• by Dave Morgan , Featured Contributor, February 19, 2009

The online advertising industry received some qualified good news on the regulatory front this past week. Friday's headline and subhead in The Wall Street Journal said it best: "FTC Backs Web-Ad Self-Regulation: Agency Lays out Principles for Protecting the Privacy of 'Targeted' Users."

As many of you know, the FTC has spent quite a bit of time over the past two years trying to understand how, with the explosion of new data-driven techniques like behavioral targeting, the online ad industry protects consumer privacy. The FTC was looking to update its principles on profile-based targeting, which were first published a number of years ago and which advocated for strict industry self-regulation. The result of this most recent process was the publication of an almost 50-page document containing the findings and a set of proposed principles for the industry to follow.

I am not going to get into the substance of that document in today's column -- there's too much in it to do it justice in a few short paragraphs. Besides, our trade organizations and trade publications have been doing a great job reviewing, analyzing and communicating the substance of the report already. Rather, I want to highlight several critical messages that were delivered both in  the report and the comments of some FTC commissioners.

Simply put, the FTC is throwing down the gauntlet to the online ad industry. While the report still supports the notion of industry self-regulation on privacy rather than asking Congress to pass new laws, it's clear the FTC is not happy with how the industry has performed so far and is openly skeptical that the industry will get its act together.

FTC Commissioner Jon Leibowitz's comments sum it up well: "If the industry doesn't do a better job explaining what they are doing with consumers' information and giving them a choice, then it could easily move to a more regulatory approach." Leibowitz' opinion is very important. Not only has he been very consistent on this point -- it is the same one that he made at the FTC's Town Hall Meeting on the issue more than a year ago -- but many believe that he is a leading candidate to be named new chairman of the FTC.

If you don't believe Leibowitz when he criticizes our industry on data transparency, test it yourself. Go to your own Web site, read your privacy policy, and then visit your site with your browser set to the highest privacy level so that you can see all of the cookies that are being set. Make a list of all of the companies setting cookies and try to explain  what consumer information is transferred with every one of those cookies. Then ask yourself what they do with that information. I bet that most of you can't answer these questions, and I also bet that the same holds true if you asked them of your operations and business development folks.

What should we be doing about this? Here are three suggestions:

·         Take the protection of consumer privacy seriously. Raise the priority of the privacy issue in your organization. Recognize that privacy is not just an issue for your lawyers. It is a critical part of your basic value proposition with your users and partners.

·         Test your own privacy policy. This is the first thing that my good friend and top privacy lawyer Reed Freeman of Kelley Drye recommends to all of his clients. You may be surprised by what you learn.

·         Publishers, remove your heads from the sand when it comes to data transfers to partners. The past several years have brought an explosion of new techniques to capture and transfer data about browser activities. Some of today's Web pages contain dozens of pixels, "tags" and third-party delivered objects. Many publishers have no idea what each one does, what information it collects, who is actually collecting or receiving that information, what is ultimately done with that information in the end, and for how long it is stored. Now is the time to find out. Now is the time to demand that each and every partner -- network, advertiser, agency, content syndicator, analytic service, etc. -- explain exactly what is being done, and make their representations part of your contractual relationship.

·         Get involved in industry self-regulatory efforts. The IAB, AAAA, ANA and others are now working together to build a new, more comprehensive framework for industry self-regulation. Learn about those efforts and how you can contribute.

Our industry is lucky that the FTC still wants to support industry self-regulation of online privacy protection, in spite of the fact that we haven't been doing a great job of it so far. I think that we're running out of time. The next privacy blow-up could be our last. What do you think?