Ryan Singel
Security

Privacy Groups Call For Do-Not-Track-Me List to Rein In Online Ad Firms

A coalition of privacy and consumer advocacy groups petitioned government regulators Wednesday to create a Do-Not-Track list that Americans can use to block online advertisers from silently recording people’s browsing habits in order to customized ad delivery. As THREAT LEVEL correctly predicted yesterday, the groups asked the Federal Trade Commission to establish the anti-tracking measure, […]

A coalition of privacy and consumer advocacy groups petitioned government regulators Wednesday to create a Do-Not-Track list that Americans can use to block online advertisers from silently recording people's browsing habits in order to customized ad delivery.

As THREAT LEVEL correctly predicted yesterday, the groups asked the Federal Trade Commission to establish the anti-tracking measure, loosely modeled on the popular and successful Do-Not-Call anti-telemarketing list, just one day before the FTC plays hosts a two-day town hall devoted to the topic of behavioral online advertising.

Technically, the proposed list (.pdf) would work very differently from the Do-No-Call list since any advertiser that tracks user behavior would have to report what servers they use to serve up a cookie or other tracking device. Individuals then update their browsers to include a plug-in that could download the list in order to block all or some of the tracking cookies. Like the Do-Not-Call list, government regulators would have the power to enforce companies that secretly track users or keep more information than they say they do.

The FTC and Congress have shown renewed interest in how online advertising services tracks netizens following Google's proposed $3,1 billion purchase of DoubleClick online visual ad serving and tracking.

The FTC is in a "second stage" review of that purchase, which generally indicates the government will impose conditions on the purchase. Google is now worth billions thanks to its unobtrusive text ads. The company's move to expand into visual ad marketing spurred Yahoo! and Microsoft to also move to bolster their fledgling ad serving networks with purchases of DoubleClick competitors.

The groups also call on the FTC to force companies to be open to external audits to ensure compliance, to allow individuals to request what personally identifiable information an online advertising company has about them, and explicitly defines an IP address as personally identifiable information.

Online advertisers will likely be pillorying the proposal for the next few days, arguing that targeted ads are beneficial to all parties involved and that users are free to block tracking cookies already.

According to the letter submitted to the FTC, tracking of individuals on the net is widespread and insidiously secret.

The expansion of behavioral tracking and targeting of consumers through the Internet and other networked devices greatly exacerbates the failures of the current 1 inadequate structure for addressing consumer privacy interests. This expansion threatens privacy in new ways that consumers are largely unaware of.

World Privacy Forum director Pam Dixon, who coordinated the group proposal, argues that online marketers and the National Advertising Initiative industry group have failed to police themselves.

If you look back at the Do Not Call list, it was at one time managed by industry. But it didn't gain widespread acceptance until the FTC took it over.

The industry has had seven years to prove they can manage online opt-outs. It is time to move toward something structured like the Do Not Call list to address the problems we are seeing, and have now seen for seven years.

The Center for Democracy and Technology, the Electronic Frontier Foundation, and Consumer Action were among the 9 groups that signed onto the proposal.

Notably, however, the Electronic Privacy Information Center, the Center for Digital Democracy and U.S. PIRG - the groups that are asking the FTC to impose stringent privacy conditions on Google's proposed acquisition of DoubleClick - did not sign the letters.

The CDD's Chester said he didn't sign on because he wanted something to go even further.

"The plan doesn't address the full range of privacy threats from online marketing," Chester said.

EPIC's Marc Rotenberg argues the proposal too narrowly thinks of online marketing problem as if it were spyware.

Instead, Rotenberg suggested, "You have to look at the data collections of the largest search companies."

Search engines have only recently begun taking steps to forget what people type into the search box and it takes complicated third party browser add-ons to have real choices about what data your browser sends to a search engine like Google.

See Also: