Online behavioral advertising (OBA) refers to the practice of tracking users across web sites in order to infer user interests and preferences. These interests and preferences are then used for selecting ads to present to the user. There is great concern that behavioral advertising in its present form infringes on user privacy. The resulting public debate — which includes consumer advocacy organizations, professional associations, and government agencies — is premised on the notion that OBA and privacy are inherently in conflict.

Privads is a practical architecture that enables targeting without compromising user privacy. Behavioral profiling and targeting in Privads takes place in the user’s browser.

Our technical paper discusses the effectiveness of the system as well as potential social engineering and web-based attacks on the architecture. One complication is billing; ad-networks must bill the correct advertiser without knowing which ad was displayed to the user. We describe a cryptographic billing system that directly solves the problem. We implemented the core targeting system as a Firefox extension and report on its effectiveness.

While some are skeptical about whether Privads will be fully effective and/or embraced by the online advertising industry, this is the kind of innovative, values-based design that we need to mitigate the growing threats to privacy online.

Related posts: (automatically generated)

1. Google Launches Behavioral Advertising System, With Impressive (But Not Quite Perfect) Privacy Controls
2. FTC to Host Town Hall to Examine Privacy Issues and Online Behavioral Advertising
3. Does Targeted Marketing (with Personal Data) Work?
4. Recent Activities in the Online Behavioral Advertising Privacy Sphere
5. How to Share without Spilling the Beans: Towards Privacy-Preserving Data Mining

Building from its acquisition of DoubleClick, Google’s new ad system — which it refers to as “interest-based advertising” — will use cookies to track users across the multitude of sites that show Google’s display ads, allowing Google to create a profile of each user based on the kind of sites visited. Google will then target ads to a user based on that profile.

While Yahoo!, Micrsoft, and AOL have all been engaged in behavioral targeting for some time, Google’s entrance into this controversial domain is quite significant. And, similar to its approach to locational privacy with Latitude, Google has taken some very positive steps to design privacy into this new advertising framework. For example:

• If a user clicks on the “Ads By Google” link which accompanies its banner ads, they will be taken to this page where the behavioral targeting technique is explained, with a link for even more detail.
• On this page, users can see exactly which behavioral categories they have been assigned based on their browsing activity. Users can also add/delete categories to/from their profile.
• A user’s profile is only based on her browsing activity as tracked by a specific cookie. It is not populated by, or linked to, her Google Account or Gmail.
• Google won’t create “sensitive interest categories” like race, religion, sexual orientation, health, or sensitive financial categories, without a user’s opt-in consent.
• Users can also opt-out of the targeting altogether by clicking the “opt-out” button on this page, disabling Google’s tracking cookie with an “id=OPT_OUT” setting.
• Recognizing that users might routinely clear out their browser’s cookies, and as a result removing this “id=OPT_OUT” setting, Google warns users of this possibility, and has taken the steps to build an open-source browser plug-in to allow users to permanently opt-out of the cookie tracking system.
• To help explain all of this, Google has added a YouTube video on its Privacy Channel.

These are all significant — and mostly unprecedented — steps to give users access and control over the data collected about their online activities; just what I have been urging Google to do for quite a while now.

That said, Google can go further to better protect user privacy, and increase transparency, access, and control with regard to the collection of personal information. For example:

• Make participation in behavioral targeting opt-in, not opt out. Currently, every person who comes into contact with a website participating in Google’s targeting program receives the cookie and is integrated into Google’s larger tracking infrastructure. A user must happen to click on the “Ads by Google” link at the bottom of an advertisement to discover she can opt-out.
• Change “Ads by Google” to “Ad Privacy Preferences”. If the goal is transparency, access, and choice,  Google should make the link to the ad preferences page more descriptive than “Ads by Google”. In fact, since the entire advertisement is “clickable”, a user has little reason to think clicking on “Ads by Google” would take them anywhere different than the ad itself. If anything, a user would presume that link points to a general page about Google’s advertising solutions. There’s nothing that would trigger a user to think they could opt-out or view their profile by clicking this link.
• Provide more refined controls. While it is impressive to let users see and edit exactly what interest profiles they have been assigned to, Google should take it a step further and provide even finer levels of access to view precisely what websites have been included in my profile data. Not everyone will need to be burdened with such detail — perhaps only those who I call “privacy power users” — but providing the option would be an important enhancement to the privacy controls already designed.
• Expand these tools to all Google properties. I’m impressed by the level of transparency and control Google is providing users in relation to behavioral tracking and targeting. Now, extend these same privacy-enhancing features to other Google products. Let me see what data has been collected about my search history (in Google’s logs, not just what is viewable in the “Web History” interface. Similarly, let me see what clickstream data Google collects from my activities on their properties, if they’ve been logging what books I view in Google Book Search, and so on. And just like the interests in my behavioral profile, provde me the ability to edit, add or remove data from these logs.
• Create a global Google cookie opt-out plugin. Google should enhance the advertising cookie opt-out plug-in to include any and all Google cookies. Rather than relying on third-parties to design and maintain cookie blocking, Google should recognize that releasing such a tool would be a big step in building user trust (and, since I’m guessing that only a small percentage of people would bother to user such a plug-in, Google probably wouldn’t lose much data anyway).
• Commit to never use search history for behavioral targeting. Finally, I call on Google to commit to never use an individual’s search history for behavioral targeting. Search queries necessarily contain personal, sensitive, and private information. It should never be aggregated in an attempt to profile a user and sell advertising.

[Disclosure: I recently attended a Public Interest Consultation and Roundtable discussion at Google, which included a preview of this advertising product and related privacy controls. Google paid for my travel & accommodations.]

UPDATE: Read Seth Finkelstein‘s column criticizing Google’s strategy, which includes this apt reflection:

If Google can convince people its surveillance is merely a warm and fuzzy way of helping you shop, while ISPs’ surveillance is akin to warrantless wiretapping, that gives Google an enormous advantage in collecting information to sell to advertisers.

UPDATE: Chris Soghoian has expanded Google’s opt-out plugin to include nearly all behavioral advertising networks. Download it here.

Related posts: (automatically generated)

1. FTC to Host Town Hall to Examine Privacy Issues and Online Behavioral Advertising
2. Recent Activities in the Online Behavioral Advertising Privacy Sphere
3. FTC Proposes Self-Regulatory Principles for Online Behavioral Advertising
4. Privads: Privacy Preserving Targeted Advertising
5. Google Files for Behavioral Targeting Patents

Earlier this month, TRUSTe released a whitepaper designed to help online businesses assess and better understand their own privacy practices related to data collection and retention. The intent is to help these companies better demonstrate transparency — and better meet consumer expectations — related to their behavioral advertising data practices.

Central to this effort is TRUSTe’s “Checklist for Businesses” which walks businesses through a series of questions to help them understand their own business operations and build privacy compliance and risk mitigation measures into their design as they relate to behavioral advertising activities. It is a pretty good list of issues that any online company should (already) be paying attention to.

One item that stands out to me relates to providing more transparency for users, where TRUSTe suggests providing a link alongside targeted adds stating “Why this ad?” Or “How data about your activity here will tailor the ads you see.” Such visible and proactive disclosure would go much further to educating consumers than language buried in a hard-to-find privacy policy.

The FTC appears to agree. Last week, the FTC released an update to its principles for online behavioral advertising, condemning Internet companies for not explaining to their users clearly enough what information they collect and how they use it for targeted advertising. Saul Hansell at the NY Times provides a nice summary of the Commission’s critique:

• Privacy policies are not a good enough way to tell people what information is being collected about them.
• The privacy of users is not necessarily protected because a system doesn’t capture names or other “personally identifiable information.”
• The industry’s self regulation has not been adequate.
• Internet companies have not cooperated with the commission to provide enough information on what is happening now with data about users.

Similar to TRUSTe’s recommendation noted above, the FTC calls on online companies to “design innovative ways – outside of the privacy policy – to provide behavioral advertising disclosures and choice options to consumers.”

According to the NYTimes coverage, Yahoo is already experimenting with providing users more information about targeted advertising. As you can see from the sample below,  a notice placed is placed above Yahoo ads that appear on eBay. Click on the word “about” over the ad and you’ll see this disclosure with an option to disable targeting. (Apparently Yahoo hasn’t expanded this beyond the eBay ads).

Despite recommendations like this, and the overal stern tone of the report, the FTC seems to be (at least for now) maintaining faith that the Internet industry can voluntarily regulate its own privacy practices. As Jules Polonetsky, the co-chairman of the Future of Privacy Forum, explains, “The commission is saying you have one last chance before I come upstairs and take your toys away.”

We’ll see how much patience the FTC has, and whether the toys will get thrown into the closet anytime soon.

Related posts: (automatically generated)

1. FTC to Host Town Hall to Examine Privacy Issues and Online Behavioral Advertising
2. FTC Proposes Self-Regulatory Principles for Online Behavioral Advertising
3. Google Launches Behavioral Advertising System, With Impressive (But Not Quite Perfect) Privacy Controls
4. Privads: Privacy Preserving Targeted Advertising
5. Facebook to Join Behavioral Targeting Game, and Might Win

Interestingly, the Yahoo release avoids using the phrase “behavioral targeting” (which is mentioned in the NYT piece), and instead note how the system will allow publishers to connect with “their exact target audiences across the increasingly fragmented Internet” and enable “precise geographic, demographic, and interest-based targeting.” Given the rising anxiety about the widespread monitoring of users’ online activities, perhaps Yahoo is trying to find softer ways to describe their own role in this surveillance of Internet behavior. You can put lipstick on a pig…

The release also points to a short video plugging AMP! It gives a peek into AMP!’s user interface, including a section where advertisers can “select the targeting categories you would like to search.” A drop-down list is shown with “Demographic Targeting” selected, along with sex, age, and income variables. A link is also provided to a page “About Behavioral Targeting,” which presumably describes how this works:

The other options in that drop-down box are visible in a later screen bragging about AMP!’s behavioral, geographic, and demographic targeting. The blurry drop-down box in the background shows each of these targeting options, which likely come with their own screen of variables.

This is all we know about AMP!’s behavioral targeting at this point, but hopefully more information will continue to come.

Related posts: (automatically generated)

1. Yahoo’s New Ad Sales System to Include Behavioral Targeting
2. With SmartAds, Yahoo Finally Joins Google…as a Threat to Privacy
3. Yahoo to preserve e-mail of Marine killed in Iraq
4. Google, Yahoo, Microsoft, Others to Address Human Rights Violations
5. Yahoo’s Site Explorer

Yahoo said the system, called AMP and still months away from being ready, would greatly simplify the task of selling online ads, allowing Yahoo’s publishing partners, for instance, to place ads on their own sites as well as on Yahoo and on the sites of other publishers in the company’s growing network. Advertisers will be able to focus those ads by demographic profile, geography and online behavior, the company said.

No further details are provided regarding how the behavioral targeting will work. Presumably, it will be something like Yahoo’s beta SmartAds platform, which promises advertisers the ability to “leverage Yahoo’s unique data and insights to deliver personalized marketing messages and drive click-thru rates.” I commented on the privacy and surveillance threats of that program here.

Presumably, AMP will be built on similar monitoring, collection, and aggregation of users’ online activities across Yahoo’s properties. Hopefully we’ll get more details on this soon.

Related posts: (automatically generated)

1. Facebook to Join Behavioral Targeting Game, and Might Win
2. Panoptic Sorting on the Rise as MySpace Enters Behavioral Targeting Foray
3. More Details on Yahoo’s New Ad Sales System, AMP!
4. With SmartAds, Yahoo Finally Joins Google…as a Threat to Privacy
5. Google Launches Behavioral Advertising System, With Impressive (But Not Quite Perfect) Privacy Controls

According to The Times, the bill “would make it a crime… for certain Web companies to use personal information about consumers for advertising without their consent.” Looking at the actual text of the bill, it unfortunately isn’t quite that sweeping or clear cut. Much of the proposed law is based on providing users the ability to opt-out of targeted advertising. For example:

5. Third party entities that collect or use non-personally identifiable information online for online preference marketing shall post clear and conspicuous notice on its website about its data collection and use practices, and each shall give consumers an opportunity to opt-out of online preference marketing.

Opt-out will always be a weaker form of consumer protection compared to requiring users to specifically opt-in to having their activities tracked. This merely maintains the standard (U.S.) practice of allowing companies to surveill and monetize user activities as the default, making it the exception if a person seeks privacy protection. (For general comparison to E.U. privacy protections, see my essay “Privacy Protection in the Network Society: “Trading Up” or a “Race to the Bottom”?”)

Additional concern with this language is the interpretation of “clear and conspicuous notice.” Would providing this notice in a website’s terms of service suffice? Even if links to the TOS aren’t visible on the typical pages users view? (For example, Google’s TOS is found only if you click on “About Google” from its homepage or a search results page)

The bill is a bit stronger when it comes to the practice of linking generally anonymous information with personalized information, such as a name or e-mail address. For example:

14. (a) Notwithstanding subdivision four of this section, third party entities shall not merge personally identifiable information with information previously collected as non-personally identifiable information, without the consumer’s prior affirmative consent to any such merger.

While requiring affirmative consent is preferred to an opt-out regime, I worry that this consent could be similarly buried in a site’s terms of service, which users tacitly “accept” when the service is used. Google’s TOS states, for example, that users accept their terms “by actually using the Services.” No prior consent is required — if you perform a Google search, you automatically have agreed to the TOS (even if that TOS isn’t even visible from the search results page).

The bill is strongest, however, in relation to a demand I have long made on Web search providers: let me see the data you have collected about my actions. The bill states:

17. Business entities shall provide consumers with reasonable access to personally identifiable information and other information that is associated with personally identifiable information retained by the third party entity for online preference marketing uses

The press seems to have missed the importance of this section. If passed, the law would require Google, Facebook, DoubleClick, etc to provide me access to the personally identifiable information “and other information that is associated” with my user account stored in their databases.

This is a vital right for consumers to be able to protect their data privacy: having access to view your data is the first step towards regaining some control over the collection of the data in the first place.

Related posts: (automatically generated)

1. Tracking Web Users with ClickTale
2. # Privacy: Search Engine Privacy Standard Proposed
3. ChoicePoint to Allow People Access, but Questions Remain
4. Does the EU Data Retention Directive Apply to Search Query Data?
5. NYT: Increasingly, Internet’s Data Trail Leads to Court

Transparency and consumer control

Issue: Interested parties cite the need for greater transparency and consumer control to address the privacy issues raised by behavioral advertising. Many criticize existing disclosures as difficult to understand, inaccessible, and overly technical and long. They also stated that, with clearer disclosures, consumers can make more informed decisions about whether or not they want personalized advertising or, alternatively, whether they would prefer not to do business at particular websites…

Proposed Principle: Every website where data is collected for behavioral advertising should provide a clear, concise, consumer-friendly, and prominent statement that (1) data about consumers’ activities online is being collected at the site for use in providing advertising about products and services tailored to individual consumers’ interests, and (2) consumers can choose whether or not to have their information collected for such purpose. The website should also provide consumers with a clear, easy-to-use, and accessible method for exercising this option.

Requiring this kind of opt-in regime is an important step towards giving users more control over the collection and use of their personal data. To extend this further, websites should be required to have users periodically renew their acceptance of the collection of data, since privacy preferences might change as user behavior on a particular website changes over time. For example, when a user first uses Facebook to simply connect with friends, she might be willing to share basic personal information, but once her activities on Facebook expand to include more extensive personal information, she might no longer be so willing to have her data used for behavioral targeting. Rather than relying on her to take the time to find and tweak the privacy preferences, Facebook should be required to actively present her privacy options to her periodically when she logs in.

Limited data retention

Issue: Stakeholders express concern about the length of time that companies are retaining consumer data collected for behavioral advertising. The longer that data is stored in company databases, the greater the risks to the data. On the other hand, there may be good reasons for retaining data, such as maintaining and improving customer service or tracking criminal activities on the website.

Proposed Principle: Companies should retain data only as long as is necessary to fulfill a legitimate business or law enforcement need. FTC staff commends recent efforts by some industry members to reduce the time period for which they are retaining data. However, FTC staff seeks comment on whether companies can and should reduce their retention periods further.

While the FTC is on the right track, I struggle with framing a self-regulatory principle around a “legitimate business or law enforcement need.” Companies can claim any business need (current or future) as legitimate, and who know when law enforcement might come knocking on your door to access user records. There is enough fuzziness here that a company can easily say they need to retain records for 1, 10, or 100 months on “legitimate” grounds. Data retention periods need to be fixed and externally-defined, not left up to the companies themselves.

Affirmative express consent for material changes to existing privacy promises

Issue: Acknowledging that privacy polices are not only important tools for providing information to consumers, but also serves to promote accountability among businesses, it is also widely recognized that businesses may have a legitimate need to change their privacy policies from time to time.

Proposed Principle: A company must keep any promises that it makes with respect to how it will handle or protect consumer data, even if it decides to change its policies at a later date. Therefore, before a company can use data in a manner materially different from promises the company made when it collected the data, it should obtain affirmative express consent from affected consumers.

Again, opt-in regimes are always preferred over simply making changes and telling people they can opt-out if they so choose. Requiring “affirmative express consent” to use personal data is an important requirement.

Affirmative express consent to (or prohibition against) using sensitive data for behavioral advertising

Issue: Stakeholders express concern about the use of sensitive data (for example, information about health conditions, sexual orientation, or children’s activities online) to target advertising, particularly when the data can be traced back to a particular individual. They state that consumers may not welcome such advertising even if the information is not personally identifiable; they may view it as invasive or, in a household where multiple users access one computer, it may reveal confidential information about an individual to other members.

Proposed Principle: Companies should only collect sensitive data for behavioral advertising if they obtain affirmative express consent from the consumer to receive such advertising. FTC staff seeks specific input on (1) what classes of information should be considered sensitive, and (2) whether using sensitive data for behavioral targeting should not be permitted, rather than subject to consumer choice.

Here, the FTC again supports user opt-in for the collection of personal data, which is important, and I again call for the need to have users periodically re-affirm their acceptance. In response to the FTC’s request for input: attempting to globally define “sensitive” information is the wrong approach. Some information is sensitive in one context, and not in another. I’m willing to share my income level with a website trying to match me up with the proper investment options, but I might not want to share it with my social networking site. Similarly, pieces of information typically considered non-sensitive (my zip code or my gender), might become sensitive when combined or used to help link me to separate, sensitive data. Rather, users should be given the technical ability to specify which of their personal information can be used by a particular site (allowing the ability to decide what is sensitive in a particular context). Further, companies should be prevented from mining, aggregating, or using these data points in order to extrapolate or extract additional information about users.

The document also addresses issues related to security of data, and secondary use of data beyond behavioral advertising.

What is missing, however, are key principles shared by many other privacy frameworks, including the FTC’s own Fair Information Practice Principles. Notably, there is no mention of granting users the right to access the data collected by a particular website. The FTC should add language similar to their existing Fair Information principles:

Access/Participation

Access refers to an individual’s ability both to access data about him or herself — i.e., to view the data in an entity’s files — and to contest that data’s accuracy and completeness. Both are essential to ensuring that data are accurate and complete. To be meaningful, access must encompass timely and inexpensive access to data, a simple means for contesting inaccurate or incomplete data, a mechanism by which the data collector can verify the information, and the means by which corrections and/or consumer objections can be added to the data file and sent to all data recipients.

The right of individuals to access and challenge personal data is generally regarded as perhaps the most important privacy protection safeguard, and must be included any regulatory regime of set of best practices addressing the collection of personal information.

Related posts: (automatically generated)

1. FTC to Host Town Hall to Examine Privacy Issues and Online Behavioral Advertising
2. Recent Activities in the Online Behavioral Advertising Privacy Sphere
3. Google Launches Behavioral Advertising System, With Impressive (But Not Quite Perfect) Privacy Controls
4. Google’s Privacy Principles Fall Short
5. Privads: Privacy Preserving Targeted Advertising

The algorithms make their judgments partly on certain keywords in the profile. A member might be obvious by describing himself as a financial information enthusiast, for example. But more than likely the clues are more subtle. He might qualify for that category by listing Donald Trump as a hero, Fortune magazine as a favorite publication or “Wall Street” as a favorite movie.

The system also looks at the groups members belong to, who their friends are, their age and gender, and what ads they have responded to in the past. “Our targeting is a balance of what users say, what they do and what they say they do,” said Adam Bain, executive vice president for production and technology at Fox Interactive.

The value of trawling for user behavioral data is made clear by MySpace executives:

“We are blessed with a phenomenal amount of information about the likes, dislikes and life’s passions of our users,” said Peter Levinsohn, president of Fox Interactive Media… “We have an opportunity to provide advertisers with a completely new paradigm.”

…To the consternation of privacy advocates, who say Internet users are unaware of such activity, the social networks regard these detail-stocked profile pages as a kind of “digital gold,” as one Fox executive put it last year.

The increased interest in mining user data on social networking sites for this “digital gold” reveals a rise in what Oscar Gandy called “panoptic sorting,” whereby individuals are continually identified, assessed and classified for the purpose of coordinating and controlling their access to consumer goods and services, a process Gandy insists in inherently discriminatory. David Lyon has extending this notion beyond the consumer realm into a broader social milieu, where the notion of “social sorting” highlights the growing drive in our modern surveillance society for identification and classification.

We find examples of this kind of social sorting in MySpace’s ad strategy, which they call “hyper targeting”:

For the last two months, Fox Interactive has also experimented with the second phase of its targeting program, called “hyper targeting,” in which it further divides the 10 enthusiast categories into hundreds of subcategories. For example, sports fans are divided into subgroups like basketball, college football and skiing, while film enthusiasts are further classified by their interest in genres like comedies, dramas and independent films, and even particular actors and actresses.

Advertising messages will then be tailored based on which category I happen to fall into.

This “hyper targetings” fits neatly into both Gandy’s and Lyon’s concerns of how consumer surveillance produces discriminatory practices that “cream off some and cut off others,” as Lyons (2003, p. 2) states:

To consider surveillance as social sorting is to focus on the social and economic categories and the computer codes by which personal data is organized with a view to influencing and managing people and populations. …[I]n everyday life our life-chances are continually checked or enabled and our choices channeled using various means of surveillance. The so-called digital divide is not merely a matter of access to information. Information itself can be the means of creating divisions.

The consequences of both panoptic and social sorting, Lyons concludes, present issues of “deep discrimination…and social justice.” We must think long and hard about the consequences of this “new paradigm” in online advertising.

Related posts: (automatically generated)

1. Yahoo’s New Ad Sales System to Include Behavioral Targeting
2. Facebook to Join Behavioral Targeting Game, and Might Win
3. Advertisers Data-Mining on MySpace
4. Privacy and Surveillance in Web 2.0: Unintended Consequences and the Rise of “Netaveillance”
5. NSA Wants to Mine MySpace & Semantic Web

Google, Yahoo, and Microsoft have all recently announced varying plans to engage in behavioral targeting of their users in order to target advertising messages. These search engine giants collect and mine bits of information about me based on my searches, my profile, or my activities on other properties (whether I play fantasy football, for example) in order to create behavioral profile. It involves a certain amount of guesswork since just because I happen to search for “Paris Hilton” doesn’t mean I really care about the celebrity and that I really want to see advertisemens related to her.

Facebook, however, has access to a much more precise snapshot of my interests. The groups I join might reveal my geographic location, my favorite sports teams, my intellectual interests. The causes I join reveal what I’m passionate about. I might list my favorite movies, books, and music in my profile. And so on. Given the specificity of what I reveal about myself on Facebook, little guesswork is needed in order to build my behavioral profile. The more accurate the profile, the more targeted the advertisement. Will advertisers flock to Facebook to maximize the effectiveness of their targeting efforts? Time will tell.

[BTW, there is a Greasemonkey script to scrub the ads from your Facebook news feed]

This ability to aggregate and profit from my online behavior has, of course, not gone unnoticed. The FTC is holding a town hall meeting to address the growing concerns about Internet and search companies developing the means to track and profile users based on psychological and behavioral traits. I hope Facebook will attend.

Finally, one line from the USA Today article jumps out at me. When recalling the concerns raised about how Google’s Gmail targets ads based on the content of a user’s incoming e-mail, the article states: “Google’s customers eventually got used to the ads as online users have in general become more at ease with privacy issues.” I’m not sure what evidence the authors are relying on to make the claim that online users have “become more at ease with privacy issues.” Are people really at ease? Or is it more acquiescence in the face of default settings, the lack of a position from with to negotiate privacy settings, etc…

Related posts: (automatically generated)

1. Panoptic Sorting on the Rise as MySpace Enters Behavioral Targeting Foray
2. Yahoo’s New Ad Sales System to Include Behavioral Targeting
3. FTC to Host Town Hall to Examine Privacy Issues and Online Behavioral Advertising
4. Google Launches Behavioral Advertising System, With Impressive (But Not Quite Perfect) Privacy Controls
5. Recent Activities in the Online Behavioral Advertising Privacy Sphere

Topics of discussion include:

• How does online behavioral advertising work? What types of companies play a role in this market?
• What types of data are collected? Is the data personally identifiable or anonymous? Even when the data is anonymous, is it, or could it be, combined with personally identifiable data from other sources?
• How is the data used, and by whom? Is it shared or sold? Is the data used for any purposes other than to target advertising?
• How has the online advertising market, and specifically behavioral advertising, changed since 2000?
• What security protections are companies providing for the consumer data that they collect, use, transfer, or store?
• What do consumers understand about the collection of their information online for use in advertising?
• Are companies disclosing their online data-collection practices to consumers? Are these disclosures an appropriate and effective way to inform the public about these practices? Are companies offering consumers choices about how data is collected and used?
• What standards do, or should, govern practices related to online behavioral advertising? Are companies following the Network Advertising Initiative Principles, originally issued in 2000 for online network advertising companies? Are these principles still relevant, in light of changes in the marketplace? What other legal or self-regulatory standards are applicable to these practices? Are certain practices generally regarded as appropriate or inappropriate in this area?
• What changes are anticipated in the online behavioral advertising market over the next five years? Will information be collected through technological means other than cookies? Is behavioral advertising moving beyond the Internet into other technologies?

The meeting will be held November 1-2, 2007 at the FTC Conference Center at 601 New Jersey Avenue, N.W., Washington, DC. It is free and open to the public.

Related posts: (automatically generated)

1. Recent Activities in the Online Behavioral Advertising Privacy Sphere
2. FTC Proposes Self-Regulatory Principles for Online Behavioral Advertising
3. Google Launches Behavioral Advertising System, With Impressive (But Not Quite Perfect) Privacy Controls
4. Privads: Privacy Preserving Targeted Advertising
5. Latest iTunes Update Raises Privacy Issues