A Self-Regulatory Moment

March 26, 2010

An earlier post about Google’s new “certified ad network” program raised the question of whether websites should disclose to consumers which third-party networks may have access to user data through AdSense. Google’s program allows certified networks to use previously collected behavioral data to target ads served through AdSense, but prohibits (by contract) the collection of new data for future use. Based on this distinction, Google does not provide consumers with any specific notice-and-choice as to certified ad networks.

Lurking here is a fundamental question about ad-targeting disclosure: is it good enough to provide notice and choice only when behavioral data are being collected, or must you also provide it when being used?

Google’s approach seems founded on a literal reading the FTC’s 2009 Staff Report on Behavioral Advertising (see page 52), which by its terms speaks only of notice-and-choice on every website “where data is collected.” The NAI’s self-regulatory principles use similar language. But neither the FTC nor the NAI discussed “use” versus “collection,” the involvement of multiple companies in delivery of a single ad, nor a notion that disclosure standards might differ in those cases.

There are good reasons to conclude that consumers deserve notice-and-choice both at the point of collection and the point of use of behavioral data.

  1. The serving of a targeted ad will be the moment of recognition for many consumers; the very point at which they want to understand and exercise their choices. If they can’t easily identify the company serving the ad based on prior collected behavior, they have no way to prevent it from continuing.
  2. With visibility as to which third-parties have access to data, consumers can make their own decision about whether to rely on Google’s contractual rules about how it may be used. Google’s approach is a black box for consumers; they receive no direct assurance from the certified ad network about their practices, nor any assurance that Google will monitor or enforce the contractual prohibitions on their behalf.

In plain terms, Google says to the consumer: If you don’t opt-out when information is first being collected about you, you lose the practical ability to do so when it is used to show you targeted ads. Google’s own opt-out program does not appear to remove the user from receiving behaviorally targeted ads from non-Google networks through AdSense.

Did the FTC Staff intend this outcome? There’s nothing in the rest of the Staff’s discussion to indicate that they meant to exclude the use-only situation from enhanced disclosure.  Indeed, in distinguishing first-party from third-party data collection, the Staff said:

By contrast, when behavioral advertising involves the sharing of data with ad networks or other third parties, the consumer may not understand why he has received ads from unknown marketers based on his activities at an assortment of previously visited websites. Moreover, he may not know whom to contact to register his concerns or how to avoid the practice.

In the same statement, the FTC Staff spoke to this kind of novel situation when they said, “Where the data collection occurs outside of the traditional context, companies should develop alternative methods of disclosure and consumer choices that meet the [transparency] standards described above …”

The IAB-led coalition has adopted principles that require notice-and-choice “when data is collected from or used on a Web site for Online Behavioral Advertising purposes …” (page 17) The IAB’s overall approach to disclosure is premised on embedding notice into ad-delivery, which like the FTC explained, satisfies a consumer curious about why they saw a particular ad. This is true whether or not data are also being collected for future targeting.

“Fourth-party” ad delivery of the sort now available in AdSense is increasingly common, and Google’s precedent may end up as an industry standard. If enhanced disclosure only applies at the point of collection of behavioral data, and not at the point of use, that should be based on a thoughtful discussion of the consumer impact, rather than a narrow reading — and most likely a mis-reading — of FTC staff guidance.

This will be an important test of the industry’s self-regulatory framework. Google is an NAI member (as are several certified ad networks), and this question involves interpretation of NAI guidelines. One way or another, the NAI must pass judgment on the point, and in doing so will demonstrate whether consumers (and the FTC) can count on an effective self-regulatory effort for behavioral advertising.


3 Responses to “A Self-Regulatory Moment”

  1. […] ads were being served in Google, but perhaps with the advent of the Google’s ad exchange (see prior post), this is […]

  2. […] why should we believe that Google is actually on top of back-end privacy compliance by the scores of third-party ad networks that now have access to user behavior on millions of websites in the Adsense […]

  3. […] the marketplace, it is a sensible investment. It’s when they don’t make the promise or the promise isn’t clear that I get more […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: