New Self-Regulatory Principles Impose Limits On Tracking

The industry self-regulatory group Digital Advertising Alliance on Monday issued new principles prohibiting companies from collecting any information about Web users in order to determine their eligibility for employment, credit, health care or insurance. The new principles are slated to take effect next year.

The move is aimed at stemming criticism from Federal Trade Commission officials and consumer advocates, who say existing self-regulatory principles contain a loophole that allows companies to continue tracking users even if they opt out of online behavioral targeting.

The current principles only require ad networks to stop collecting information for purposes of online behavioral advertising -- or serving ads to users based on their Web activity -- when users opt out. But ad networks are allowed to continue collecting data for non-behavioral-targeting purposes.

Those purposes typically include analytics, frequency capping, site optimization and the like. But some privacy advocates -- and FTC officials -- have argued that nothing in the principles stops companies from tracking people for purposes that go well beyond analytics, such as determining insurance eligibility.

It's not known whether any companies have used tracking data for those purposes. But the potential for such uses of data has sparked concern by watchdogs.

The new principles aim to stem that concern by banning ad networks from collecting, using or transferring data for purposes of determining health insurance eligibility, creditworthiness, and employment terms. That ban applies regardless of whether people opt out of online behavioral advertising.

The new principles also specify that ad networks can continue to collect data for purposes including intellectual property protection, fraud prevention, reporting, market research, or where the data will be “de-identified.”

Privacy expert Justin Brookman praised the DAA's move, but said he still has some concerns about whether the industry's self-regulatory program can protect consumers.

“This is definitely a step in the right direction. They deserve credit for it,” says Brookman, director of the Center for Democracy & Technology's consumer privacy project.

But, he says, the self-regulatory program still has some flaws. Among others, some data collectors aren't part of the DAA and have not promised to follow self-regulatory principles. The DAA is made up of the Interactive Advertising Bureau, Direct Marketing Association, Association of National Advertisers, and American Association of Advertising Agencies.

Brookman also points out that the DAA's opt-out is still cookie-based, which isn't persistent because many users delete their cookies.