On February 12, 2009, the Federal Trade Commission (FTC) staff issued a supplemental report of its December 2007 draft “Self-Regulatory Principles for Online Behavioral Advertising.” The report further develops the FTC’s voluntary best practices for the behavioral advertising industry and supports continued self-regulatory treatment. However, the document is not an endorsement of the status quo. The revised principles are likely to spur the following changes to your company’s treatment of behavioral advertisements, including: (1) the development of more consumer education content regarding behavioral advertising, (2) the development of internal privacy protections for anonymous data profiles, (3) the creation of opt-in customer notice mechanisms for use and collection of information perceived as sensitive (such as, information related to health, finance, or children), and (4) the creation of opt-in customer notice mechanisms for retroactive changes to your company’s privacy practices.

Further, you may think that existing website billboard privacy polices are sufficient for conformance with the FTC’s revised guidelines. This is unlikely. The staff report clearly indicates that static privacy policies may not be sufficient notice for behavioral advertising purposes, and disclaimers in proximity to the targeted advertisements may be needed. Notwithstanding the additional disclaimers outside the privacy policy, traditional billboard privacy policies may need revision to conform to the new guidelines, as well. Specifically, the staff report adopted a very broad and open-ended definition of PII1 for these purposes, and indicated that the sharing of information inside a corporate family could fall outside the “first party” sharing of data exemption.

While it is tempting to ignore a cumbersome (and voluntary) examination of information policy, the staff report also comes with a fair warning to take these guidelines seriously. The concurrences of Commissioners Jones Harbour and Liebowitz indicate that if companies do not engage in these voluntary regulatory efforts, mandatory behavioral advertising regulation could lie ahead. As stated by Commissioner Leibowitz, “[p]ut simply, this could be the last clear chance to show that self-regulation can—and will—effectively protect consumers’ privacy in a dynamic online marketplace.”

Click here to read the full white paper written by Amy S. Mushahwar and John P. Feldman.