• by Wendy Davis  @wendyndavis, May 16, 2011

The Federal Trade Commission consumer protection chief David Vladeck delivered a message on Monday to online ad companies: New enforcement actions are in the works.

"The FTC will step in when false or misleading privacy claims have the effect of undermining consumer choices," Vladeck said at an industry conference about ad networks and exchanges. He added that the commission recently reached settlement agreements with Twitter, Google and the ad network Chitika for allegedly "making deceptive claims about the privacy of the information they collect."

In Chitika's case, the ad network offered users the opportunity to opt out of online behavioral targeting, but the opt-out cookie lasted for only 10 days. "We were not happy with Chitika," Vladeck said. "There are more cases to come."

Vladeck also discussed the FTC's proposal for a universal do-not-track mechanism. Do-not-track, Vladeck said, need not require new legislation if the industry can include five components. Four of them are relatively straightforward: The mechanism must be easy for consumers to use, effective, universal and persistent.

The fifth component, however, has proven to be more complex: A do-not-track mechanism must allow users to avoid the collection of their data, not just its use.

This requirement, Vladeck said, stems from the concern that data that is initially collected for advertising purposes might end up being used for other, secondary purposes that consumers don't want.

"Can my health insurer learn that I spend a lot of time online browsing for deep fat fryers?" Vladeck said. "We've asked these questions repeatedly. We haven't yet gotten a clear answer. Until we get an answer to our questions about secondary uses, we cannot support an opt-out mechanism that opts consumers out of ads but allows data to be collected for secondary purposes."

At the same time, he said, the FTC believes there should be an exception to the no-collection rule when the data is being gathered for "commonly accepted practices." Defining them, however, is proving difficult, especially when it comes to analytics.

So far, the FTC and industry groups generally agree that fraud detection, fulfillment of online orders and frequency capping should be considered legitimate business practices, Vladeck said in a follow-up interview with Online Media Daily. Beyond that, he said, the FTC and industry are still attempting to "narrow the range of disagreement."

Vladeck also told OMD that the FTC has "real concerns" that information it collected to send users targeted ads is being used for other purposes. "We see leakage of data that looks like it was collected from behavioral advertising," Vladeck said. Even when consumers consent to the use of their data for targeted advertising, failing to disclose that the data could be used for other purposes could constitute a "deceptive omission," he added.

Eeven without new laws, he says, companies that don't follow industry practices could face repercussions in the form of a hit to their reputation. "The market has a discipline," he said, adding that marketers might refuse to do business with outliers.