Behavioral Targeting Rules Updated

The Network Advertising Initiative, a self-regulatory group for ad networks that do behavioral targeting, has just finalized updated rules for companies that tailor ads across a network of sites.  AOL's ad networks, Advertising.com and TACODA, are part of our Platform A advertising division and offer advertisers the opportunity to have their ads delivered to consumers who have been to auto sites or other types of sites in their networks.  These ad networks are members of the NAI and their privacy leads, Ho Shin and Khan Smith, worked closely with me to help the NAI update the standards and close some important gaps.  I was part of the group that drafted the initial set of rules, about 7 years ago when I was Chief Privacy Officer at DoubleClick and I have to admit that they had grown stale and needed to catch up to the current marketplace.  It took some urging by the Federal Trade Commission to get companies moving on this and there is more to do, but this was a big step forward.

The most important advance is that the rules now clearly limit ad networks from creating a "clickstream profile" that represents a sensitive category such as cancer, HIV or other sensitive health categories, unless a user explicitly opts-in.  This was in the old rules - but only if the profile was personal.  The new rules restrict such activity even when the ad is targeted based solely on cookie linked information, without a name attached to the profile.  Also covered are areas like sexual behavior/orientation/identity, mental illness, sexually related conditions, abortion related and more.  And since children can't consent to data sharing, an ad network kids profile isn't permitted, even on an opt-in basis.

AOL, Advertising.com and TACODA have for quite some time enforced a similar internal policy, considering it inappropriate to use these types of categories to tailor an ad on one Web site based on a consumers visit to another.  We are pleased to see all the major portals and ad networks coalescing around this.

Another key point in the new rules is a restriction against using a clickstream profile for a non-marketing use.  This means that the data can be used to help deliver an ad for a motorcycle to a biker, but that profile may not be used by an insurance company to turn them down for a policy.  I am not aware of anyone in the industry doing anything of the sort, but I have often seen speculation from critics that such could occur.  Hopefully this should put those concerns to rest.

I will post more on the NAI rules in the future, but one last area that should be cleared up by the rules is regarding the use of flash cookies for tracking.  HTTP cookies, with all their frailties, are subject to many controls.  You can block them with your browser settings, remove them with an anti-spyware program, or overwrite them with an opt-out cookie. In fact, your browser will only hold so many cookies, and then they will be overwritten.  Flash cookies are very useful to allow an application to remember your settings, or for example to save your high score for an online game.  But since they are not as well known, they are not as easy for consumers to delete or control with browser settings as are HTTP cookies.  My opinion is that it is not a good practice to use a Flash cookie to create an ad network behavioral profile.  The new NAI document makes it clear that the requirements are technology neutral. All Web sites that share data for behavioral targeting need to provide a link to an easy to use opt-out  - and if you can't do that with a flash cookie, then you shouldn't use it for tracking.  I do note that Macromedia has more recently built additional settings that allow some user control of flash cookies, but I agree with the concerns of privacy experts at the Center for Democracy and Technology on this one.

Jules