- They added a data retention policy: 12 months for log data and indefinite retention of aggregate data, which is right in the middle of industry norms.
- They added a clear exclusion for sensitive-category information, which they define to include “health, religion, political views or sexual orientation” (and they note that they do not have pornographic sites in their network).
However there’s still a gigantic omission: no consumer opt-out feature. VideoEgg uses Flash cookies for tracking, so the fair thing to do would be to offer a Flash-based opt-out cookie (see this example). This would make the opt-out preference at least as durable as the method they use to track behavior. Unfortunately, they chose to provide neither a browser-based nor a Flash-based opt-out process.
What’s the only thing worse than not offering a consumer opt-out? Saying you do when you don’t.