FTC Clamps Down On Deceptive Opt-Out Cookies
Signaling its concern about privacy and online advertising, the Federal Trade Commission said Monday that it brought an enforcement action against the online ad network Chitika for continuing to track Web users after they opted out.
The FTC alleged in its complaint that Chitika's opt-out cookies lasted for only 10 days. After that time, Chitika resumed collecting anonymous information about people's Web-surfing activity in order to serve them targeted ads. The FTC alleged that the short lifespan of Chitika's opt-out cookies amounted to a deceptive practice.
The complaint and settlement were made public Monday on the FTC's Web site. The enforcement action marks the first time the FTC has targeted a company for allegedly offering deceptive behavioral-advertising opt-outs, according to industry observers.
Chitika used the 10-day cookies from May of 2008 until March 2010, according to the FTC. To settle the charges, the company agreed to destroy data collected prior to March 2010. In addition, Chitika promised that from now on it will preserve users' opt-out cookies for at least five years.
Chitika said in a statement that it had intended for opt-outs to last for 10 years, but prior to March 1, 2010, mistakenly set the cookies to expire in 10 days. "The FTC brought this bug to our attention in February, 2010; on March 1st, we had fixed it to opt out users for 10 years." Chitika said.
"We have always placed the utmost importance on the privacy of online users, and we believe this agreement will help us continue to place a premium on privacy as our advertising network continues to expand," the company added. Chitika also said that it received only 30 opt-out requests per month between May 2008 and February 2010.
The industry's self-regulatory standards require that companies involved in online behavioral advertising -- or tracking people in order to serve them targeted ads -- inform users about the practice and allow them to opt out. Those standards, however, are voluntary. While lawmakers have introduced bills that would make them mandatory, no law currently requires ad companies to notify people about online tracking or let them opt out. But some ad industry officials have said that that even without new laws, companies that renege on promises to users could face FTC actions.
Chris Soghoian, a privacy researcher who investigated Chitika's opt-out system while employed by the FTC in 2009 and 2010, praised the regulators' action against the company. "I think it sends a good message," he said. "If you are going to offer consumers a mechanism to stop behavioral advertising, it had better be effective."
Before joining the FTC, Soghoian published research showing that some opt-out cookies expire after six months, while others last for decades. Shortly afterward, the self-regulatory group Network Advertising Initiative said it would require members to set opt-out cookies for at least five years.