This week, Federal Trade Commission Chairwoman Edith Ramirez offered some advice to online ad companies: Don't track people who don't want to be tracked.
Speaking at the Technology Policy
Institute Aspen Forum, Ramirez unequivocally told ad networks to respect consumers' wishes -- even when consumers don't convey those wishes through the tools endorsed by the industry's self-regulatory
groups. Specifically, Ramirez suggested that companies should stop tracking people who delete their cookies, or express their preferences through settings in their browsers.
"Behind-the-scenes
entities should also offer and respect consumer choices," she said. "For ad networks, this problem can be
addressed by respecting consumer choices expressed through platform or browser tools."
She added that around 17% of consumers activate a "limit ad tracking" setting on Apple and Android mobile
devices, and between 30 and 50% of people delete their cookies each month.
"Ad networks should refrain from using techniques that circumvent these types of consumer choices," she said.
The recommendation might seem like common sense to many observers -- but some ad networks have done everything they can to track people for ad purposes, despite their apparent wishes. Just this
week, a federal appellate court indicated it may revive a privacy lawsuit
against ad company Turn, which is accused of using a controversial tracking technology to reconstruct data about users who deleted their cookies.
When researchers initially revealed Turn's
workaround, the company insisted it had done nothing wrong. "Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising," Turn wrote in a January
2015 blog post. (Two days later, the company reconsidered and said it would stop re-creating deleted cookies.)
The company also
said it honored opt-outs that were made through the industry's officially approved mechanisms, at pages operated by the Network Advertising Initiative and Digital Advertising Alliance. Bur privacy
advocates have long criticized those tools for many reasons, including that they're cookie-based: When privacy conscious users delete their cookies, they also delete their opt-out commands.
Turn is hardly the only ad network to target people who deleted their cookies. Companies including Google's DoubleClick, Vibrant Media, WPP, PointRoll and PulsePoint allegedly circumvented Safari's settings, which block third-party cookies
by default.
Ramirez also suggested in her speech this week that companies should take steps to protect people's privacy even if they don't object to tracking. "Certainly, companies cannot put
the onus on consumers to choose among basic privacy protections. Nor can they abdicate their responsibility to use reasonable measures to protect consumer data," she said. "Companies need to practice
privacy and security-by-design ... and refrain from collecting and storing consumer data that they do not need."