted" four fair information practices that the
Commission recently recommended be imposed to address online privacy. Moreover,
Commissioner Swindle objected to imposing such "burdensome regulation on an entire
industry to address the 10% of advertisers who are not members of NAI," which is a
group of advertisers that the Commission "can neither define nor identify."
According to Commissioner Swindle, "[w]e should not recommend legislation and
regulation if we cannot demonstrate that the problems they are intended to resolve are
real and significant." Finally, Commissioner Swindle posed the question of why the
majority was unwilling to give recent "promising developments" in
self-regulation and technology "a chance before resorting to the heavy hand of
government intervention."
Commissioner Mozelle W. Thompson praised the NAI Principles and the report's
recommendations, but called on the network advertising industry to educate consumers about
the benefits of data collection. In his statement, the Commissioner said "this
program alone will not provide all that consumers need and want in this area. Members of
the profiling industry need to do more than derive self-benefit from gathering information
from consumers that they follow around the World Wide Web. They must incorporate their
self-regulatory program into a plan to demonstrate how consumers will benefit from
information gathering and profiling. This undertaking is important both to consumers and
to the future of the industry."
In his statement, Commissioner Thomas B. Leary endorsed the report's recommendations
relating to the NAI Principles, safe harbor protections for such principles, and the call
for some "backstop legislation." However, Leary added that "for the reasons
expressed in my separate statement relating to online privacy generally, I believe that
legislation should focus on adequate 'Notice' and not mandate across-the-board standards
for other elements of the so-called 'fair information practices.'"
Commissioner Leary concluded by saying that "[n]otwithstanding these reservations,
I have voted for this Report. Unlike the earlier, more general Commission Report on
Privacy Online, this Report contains more points with which I concur than points from
which I dissent. This Report focuses on a particularly serious issue that applies uniquely
to the online world and it gives appropriate recognition to a comprehensive
self-regulatory scheme. In these circumstances, the particular legislative proposals that
I consider overbroad have a relatively limited impact. I am optimistic that further
dialogue will continue to narrow our remaining points of disagreement."
Copies of the report and the
Commissioner's separate statements are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer
Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580;
toll-free: 877-FTC-HELP (877-382-4357); TDD for the hearing impaired 1-866-653-4261. To find
out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.
- MEDIA CONTACT:
- Eric London
- Office of Public Affairs
- 202-326-2180
- STAFF CONTACT:
- Dana Rosenfeld
- Bureau of Consumer Protection
- 202-326-2113
(FTC Matter No. P994809)
(onlineprofiling2) |