Can We Trust The Online Ad Industry To Regulate Itself?

Internet advertisers this month took a fresh stab at persuading federal privacy regulators to leave them alone. The advertisers are touting new industry guidelines which they believe will resolve consumer concerns about data disclosure once and for all. Why, then, does the effort still feel like wishful thinking?

For anyone who missed it, the advertisers’ new initiative is an expanded set of principles to govern what they can do with the information they collect about people’s internet surfing habits. The ad companies have already provided a consumer opt-out system but the Federal Trade Commission suggested the scheme did not go far enough. The new industry rules are intended to provide additional measures of reassurance, for instance by saying that companies can’t use browsing information to help determine whether someone is eligible for credit or insurance.

According to Stu Ingis, general counsel for the Digital Advertising Alliance, ad companies weren’t using the information for eligibility reasons in the first place. Still, he said in an interview, the new principles formally expand the existing guidelines and represent “a holistic response to policy makers and consumers.”

So what does all this actually mean? In a nutshell, it means the industry thinks it has done enough to allay privacy concerns by offering consumers a one-stop website where they can see which ad companies are tracking them. The site works by displaying the dozens of ad companies that have placed tracking cookies on an individual user’s internet browser. A user can then check boxes to force ad companies to stop using her browsing history as the basis for selecting future ads — and now, according to the new guidelines, the companies will also be restricted from using the browser history for a variety of other purposes.

In the bigger picture, the guidelines seem to be a tactical gambit to forestall the federal government from interfering in the online ad industry. According to Ingis, the guidelines are evidence that the ad companies can create and follow a series of best practices to address privacy concerns. He cites the Better Business Bureau as a similar model of effective self-regulation.

In some ways, the ad companies have a point. The online ad industry is a complex, technology-intensive business that the companies understand far better than their would-be overlords in Washington.The business is a young, growing sector of the economy that may be safer away from the hands of regulators eager to make political hay out of privacy fears.

Secondly, legitimate ad companies are not interested in “spying” on individual consumers but rather in serving up relevant advertisements. Their activities make it possible for companies to avoid wasting money on ads targeted at the wrong demographic. Consumers — who will receive ads regardless — likely appreciate the distinction too. Does a cheerleader from UCLA really want to see ads for Buicks and the New York Rangers? Does a retiree in Florida want invitations to see Justin Bieber? The ad companies help ensure that companies get the most from their ads — which in turn supports websites and creates new online content.

Still, the fact remains that people are increasingly uneasy about the volume of data they reveal to third parties every time they use the Internet. And the reality is that the ad companies’ new guidelines are unlikely to reassure them. Here’s why:

The process is too complicated

The ad companies’ self-regulation model is hard for the average internet user to understand. While the site allows users to see and instruct the ad companies with only a few clicks, the process does not guarantee a company will stop tracking them. Instead, it works by installing an ‘opt-out’ cookie on a user’s browser that is nominally valid for five years but that will disappear every time a user clears their browser cache. The system also requires that people be aware of ‘Ad Choices’ in the first place. For now, a handful of companies are flagging the opt-out choice with a little blue icon at the bottom of their pages but it is unclear how many consumers are actually using it (you can see an example by scrolling to the bottom of CNN’s page)

The process does not stop data collection

Despite being touted as “effective solutions for the collection and use of data,” the guidelines do nothing to prevent data collection. All the rules seem to require is for ad companies to stop serving specialized ads if a user requests this — they do not require companies to stop monitoring a user’s browsing habits in the first place. And it is not even clear which types of adds are covered by the restrictions. At least the ad companies are being candid about this. Here is a description of how the process works (or doesn’t..) in the industry’s own words:

Will the Consumer Opt Out Page block me from receiving any ads or email advertisements?

No. The opt-outs available through the Consumer Opt Out page apply only to interest-based advertising from the participating companies and do not apply to other types of banner ads provided by these companies (i.e. ads that come in the pictorial, “banner” format).

For example, even after opting out of interest-based advertising from a participating company, a user may still receive other types of banner advertising from that company, including ads selected on the basis of a the content of the web page (“contextual” ads), or other types of information (for example, demographic or general computer browser location information).


Does opting out stop participating companies from collecting any data?

No. Opting out tells the participating companies to stop delivering interest-based advertisements to that browser. Other types of advertisements – including those based on general location or registration data – will continue to be delivered to the browser.

After you opt out, participating companies and the Web sites you visit may continue to collect and use information for purposes other than online behavioral advertising. For example, participating companies may still collect and use advertising data to measure the number of ads served for a particular campaign, to limit the number of times a particular ad is served to a unique browser, or to prevent fraud. In some cases, automated systems will continue to collect other data about browser visits but that data will no longer be used to deliver interest-based advertising to the user.

In addition, data may be collected and used by participating companies and Web sites for a variety of purposes unrelated to advertising, including the operation of online products and services (like recognizing a return visitor to an online photo or social networking service).

The process does not address fundamental privacy issues

If I understand the ad companies’ self-regulatory model correctly, it does little but provide a way to stop viewing certain types of online ads. It does not address more fundamental issues such as who owns data about me — or how I can even find out this information in the first place. Nor does it address how long companies can possess data or when they can sell the data to third parties. The new announcement that browsing data can’t be used to determine medical or employment eligibility is welcome but seems to address only the tip of the privacy iceberg. Finally, it should be noted that the scheme remains voluntary — meaning that unscrupulous companies may ignore it altogether.

Overall, the ad companies’ initiative is far from a comprehensive privacy policy. Sooner or later, Americans will have to make a choice about whether they are comfortable with the convenience and economic benefits of the existing online ad model or if they want to contemplate European-style legislation that bars companies from collecting information altogether.