• by Daniel Royalty , Holly Towle , October 14, 2009

How the legal framework for behavioral advertising will be built

As behavioral advertising increasingly becomes the standard for online advertising, self-regulation will soon be joined by concrete and enforceable legal frameworks. Two groups will serve as the main catalysts for developing these frameworks. First are consumers, represented by advocacy organizations. Second are businesses that perceive they are being negatively affected by behavioral advertising. These businesses include those that hope
to prevent others from collecting their consumers' behavioral data, and those whose competitors use behavioral advertising to attract consumers. Both groups will effect change through legislatures, regulators, and courts.

Two congressional subcommittees have held hearings aimed in part at introducing bills to address behavioral advertising. One privacy bill has been introduced at the federal level, and another is promised. A new generation of data protection laws and regulations have or will soon hit the books, such as a Maine statute regarding predatory marketing to minors.

Although the wheels of regulatory and legislative change have begun to turn, litigation and regulatory action promise to be the more immediate agents of legal development. A patchwork of consumer-focused laws and regulations apply to behavioral advertising and the technologies used to implement it. Some laws have broad proscriptive application, such as the Federal Trade Commission Act (and "baby" FTC acts at the state level), prohibiting unfair or deceptive acts or practices. Other laws and regulations narrowly focus on activities that may be used in behavioral advertising systems, such as the Federal Electronic Communications Privacy Act, which controls how companies may examine electronic communications and share information derived from them.

LConsumer litigants (and class action lawyers) driven by the possibility of lucrative settlements will invoke existing laws against various behavioral advertising systems. For example, the consumer class action against online ad agency NebuAd, and several isps that is pending in federal court, brings claims under the federal Wiretap Act, and it will be an important test for deep packet inspection (DPI) at the ISP level.

In contrast to consumer issues, little attention has been paid to businesses competitively affected by behavioral advertising. Laws in this area will likely be made by fits and starts as business disputes with behavioral advertisers are resolved in the courts under existing laws. For example, businesses may invoke trademark laws to limit the reach of their competitors' behavioral advertising campaigns. A number of recent federal appellate court decisions consider whether use of trademarks as triggers for adware-generated advertisements violate the Lanham (Trademark) Act, and they come to differing conclusions based on the facts. Businesses also may leverage laws controlling how data may be collected. Under the federal Wiretap Act, either party to an electronic communication - Internet user or Web site owner - may sue for nonconsensual interception of the communication. NebuAd drew a consumer class action, in part, because the suit carved out an easily definable group of consumers - affected subscribers. In contrast, a behavioral advertising model that targets, or disproportionately affects, a specific business will draw litigation from that business if it judges the competitive costs of inaction too high.

Although the recent flurry of congressional activity has (appropriately) occupied the limelight, most of the upcoming change will happen in the courts, as existing laws are mapped onto behavioral advertising and its myriad implementations.