Just before Christmas, separate but simultaneous to its approval of the Google-DoubleClick acquisition, the FTC sweetly asked websites to voluntarily do two things: step up the disclosures they make about the data they collect and seek permission before tracking people's web surfing. It then dropped a bombshell: It hinted that it will view any marketer sites that don't do those things as offering inadequate protection.
You see, up until now the industry has been largely self-regulated and, to date, internet privacy and data collection has yet to become a consumer hot-button issue with real ramifications for marketers and media sellers, unlike childhood obesity or pharmaceutical ads. And even privacy advocates suggest consumers aren't as concerned about the issues as they should be.
Tougher than expected
But, of course, none of that matters if privacy advocates and the FTC make enough noise to attract Congress' attention. The FTC's latest proposals are, technically, voluntary. But marketers ignore the FTC requests at their own peril, say some experts, and the online-ad industry's practices could be the subject of legislation.
"The announced principles are a lot tougher on the industry than most observers expected," said Peter Swire, who was the Clinton administration's chief counselor on privacy and is now a senior fellow at the Center on American Progress. "Companies are going to have to give consumers a realistic choice on whether they want to be tracked online."
Mr. Swire said the FTC is sending a signal that the industry shouldn't ignore -- because Congress is now aware of the issue. Among the FTC's proposed "enhanced principles" that marketers would have to follow for websites:
-- Each site collecting behavioral data for ad tracking should provide a clear, consumer-friendly and prominent statement disclosing data being collected to target ads and letting consumers choose whether to let their information be collected for such a purpose.
-- Any company collecting or storing behavioral-ad consumer data must provide reasonable security for that data and retain it only as long as is necessary to fulfill a legitimate business or law-enforcement need.
-- Websites may use sensitive data -- medical information or children's activities online -- for behavioral targeting only if consumers specifically opt in.
-- Marketers who decide to alter their privacy guidelines to use information in a new way will be required to go back to consumers to get their consent before using that information again.
The FTC asked for comment on the principles.
Some consumer groups had called for the FTC or Congress to limit behavioral tracking rather than relying on voluntary industry action. But some suggest the "voluntary" principles could be a major change for the FTC and put considerable pressure on the ad industry and marketers to let consumers opt out of cross-website tracking.
Jeff Chester, executive director of the Center for Digital Democracy, said the standards seem to be an attempt by the FTC staff to state what would be the minimum needed to pass muster and comply with safe-harbor industry self-regulation, but he said the request for comments indicated the final standards may be different.
An Interactive Advertising Bureau official praised the FTC for addressing the privacy issue but said his group has yet to thoroughly examine the FTC guidelines.
"They hit on the major industry issues that the industry is working on," said Mike Zaneis, VP-public policy. While saying he had just received the proposal, "it's by and large appropriately focused."
He said the industry is in the midst of rewriting its guidelines to keep up with technological developments.