Kudos to the Network Advertising Initiative for completing a comprehensive compliance review of their membership, and for laying out both positive and negative results in their assessment. The report is encouraging, and ultimately points to an even more crucial role for the NAI in creating an effective self-regulatory regime for online behavioral tracking.
Here’s what I found most important in the report:
We’re on the right track. The two areas of weakness in compliance noted by the NAI — missing data retention policies and lack of disclosure on publisher sites — have been primary areas of focus for the PrivacyChoice project (see our blog posts on retention and our PrivacyWidget for sites). It looks like we’re focused in the right areas.
Retention policy is hard for the big guys. Although the report does not name the four NAI members who lack complete policies about consumer data retention (why not?), here’s my list: Google, Yahoo!, Microsoft and Specific Media. It’s ironic that the first three are the largest and highest profile members of the NAI (the fourth being a network with “possible compliance issues” and an incomplete submission). Setting and enforcing retention policies seems to be more complex and has higher stakes for the larger networks. The report promises clear retention policies from these companies by the end of Q1 2010, so get ready to compare and contrast how the big three approach and spin this knotty problem.
The NAI report is a reminder of how self-regulation is supposed to work in practice. As a consumer, it’s good to know that each NAI member was required to make formal submissions and be questioned on each element of the NAI’s standards. To see a half dozen networks implement retention policies in time for the report is a substantive sign of progress, even if there are a few laggards.
Even more important, the NAI’s promise to focus on website-level disclosure has the potential to vastly improve industry privacy practices across the board, even beyond the NAI membership. Our research revealed that on most websites NAI members are outnumbered by non-NAI members. Firms with less protective policies and no oversight will continue to track consumers as long as websites allow them to. The prevalence of non-adherent targeting firms is the central challenge to effective self-regulation.
But if the NAI makes publisher disclosure a serious focus in 2010, websites may for the first time start to feel accountable for the ad-network choices they make. That kind of transparency can bring more targeting firms into the NAI fold and squeeze out the rest. The good news for NAI members is that this also means lower-profile competitors will face the same restrictions and costs of doing business as they do.
This leads to me to wonder if the NAI is underrated in its self-regulatory role. While the IAB/DMA/BBB efforts get much attention, they seem focused on an advertiser-driven disclosure framework that assumes ad-network adoption and does little to foster website accountability.
Websites are the real decisionmakers in this ecosystem. Perhaps it will be the NAI’s clout with them that actually makes self-regulation work.