The Federal Trade Commission
has finalized a settlement with ad network Chitika, which allegedly engaged in deceptive practices by tracking Web users after they opted out.
Although Chitika told Web users they could opt
out of online behavioral targeting, the company's opt-out cookies expired after only 10 days. Allowing opt-outs to expire so quickly violated at least an implied representation that they would "last
for a reasonable period of time," the FTC allowed.
Chitika said it had intended for opt-outs to last for 10 years, but prior to March 1, 2010, mistakenly set the cookies to expire in 10 days. The
company will destroy data it collected prior to March 2010, and also promised it will preserve users' opt-out cookies for at least five years.
The resolution, first announced in March, drew two
public comments, including one from Chicago-Kent College of Law's Institute for Science, Law and Technology. That letter, signed by legal fellow Jake Meyer and a colleague, proposed that the online ad
industry obtain people's explicit consent before collecting and using their personal information. "In place of an opt-out mechanism, an opt-in mechanism could be provided for consumers by Chitika and
other Internet advertising companies without creating an unreasonable burden on these companies," the letter states.
The FTC responded in a letter that it believes companies that collect data
about consumers "should make their practices transparent to consumers and should also offer consumers the ability to control those practices."
The agency added that specific mechanisms "may vary
depending upon the business model and context, as well as the nature of the data collected and used."
Industry self-regulatory standards call for companies involved in online behavioral
advertising -- or tracking people in order to serve them targeted ads -- to inform users about the practice and allow them to opt out of receiving the ads.
While lawmakers have introduced bills
that would make those practices mandatory, no law currently requires ad companies to notify people about online tracking or allow them to opt out of data collection.