Where is the boundary? Conflicting standards on health-related ad targeting

A spooky experience with drug-ad targeting was the initial inspiration for the PrivacyChoice project, so it won’t surprise you that I support the call for an FTC investigation into pharmaceutical ad targeting. There’s a big difference between building a profile about what kind of car you want to buy and a profile that infers that you’ve just been diagnosed with cancer. Ask consumers and they would overwhelmingly say that this kind of targeting should be opt-in, not opt-out.

Here’s a key point: There’s a major conflict between the two published industry standards for ad targeting based on health conditions.

In the Network Advertising Initiative 2008 Principles (pdf), “sensitive” health information is defined as: “Precise information about past, present, or potential future health or medical conditions or treatments, including genetic, genomic, and family medical history.”

On the other hand, the DAA’s 2009 self-regulatory principles (pdf) say that prior consent is only necessary before collecting “pharmaceutical prescriptions or medical records related to a specific individual.” This standard is much narrower, and permits collection of online behavior to infer medical conditions, so long as personal prescriptions or medical records are not involved.

The DAA should promptly adopt the NAI rule, which appropriately gives consumers the choice of whether to have health-related behavior tracked. It’s not only the right thing to do; without protective and consistent standards, health-based profiling could rightly become a flashpoint that sinks the overall self-regulatory effort. Protecting the fortunes of pharmaceutical marketers isn’t worth it.

The new opt-out page: a missed opportunity

The new centralized industry opt-out page is now in beta on the aboutads.info site, which is a production of the new Digital Advertising Alliance. The new page consolidates opt-outs for the tracking companies participating in the self-regulatory program (at this point, the NAI member list). This is the page that websites can now point to as part of providing enhanced notice and choice. Over time it may supplant the NAI’s current group opt-out experience.

Unfortunately, it’s not an upgrade. Here’s why:

1. Don’t make me read. Like the NAI page, the new page is text heavy, and choices are largely below the fold (particularly on a laptop). The site does not explain the process visually or with video (NAI’s site does).
2. Don’t make me scroll. It’s admirable that the page has a global opt-out button (in addition to the ability to “check all”); but why bury that button at the very bottom of the page?
3. Make it easy to see where I stand. Like the NAI page, a user sees which of three states they are in for each company: opted-out, not opted out and with active tracking cookies, or not opted out and with no tracking cookie. But unlike the NAI page, the user has to click through different tabs to see to see status. And gone are the NAI’s reassuring green checkmarks that provide unambiguous confirmation of success.
4. Don’t make me do this again. There’s no instruction as to how to make the opt-out choice survive cookie-clearing (through a browser add-on or bookmark). At least the NAI built an add-on for this purpose, although it has never moved out of beta and was never offered as part of the opt-out process. It seems like a considered decision has been made that durability is not a requirement for the program. This won’t inspire confidence in the advocates of a meaningful “Do Not Track” option.
5. Tell me this really works. As with the NAI site, the opt-out is billed only as terminating the use of behavioral information, not the collection of behavioral data. The new page could have been an opportunity to state that no behavioral profile data will be collected about consumers who have opted out.

A trade organization like DAA has limited funding and too many committee inputs, so perhaps it’s not fair to expect a delightful privacy experience for consumers. Assuming the opt-out platform is open, independent companies should and will build better versions. Recent research confirms that the privacy experience has a big impact on brand impression, so hopefully advertisers will push for “a little more Steve Jobs” when it comes to privacy design.