• by Wendy Davis , Staff Writer @wendyndavis, March 30, 2011

For more than 10 years, online ad companies have said that users should be notified about behavioral targeting and allowed to opt out. More recently, industry groups have said that companies engaged in online tracking should give clear notice via an icon that links to explanations about behavioral targeting -- or serving ads to users based on the other sites they've visited -- and lets consumers eschew targeting.

But carrying out that policy is proving extremely complex, as a new study released today by Carnegie Mellon shows.

For the study, researchers examined 400 pages from 100 popular Web sites and looked for proof that behaviorally targeted ads were accompanied by an icon. Researchers then narrowed their focus to 164 pages that contained non-contextual ads and where Firefox's TACO add-on revealed the presence of an ad network belonging to the self-regulatory group Network Advertising Initiative.

Only 35% of those pages contained enhanced notice, according to the report. "Notably, much of the enhanced notice appeared to be driven by advertisers (i.e. the companies that purchase ads) rather than by NAI members," the report says. "For example, almost all of the Verizon ads we saw had enhanced notice, even though they came from many different ad providers: AOL Advertising, Collective, Google, interCLICK, and Trac Marketplace. This suggests that some online advertising buyers are interested in providing notice and choice to their customers."

Researchers also examined the opt-out pages run by the two industry-sanctioned umbrella groups, the NAI and Digital Advertising Alliance, and found mechanical glitches with both programs. But that's only part of the problem: "Even if the opt-out mechanisms did work flawlessly, they do not adapt to changing membership," the report states. "In the past three months, six new members have joined the NAI; a user who has opted out of all NAI members three months ago would not be opted-out of six members today."

Additionally, the report found a host of different definitions of "opt-out." The DAA and NAI say that consumers who opt out will no longer receive targeted ads based on the sites they have visited in the past. That in itself troubles some privacy advocates, who say that many Web users who want to opt out of behavioral targeting care at least as much about online tracking as about receiving targeted ads.

Regardless, the industry's relatively narrow definition of opt-out isn't preventing some ad networks from adopting a more privacy-friendly approach. The Carnegie Mellon researchers found that 58 NAI members offered their own definition of opt-out, and 22 of those companies stopped collecting tracking data after users opted out.