Targeting Real-Time Targeting: Privacy Groups File Overreaching Suit With The FTC Against Real-Time Behavioral Advertising

The Debate"The Debate" is a column focused on the current debate around ad targeting and consumer privacy.

Today's article is written by: Ed Zimmerman, Mark Kesslen, and Matthew Savare, Lowenstein Sandler, a law firm. (See bios.)

Let’s say you’re surfing the web, planning your next vacation with the family.  You visit several travel sites, book your plane tickets and hotel, and rent a car.  You also read some reviews and blogs about your destination, the local restaurants, and nightlife.  You then Tweet about it and go to Facebook where you reconnect with one of your friends who lives in the area you’re visiting.  From the searches you’ve run, it’s clear that you’re going to the French countryside and you’re interested in activities for the family, with a winery visit or two.

After playing around on the social networking sites, you decide to do more research for your trip.  Given the way the Internet now works, you expect – actually, you know definitively – that you’re going to be served some ads to help pay for all this free information you’re getting.  And now comes the fundamental question: would you rather get served an ad about the best local dining, a great idea for a day trip near your destination, or ads for a wonder drug that’s totally inapplicable to you?

It seems too obvious to even ask the question, but recently, several privacy groups filed a legal action seeking to ensure that we continue to receive those wonder drug ads, technological advances be damned!  These self-appointed privacy advocates seek to stop – or at least greatly curtail – the natural evolution from irrelevant online ads that are pushed at you (and millions of other uninterested consumers) to smarter ads that are contextualized and served to you based on your preferences, interests, and needs.

The Latest Attack on Online Advertising

On April 8, 2010, three privacy groups jointly filed a complaint with the Federal Trade Commission (“FTC”) alleging that certain online profiling and targeting practices – including real-time auctions of individual ad impressions – constitute unfair and deceptive business practices.  In their complaint, the Center for Digital Democracy, the US Public Interest Research Group, and the World Privacy Forum request that the FTC investigate a number of behavioral advertising and related companies, enjoin them from certain types of behavioral advertising, award consumers compensatory damages, and require any real-time tracking and bidding system to take greater steps to protect the privacy and economic welfare of US consumers.

The sweepingly broad complaint attacks numerous aspects of online advertising ranging from ad auctions to cloud computing.  It is the latest in a decade-old string of legal challenges to behavioral advertising, but this time with an emphasis on the industry’s push towards optimizing real-time bidding using real-time conversion data.

The Complaint & Oscar Wilde

The complaint focuses primarily on recent technological developments that have enabled online advertisers to more quickly, efficiently, and precisely target ads to individual users.  The complaint also provides a veritable who’s who list of hot companies in the sector.  At a time when many investors and potential customers/partners/acquirers are trying to ascertain which companies are the leaders in behavioral targeting and tracking, one wonders whether the complaint isn’t a roadmap spotlighting the best of breed companies in the field, raising the interesting question (stolen a bit from Oscar Wilde): If you are doing behavioral targeting, is it better to have been named in the complaint or to have been overlooked?

In terms of substance, the complaint targets real-time bidding (“RTB”), which permits advertisers and publishers to buy and sell individual display ad impressions in near real-time with the use of various targeting parameters, including geographic location, behavioral data, and information concerning the context of the ad in the page.  For the advertising industry, RTB represents a seismic shift (and improvement) from the world of reserved bidding where buyers of online ads bid on future publisher placements and hope that the publisher or ad network will deliver their targeting parameters correctly.

Similar to the reasoning privacy advocates used when they complained to the FTC in 2007, this complaint repeatedly claims that the “stealth” aggregation, combination, and use of consumers’ online viewing habits threaten users’ privacy.  However, the privacy groups do not set forth one concrete example or articulate – even in a general sense – how behavioral advertising impacts users’ privacy.  Instead they rely on nebulous allegations of undefined threats to autonomy and privacy.

The complaint also sets forth several additional issues that had not been previously raised to the FTC.  For example, the groups strangely allege that housing the data in a “cloud” heightens security risks.  This seems like a purely Luddite perspective – does housing data in one server really provide greater data protection than spreading data across numerous servers?  Not surprisingly, the groups don’t supply any support for their assertion.

The complaint also emphasizes that more companies are combining online behavioral data with data residing in databases (like those of Nielsen and Experian) of the physical world.  They allege that an advertiser’s compilation, generation, and sale of more information on a given user compromise that user’s privacy.  They also highlight the fact that the ad exchange system that originated in the online world has migrated to the mobile space, making targeted advertising nearly ubiquitous, as if to say that it breaks some natural law prohibiting the matching of offline, online, and mobile data.  We understand that compiling increasing quantities of data means that the holders of that data know more about you, but is that really a detriment to the consumer?  How many of us rate movies on Netflix or songs on Pandora with the understanding (or hope) that the engines will more accurately understand what we like in order to make more compelling suggestions?

One of the authors recently lamented that he was served an ad by a music service.  He didn’t mind receiving the ad; he had not subscribed for premium service, and therefore he understood the bargain he had made.  He did, however, mind that the ad indicated that the server believed him to be far older than he actually is (given the advertised product).  This left him wondering whether his musical preferences gleaned by that service from scores of hours and dozens of ratings were too unhip (answer: probably).  He took some comfort in thinking that the site lacked a great targeting engine (maybe it should begin working with one of the companies highlighted in the complaint!).  If the targeting had, in fact, depressed him because it forced him to come to terms with the fact that his musical taste was stuck in 1983, the FTC’s standards wouldn’t recognize that as harm of the type the law was designed to prevent; even the complainants acknowledge that “emotional harm” doesn’t count, as they articulate the standard for the FTC to find “consumer injury:”

The injury must be “substantial.”  Typically, this involves monetary harm, but may also include “unwarranted health and safety risks.”  Emotional harm and other “more subjective types of harm” generally do not make a practice unfair.  Secondly, the injury “must not be outweighed by an offsetting consumer or competitive benefit that the sales practice also produces.”   Thus the FTC will not find a practice unfair “unless it is injurious in its net effects.”   Finally, “the injury must be one which consumers could not reasonably have avoided.’”

In the most far reaching of their claims, the groups argue that the “open marketplace” that has developed to buy and sell behavioral ad data has created a financial windfall for publishers, ad agencies, and marketers that “capitalize” on consumer data.  The groups contend that this unauthorized use of data causes consumers financial loss and losses to their privacy and autonomy.  However, the complaint does not specify or even attempt to explain the nature of this alleged financial loss.  Put simply, the ad industry’s ability to profit from the use of consumer data does not mean that consumers are financially harmed.  As noted below, the exact opposite is true.

Similarly, the complaint asserts that consumers are not adequately compensated for the use of their data.  This type of claim begs several important questions.  For example, how – if at all – do the groups value the enormous amount of ad-supported, free content and services made available to consumers on a daily basis?  Aren’t the hundreds of millions of online users already receiving consideration for their information?

Ultimately, the groups ask the FTC to do the following:

  1. Compel companies involved in real-time online tracking and auction bidding to employ an “opt-in” regime, as opposed to the standard “opt-out” process;
  2. Require that these companies amend their privacy policies and business practices to acknowledge that tracking and real-time auctioning involve personally-identifiable information;
  3. Require that consumers receive “fair financial compensation” for the use of their data;
  4. Prepare a report that informs consumers about the privacy risks and consumer protection issues involved with the real-time tracking, data profiling, and auctioning, including sections devoted to financial and health marketing and data involving 13-17 year olds; and
  5. Address the potential that companies may “redline” information to certain consumers (i.e., withhold editorial content to consumers based on an assessment of their economic value derived from data obtained by tracking and profiling them).

The Implications to the Advertising and Data Industries

Despite the breadth of the complaint, many of its allegations were raised to the FTC years ago.  Based on those objections from 2007, the FTC, in February 2009, issued a report titled “Self-Regulatory Principles for Online Behavioral Advertising.”  In July 2009, a group of the largest media and marketing trade associations, including the Association of National Advertisers, the Direct Marketing Association, and the Council of Better Business Bureaus, responded to the FTC report with its own report of the same name.

Basing its report largely on the FTC report, the consortium set forth the following seven principles for companies to follow when utilizing behavioral advertising.

  1. Transparency – Third parties and service providers are to provide “clear, meaningful, and prominent notice on their own websites that describe their behavioral advertising data collection and use practices.”  This is a significant change for many companies, which tend to bury these disclosures in their privacy policies.  More prominent disclosures would minimize the risk that the FTC would hold the practice to be deceptive or unfair.
    In January 2010, in an effort to simplify and standardize the disclosure process, the advertising industry agreed on a standard icon — a white “i” surrounded by a circle on a blue background — that companies using behavioral advertising should add to their online ads to inform consumers how their data is being collected and used.  The icon, which companies plan to add to their online ads by mid-summer, would be accompanied by a phrase such as “Why did I get this ad?”  When consumers click on the icon or the phrase, they will be redirected to a page that explains how the advertiser used their online history and demographic information to send them targeted ads.
  2. Consumer Control – Third parties should allow consumers to choose whether their data is collected and used for behavioral advertising.  Service providers should not collect and use data for those purposes without first obtaining the consumer’s consent, which, once granted, should be made easy to withdraw.  Again, that kind of process tends to negate any implication of unfairness or deception.
  3. Data Security – Entities should use “appropriate” physical, electronic, and administrative safeguards to protect consumer data, and should retain data only as long as necessary to fulfill a legitimate business need or as required by law.  In addition, service providers, among other things, are to anonymize, alter, or randomize any consumer personally-identifiable information or unique identifiers to prevent it from being reconstructed.
  4. Material Changes to Existing Behavioral Advertising Policies and Practices – Before applying any material change to their data collection and use policies with respect to behavioral advertising, entities are to obtain a consumer’s consent.
  5. Sensitive Data – Entities should not use behavioral advertising directed to children they have actual knowledge are under thirteen, except as permitted by the Children’s Online Privacy Protection Act.  In addition, entities should not collect personal information from children they know to be under thirteen or from sites directed to children.  Regarding other forms of “sensitive data,” entities should not collect and use Social Security Numbers, financial account numbers, drug prescriptions, or medical records for behavioral advertising without the consumer’s consent.
  6. Accountability – The industry report notes that its principles are self-regulatory in nature, and apply to the more than 5,000 companies that belong to any of the sponsoring organizations.  It also stipulates that monitoring, reporting, and compliance programs need to be put into place to process complaints, ensure transparency, and promote compliance.
  7. Education – The report encourages entities to participate in educational and outreach programs to instruct individuals and businesses about behavioral advertising.

Current Law & Where We Go Next

Although we believe that the complaint truly misses the mark, it does rightfully point out that behavioral advertising and tracking companies should focus on providing clear and prominent disclosures to their customers.  This principle was highlighted last year when the FTC filed a complaint against Sears Holdings Management Corporation (“SHMC”) for unfair and deceptive business practices relating to SHMC’s operation of the sears.com and kmart.com websites.  In connection with a marketing initiative, users of those sites were invited to join the “My SHC Community,” which contained a program that collected information on nearly all of their online activity.  However, SHMC had not prominently disclosed this tracking functionality at the time users joined.  Instead, SHMC made the disclosure in the middle of an end user license agreement.

In a ruling that departed from the legal precedent that full disclosure does not constitute an unfair or deceptive business practice, the FTC deemed SHMC’s otherwise complete disclosure to be insufficient in light of consumers’ expectations and the amount and detail of information SHMC was collecting.  SHMC ultimately consented to an order from the FTC requiring that prior to a consumer downloading or installing any tracking application, SHMC make clear and prominent advance disclosure of how and what they track – separate and apart from any privacy policy or terms of use – and that the consumer consent to the downloading of the tracking application.

Wrap Up

Targeting is not an innovation -- sellers have targeted potential customers since the practices of buying consumer goods and services first arose.  The complainants seem upset that we've just gotten increasingly good at it.  When targeting is practiced responsibly, it provides an enhanced user experience without any meaningful damage to consumers.  Overzealous privacy advocates have been striving for years to shutdown advances in online advertising though, ironically, these same groups would be outraged were web content to become materially less free because consumers would have to pay for their content in cash – talk about financial harm to consumers!

Even if the April 8th complaint never reaches the stage of formal FTC rulemaking, the commission will likely continue to bring individual enforcement actions related to behavioral advertising and similar practices, without attempting a wholesale ban on targeting.  In that case, the SHMC consent agreement and future proceedings would establish the compliance framework within which companies would need to operate in order to avoid FTC action.  Individual enforcement actions focused on specific misconduct make sense.  In light of the FTC's existing guidelines and industry's self-regulatory regime, the April 8th complaint’s broad indictment of online technological advances, which most targeters are employing responsibly, is simply unwarranted.

1 Ed Zimmerman Chairs the Tech Group at Lowenstein Sandler (www.lowenstein.com), a law firm, teaches Venture Capital & Angel Investing to MBA Candidates at Columbia Business School, actively angel invests, and chairs www.FirstGrowthVN.com.  Mark Kesslen runs IP for the Tech Group at Lowenstein Sandler and co-chairs the firm’s IP Litigation Group.  Prior to that he was Chief IP, Technology & Sourcing Lawyer worldwide for JPMorganChase.  He, too, angel invests actively.  Matt Savare specializes in privacy, IP, and media at the Tech Group at Lowenstein and is a frequent author and lecturer on the subject.


Popular On AdExchanger Right Now:

10 Comments

  1. Fooman xhu

    Let's ask a more fundamental question: what is the web? And secondly, who pays for it?

    The privacy groups speak out of both sides of their mouth. On one side they (appear) to want the web to remain and for it to remain free. On the other hand, they demand for it to remain anonymous. Sorry those are competig goals. Unless tear groups want everyone to pay an Internet tax or license fee and a Personal subscriber fee, they are waaaaay out of line here.

    They need to wake up tote fact that he web has changed. The sites and networks have built out the monetization mechanism for keeping the web free. The free sites have banded together and opted into the ad netwoks and exchanges with the goal of bein able to monetize what would otherwise induce bankruptcy. What is the benefit here? A massive, personalized, technically advanced contnet source called the Internet. An a means for industry o reach it's consumers with much less wasted spend. The benefit is that these savings sponsor those wonderful content sites the privacy groups demand for free.

    My next point is that the web is no longer a bunch of disconnected web pages. They are now via AI advancements quasi-sentient in that they react to and recognize human behavior and social connections and judge credit worthiness an a host of other things. This impacts what content you may see. All this to say the web is really a web now. And the answer is not to attack it by whining about privacy but rather ask the question - what do we want from the Internet ? Do we value anonymity and waste and irrelevancy? Or is there a value to participating in a system that rewards you personally for participating vs the old way where only big newspapers and tv it the benefit of your attention.

    Let's face it in an attention economy our personal attention is valuable. It can be quantified and traded. And therefore users should be able to derive a personal benefit out of it. The answer is not to shut this down prematurely but allow for safeguards and to encourage further innovation such that consumers derive the maximum financial benefit from their participation and personal history.

    The alternative is to roll back everything to the good ole days when a few media outlets controlled everything includingthe facts. Which if we dig deeper into who is bankrolling this frivolous lawsuit may prove to be instructive as to the suit's real motives.

    Reply
  2. Mark Kesslen

    Thanks so much. We feel strongly about this issue as we represent a lot of companies in this space.

    Mark (mkesslen@lowenstein.com)

    Reply
  3. These are developments that threaten privacy to a new degree. It's more than disclosure that's required: it's respect for the user, consumer and citizen. This isn't about free content---indeed, a careful analysis of the real-time bidding and targeting system raise fundamental questions of how such a system will support a true diversity of content--as those with the "right" data characteristics are targeted. That the authors can't see the full dimension of the problem is why the FTC, the Congress, and EU need to act.

    Reply
  4. These guys drive me nuts! I'm all for protecting privacy, but what really makes me laugh is how the self-appointed privacy advocates believe that marketers actually care about a single individual. All we really care about is what segment identifier you belong to.

    My favorite passage in the complaint is this one:
    "While advances in computational advertising and other forms of automation related to the behavioral targeting of individuals can provide positive benefits for publishers and advertisers, such technology must be deployed in a manner that both protects consumers and respects their dignity as human beings."

    Say what? Things are really advancing in the industry, but I am unaware of anybody in the space that has developed code that respects the dignity of human beings.

    When they start personifying technology, I think it's safe to say the are reaching.

    Reply
  5. Sidestepping this a bit -- When I receive a baby clothing catalog from a company I've never done business with, or I get a "refinance your mortgage" letter with official-looking information bearing the name of my lender and size of my mortgage loan (scraped from public records), I don't get to be able to opt-out very easily or see a handy little notice on the cover corner saying how my info got to them. I don't get to see who sold my information in a particular instance (unless I change my name to have the name of the vendor I give it to - though I gave up having my newspaper sent to Rob-WSJ Leathern a long time ago 🙂 So why the double standards about sharing of internet interest data?

    Reply
    • Great point, Rob. This is where consumer advocacy groups should be putting serious focus. I understand how direct mailers get my info (former Acxiom employee), but like you, what really gets me us the difficulty/impossibility of opting out of snail mail. It's the pile up of actual physical crap in my house that kills me. I can delete email without guilt. Junk snail mail on the other hand is harmful to consumers and the environment. Why do we have CanSpam Act, but nothing for offline?

      Reply

Add a comment

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>