• by Wendy Davis , Staff Writer @wendyndavis, November 9, 2011

Earlier this year, the ad network Chitika settled charges that it misled consumers by telling them they could opt out of behavioral targeting, but preserving that opt-out for just 10 days. That short time period violated an implied promise that an opt-out would last for a reasonable length of time, the Federal Trade Commission said.

This week the Better Business Bureau's National Advertising Review Council reported that four other companies -- Forbes Media Extension, Martini Media, PredictAd and Reedge -- were setting short opt-outs. Those companies -- which previously programmed opt-outs to expire in six months or less -- all agreed to preserve users' opt-outs for at least five years, the BBB said on Tuesday. Two other companies, QuinStreet and Veruta (MyBuys), fixed technical problems with their opt-out buttons or links, according to the watchdog.

The announcement marked the first time the BBB has publicly enforced the ad industry's behavioral-targeting privacy principles, which require ad networks to notify users about behavioral targeting via an “AdChoices” icon and allow them to opt out.

The watchdog also says it will give the FTC information about companies that refuse to follow the privacy principles. What the FTC will do with that data remains unknown. Certainly if companies have privacy policies but aren't following them, the FTC potentially can argue that consumers are being deceived. Ironically, however, if ad networks lack privacy policies altogether, the case for deception is harder to make.

Meanwhile, the BBB's move drew praise from FTC Chair Jon Leibowitz, who mentioned it in a speech Tuesday afternoon at ad:tech. “Not every self-regulatory program includes real accountability, but the ones that do work better and generally are able to avoid a more regulatory heavy hand from Congress,” Leibowitz said.

At the same time, Leibowitz has made clear he'd like to see some changes to the self-regulatory program. One of the most significant problems with the current regime is that opt-outs are cookie-based, which means they disappear when users delete their cookies. Many users do so relatively frequently; the result is that, for many users, opt-outs vanish in extremely short time frames.

One fix advocated by Leibowitz is for the self-regulatory group Digital Advertising Alliance to start honoring browser-based do-not-track commands. “We encourage the DAA to join with the browser companies to make the AdChoices opt-out permanent and move us closer to a Do Not Track architecture that is persistent,” he said.

While Mozilla and Safari offer do-not-track headers that users can activate, they don't actually block tracking. Instead, they communicate users' preferences to ad networks, but it's up to the networks to decide whether to honor those preferences.

Mozilla might have just made doing so more appealing. The company said today that it has no intention of turning on a do-not-track header by default -- meaning that users will have to change their browser settings in order to activate the header. “Do Not Track is intended to express an individual’s choice, or preference, to not be tracked,” Mozilla privacy engineer Sid Stamm blogged. “It’s important that the signal represents a choice made by the person behind the keyboard and not the software maker, because ultimately it’s not Firefox being tracked, it’s the user.”