• by Wendy Davis  @wendyndavis, July 14, 2011

The online ad industry's voluntary measures to protect consumers' privacy are falling short, a senior lawmaker said Thursday.

"Self-regulation isn't working," Rep. Henry Waxman (D-Calif.) said at a hearing of the House Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade. He added that a report posted this week by Stanford researchers shows that efforts of industry groups are inadequate.

In the report Tracking the Trackers: Early Results Stanford researcher Jonathan Mayer wrote that eight ad companies that belong to the self-regulatory group Network Advertising Initiative appear to violate their privacy policies by setting new cookies, or failing to delete existing ones, after consumers opt out of online behavioral targeting.

The NAI requires its members to stop sending behaviorally targeted ads to people who opt out, but allows companies to continue collecting data about those people. Some members, however, go beyond NAI standards and also stop collecting data about people who opt out.

The eight companies named in the Stanford report appeared to indicate in their privacy policies that they stopped tracking users who click on opt-out links. Those companies are 24/7 Real Media, Adconion, AudienceScience, Netmining, Undertone, Vibrant Media, Wall Street on Demand and TARGUSinfo Advisor.

Since the report came out, 24/7 Real Media changed its privacy policy to state: "Opting out does not necessarily delete or replace all cookies from our domain."

That is in contrast to the privacy policy in effect on Tuesday morning, which said that users could opt out of receiving "ad delivery, audience management and behavioral targeting cookies."

In an email to Online Media Daily, 24/7 corporate counsel Noga Rosenthal said the company does not "collect information for online behavioral advertising when we see an opt-out cookie." But Rosenthal added that using cookies for "operational" purposes and frequency capping "does not undermine the consumer's opt out choice and is consistent with industry standards."

Wall Street on Demand likewise revised its privacy policy this week to state: "Opting out does not necessarily delete or replace all cookies from our domain; others may remain which are used for aggregate reporting on the performance of the advertisements we serve."

The company said in an email that its prior policy contained "poor language."

Wall Street on Demand added that it also uses cookies in order to attribute conversions to ad impressions and clicks. "This provides accountability to our advertisers and publishers, and is independent of OBA [online behavioral advertising] activity covered by our opt-out procedures," said Kate Dinar, a Director of Wall Street On Demand.

Waxman isn't the only one to call attention to the Stanford report. Advocacy group Consumer Watchdog on Thursday asked the FTC to investigate the eight companies identified as potentially violating their privacy policies. "We call on the commission to hold these companies responsible for their unfair and deceptive practices," the group wrote.

Even assuming the Stanford findings are accurate, however, the companies might have good explanations. For instance, it's possible that any information gathered about users who have opted out is immediately deleted.

At Thursday's Congressional hearing, Waxman additionally criticized the fact that self-regulatory standards allow ad networks to continue to collect data about users who say they want to opt out of behavioral targeting. The Stanford report said that 33 ad networks that belong to the NAI continue to collect information about users who have opted out.

NAI executive director Chuck Curran says ad networks often have good reasons to collect data about users who opt out. For instance, he says, ad networks might use that information for analytics, or to limit the number of times the same ads are shown.