Behavioral advertising seeks to target relevant content for individual Internet consumers, but to do so, it relies upon information specific to those individuals. As a result, there has been some concern about the proper handling of private information relating to Internet consumers.

Against this backdrop, the Federal Trade Commission (FTC) has proposed certain principles to, according to the FTC, "address the need for greater transparency and consumer control regarding privacy issues raised by behavioral advertising." Corporate America as well as public interest groups have been submitting public comments with respect to the proposed principles.

Principle 1

As far as its first proposed principle, the FTC suggests that "every Web site where data is collected for behavioral advertising should provide a clear, consumer-friendly, and prominent statement that data is being collected to provide ads targeted to the consumer and give consumers the ability to choose whether or not to have their information collected for such purpose."

Public interest groups have been in support of this principle. Indeed, there has been a suggestion that it should be strengthened by, for example, disclosing explicitly how consumers can control whether their information is being used for behavioral advertising.

Corporate America while generally agreeing that there should be disclosure of behavioral advertising, nevertheless feels that the opt-out portion should be eliminated because there should be study first as to whether it would adversely impact consumers.

Principle 2

The second principle proposes that "any company that collects or stores consumer data for behavioral advertising should provide reasonable security for that data and should retain data only as long as necessary to fulfill a legitimate business or law enforcement need."

Public interest groups, in the main, are in support of this proposed principle. Corporate America also seems to be in support, while seeking additional flexibility when it comes to reasonable data retention practices.

Principle 3

The FTC's third principle proposes that "companies should obtain affirmative express consent from affected consumers before using data in a manner materially different from promises the company made when it collected the data."

Here again, public interest groups appear to be in agreement. Corporate America has expressed some concerns. Specifically, it is argued that this principle must be modified to add clarity that it applies solely to material changes to existing privacy polices relating to online behavioral advertising and not to promises involving other privacy practices. Corporate America also seems to urge an opt-out approach, which generally is the U.S. privacy model, as opposed to the proposed opt-in approach.

Principle 4

The fourth principle proposed by the FTC suggests that "companies should only collect sensitive data for behavioral advertising if they obtain affirmative consent from the consumer to receive such advertising" and the FTC seeks comments on what actually constitutes "sensitive data" and whether use of such data should be prohibited flat out or subject to consumer choice.

Public interest groups appear to be lining up in favor of express affirmative consent for behavioral advertising that uses sensitive data. In terms of what should constitute sensitive data, suggestions have included health, financial, sexual behavior and orientation, Social Security, insurance and geographic location information.

Corporate America has weighed in with concerns. Those concerns include the current lack of definition of sensitive data. Also, if and when there is such definition, there is the additional worry that the definition will address information already covered by other laws or regulations - leading to extra and potentially confusing or conflicting requirements.

Principle 5

Finally, the FTC "is seeking additional information about whether tracking data is being used for purposes other than behavioral advertising and whether such secondary uses, if the occur, merit some form of heightened protection."

Public interest groups have stated that experience in this area largely has been anecdotal and have suggested that there should be workshops or additional written proceedings to flesh this out.

Corporate America has stepped up and acknowledged that there indeed are many secondary uses of tracking data. In so doing, examples have been provided such as authentication and Internet security measures, Web site reorganization of IP addresses, retention of information on sites to deliver customized functionality, improvements to usability of sites, and the determination of site popularity. Corporate America is quick to explain in this context that none of these uses should raise any heightened concerns.

Time will tell how the FTC will handle the many public comments it has received on its proposed behavioral advertising privacy principles. Corporate America seeks self-regulation, and urges that this type of advertising delivers a better, richer and more focused Internet consumer experience, whereas public interest groups remain concerned about how private data is handled and seem to want a more active hand by government in ensuring that privacy rights are not violated. Stay tuned.

Biography

Eric Sinrod is a partner in the San Francisco office of Duane Morris. His focus includes information technology and intellectual property disputes. To receive his weekly columns, send an e-mail to with the word "Subscribe" in the subject line.

Disclaimer: This column is prepared and published for informational purposes only and should not be construed as legal advice. The views expressed in this column are those of the author and do not necessarily reflect the views of the author's law firm or its individual partners.

Reprinted with permission of Findlaw.com