To our clients and friends:

JANUARY 29, 2008



New York


Los Angeles

Palo Alto

San Diego


One Financial Center
Boston, Massachusetts 02111
617 542 6000
617 542 2241 fax

701 Pennsylvania Avenue, N.W.
Washington, D.C. 20004
202 434 7300
202 434 7400 fax

666 Third Avenue
New York, New York 10017
212 935 3000
212 983 3115 fax

707 Summer Street
Stamford, Connecticut 06901
203 658 1700
203 658 1701 fax

2029 Century Park East
Los Angeles, California 90067
310 586 3200
310 586 3202 fax

1400 Page Mill Road
Palo Alto, California 94304
650 251 7700
650 251 7739 fax

5355 Mira Sorrento Place
San Diego, California 92121
858 320 3000
858 320 3001 fax

The Rectory
9 Ironmonger Lane
London EC2V 8EY England
+44 (0) 20 7726 4000
+44 (0) 20 7726 0055 fax

FTC Proposes “Self-Regulatory” Principles for Ehavioral Online Advertising

Late in December, the Federal Trade Commission (FTC) released a set of proposed self-regulatory principles designed to address the rapidly evolving practice of “behavioral advertising.” The FTC notes that the practice, broadly defined as the “tracking of a consumer’s activities online—including the searches the consumer has conducted, the web pages visited, and the content reviewed—in order to deliver advertising targeted to the individual consumer’s interests,” could pose important consumer privacy issues. Although the FTC proposal is “self-regulatory,” the “announced principles are a lot tougher … than most observers expected,” Professor Peter Swire, a noted privacy expert, told Advertising Age. Participants at the recent FTC town hall meeting entitled “Ehavioral Advertising: Tracking, Targeting, and Technology” raised some of the more pervasive issues surrounding behavioral advertising and were summarized in a Mintz Levin Privacy Alert (available here). The FTC’s proposed principles provide very general responses to the issues raised at the meeting. The full FTC release, is available here. The FTC’s proposal states that behavioral advertising provides benefits to consumers in the form of free content and personalized advertising but notes that this practice is largely invisible and unknown to consumers.

To address issues that emerged from the town hall meeting, the FTC proposed the following “principles”:

  • Transparency: Any web site that collects data used for behavioral advertising should provide a “clear, consumer-friendly, and prominent statement” that the data is being collected to provide targeted ads. The website must also allow consumers to easily choose whether to permit their information to be used for such purpose.
  • Data Security: Any company that collects or stores behavioral-advertising-related data should provide reasonable security and should retain the data only as long as is necessary to fulfill a legitimate business or law enforcement need.
  • Material Changes to Existing Privacy Policies: Companies should obtain affirmative express consent prior to using data in a manner materially different from promises made when the company collected the data.
  • Consent to Use Sensitive Data: Companies should collect sensitive data for behavioral advertising only after obtaining affirmative consent from the consumer. The FTC is seeking comment on what constitutes sensitive data. The FTC has also inquired into whether sensitive data should be prohibited in behavioral advertising.

The FTC has also requested additional information about whether companies are using tracking data for purposes other than behavioral advertising, and whether such purposes merit some form of heightened protection. In addition, the FTC seeks to determine whether the concerns about secondary uses of data are limited to personally identifiable data (data that can be attributed to a specific person) or non–personally identifiable data.

The decision to intentionally draft these proposed “self-regulatory” principles in very general terms leaves a number of areas unaddressed and wanting for clarification. For instance, the proposal that companies obtain affirmative express consent prior to using data in a manner materially different from promises made when the company collected the data raises very important issues. What kind of burden does that place on a company, and are there limitations to the burden that a company must shoulder in obtaining affirmative express consent? And what is a material change? Naturally, a material change to one company might differ from that of another company.

Alternatively, consider the requirement that any company that collects or stores behavioral-advertising-related data must provide reasonable security and should retain the data only as long as required to fulfill a legitimate business purpose. The FTC does not define what it considers to be reasonable security, nor does it define a legitimate business purpose. As currently written, the proposal leaves these issues unanswered, and creates ambiguities that could pose future legal troubles for companies engaged in online advertising or that permit online advertising on their sites.

The FTC has requested comments on the appropriateness and feasibility of implementing its proposed principles for both consumers and businesses. The principles stand as an initial effort to balance the need to maintain vigorous competition with the need to protect consumers and are only written as suggestions. But if not narrowed as a result of public comment, the FTC will likely implement the very general and ambiguous proposed principles. These principles will undoubtedly have a significant effect on companies engaged in direct or indirect online advertising. Comments are due by February 22, 2008.

* * * * *

Any parties interested in submitting comments can contact
one of the attorneys listed below or the Mintz Levin
attorney who ordinarily handles your legal affairs.

R. Robert Popeo
617. 348.1716 |

Cynthia Larose, CIPP
617.348.1732 |

Astor Heaven
202.585.3544 |