In the course of our research for privacychoice 2.0, we’ve been surprised at how hard it is to get a handle on the data retention policies of the ad and tracking networks. This is despite the fact that data retention practices are a key disclosure point for consumer online privacy. The FTC principles called this out:
To address the concern that data collected for behavioral advertising may find its way into the hands of criminals or other wrongdoers, and concerns about the length of time companies are retaining consumer data, the FTC staff proposes: Any company that collects or stores consumer data for behavioral advertising should provide reasonable security for that data and should retain data only as long as is necessary to fulfill a legitimate business or law enforcement need.
Here’s what the NAI guidelines (PDF) require of their members:
Each member directly engaging in [Online Behavioral Advertising], a) Multi-Site Advertising and/or Ad Delivery & Reporting shall clearly and conspicuously post notice on its website that describes its data collection, transfer, and use practices. Such notice shall include clear descriptions of the following, as applicable: … The approximate length of time that data used for OBA, vi. Multi-Site Advertisiisiising and/or Ad Delivery & Reporting will be retained by the member company.
In reviewing the policies of 63 targeting networks, here’s what we learned:
1. Most companies don’t disclose their retention timeframe, or do so obliquely.
Suprisingly, for 41 of the companies (nearly two-thirds), we could not find an express statement of how long consumer data is retained. In the NAI membership, we could not find such a statement for any of these companies:
24/7 Real Media (WPP) (retention provisions added 12/09)
Audience Science (added two-year retention period 12/09)
Microsoft (subsidiary Atlas discloses a 2 year timeframe)
[x+1] (retention provision added 11/09)
Two of the other heavyweights in the NAI — Google and Yahoo! — have published information about their retention practices, in the press or on their blogs. (Here’s a round up of some of these statements.) But as far as we could tell, they have not included an express timeframe in their privacy policies, where a consumer would expect to find it.
2. Retention periods vary widely, but the trend is toward a year or less.
Of those 22 networks who have put a time frame in their disclosure policies, there’s a wide range, but with accumulation at or below one year (particularly for the larger networks).
One year or less: 13
Over one year but not more than 2 years: 6
Three years: 2
Special mention goes to Fetchback, which is clear in their disclosures that they retain the information indefinitely. Whatever you might think about that policy, at least the disclosure is clear and where a consumer would expect to find it.
For 41 other companies: Until your policies are more clear, consumers and (yikes) regulators can fairly assume that you are also retaining and using the information indefinitely.