Privacy groups on Thursday criticized the Federal Trade Commission's new policies on targeting advertising by tracking consumer behavior online, saying they don't adequately protect the public, including children and people with sensitive medical conditions.
Although privacy advocates acknowledge that the FTC took some steps toward greater clarity, they complained that the Commission largely adhered to its Bush administration policy of self-regulation.
"It failed to protect consumers here," said Jeff Chester, executive director at the Center for Digital Democracy in Washington, D.C. "This announcement today is directly connected to the failure of the FTC to oversee the consolidation of control of advertising in the online marketplace."
In a long-awaited report Thursday, the FTC largely left intact its principles governing the notice, choice and control that companies should give consumers when they track their activities to refine the type of advertising they get.
Through such behavior-targeting practices, someone who visits a golf site might be labeled a golf enthusiast and offered a pitch for a golf vacation package, even when visiting a site that is completely unrelated.
The new guidelines add a few clarifications:
- Excluded are sites that do not share the behavioral information it collects with outside parties. This applies when sites sell and display ads in-house.
- Companies that collect data outside the traditional Web site context should make sure that disclosure and choice remain clear and easy to use. This seems aimed at mobile applications and partnerships that some Internet service providers have with companies like NebuAd Inc. to display ads based on general surfing, not just at a particular site.
- Companies should consider limiting how long they keep data.
The FTC said companies should obtain "express consent" from consumers before collecting sensitive data, such as tracking children's behavior, health histories and Social Security numbers. But it leaves others to come up with standards on what qualifies as sensitive.
The guidelines do not have the force of law but could be relied upon by FTC staff as it decides which cases to investigate and pursue.
They "still fall short of the regulatory authority of the agency to step in and protect consumers," said Lillie Coney, associate director at the Electronic Privacy Information Center in Washington, D.C.