Online Tracking, Profiling and Targeting – Behavioral Advertisers Beware!

In May 2011, the Privacy Commissioner of Canada released a report based on a consultation process for online tracking, profiling and targeting of advertisers, and cloud computing. The goal was to engage the public on recent technological advancements and privacy complications in behavioral advertising.

The consultations examined the practices of online tracking, profiling and targeting through the application of the Personal Information Protection and Electronic Documents Act (“PIPEDA”). PIPEDA is the legislation in Canada that applies to the collection, use and disclosure of “personal information” by an organization in the course of a “commercial activity.” PIPEDA would apply to the personal information practices of private sector organizations engaged in online tracking, profiling and targeting.

While PIPEDA could withstand the evolution of technology, the report concludes, there are various challenges that exist with the application of PIPEDA. Among them, for example, is “defining what is (or is not) personal information; determining the appropriate form of consent; limiting the use of personal information; implementing reasonable safeguards; providing access and correction to online information; and ensuring accountability.”

Overall, the main finding from the consultation is that online tracking, profiling and targeting by behavioral advertisers is mostly invisible to consumers and that greater transparency is required to protect consumers from inappropriate or illegal behavior. The need to explore this issue further is stressed in the report.

Online Tracking, Profiling and Targeting

At the foundation of online tracking, profiling and targeting is that everything that a consumer does online is recorded in some way. This is particularly troubling, as this information increasingly is being gathered for commercial purposes, and it is becoming a big business.

Consider this example: A consumer goes online and browses through various Web pages. Her browsing habits are collected through digital markers such as HTTP cookies, flash cookies and Web beacons. These markers can be used to track information about the websites she visits, including pages visited, Internet Protocol addresses, length of time spent on pages, advertisements viewed, articles read, purchases made, search terms or other information entered on a site, user preferences such as language and Web-browser type, operating system, and geographical location information. This information could then be used to uncover patterns from the data for practices such as behavioral advertising.

What Is Behavioral Advertising?

Behavioral advertising is defined as “tracking consumers’ online activities over time in order to deliver advertisements that are targeted to their inferred interests. Behavioral advertisers use this data to build user profiles, determine user categories, and show ads based on demographics and assumptions about user interests.”

Advertisements are then delivered through websites, advertisers and ad networks. The privacy issue is raised when the action is tracked and used later to serve a targeted advertisement. PIPEDA provides that some publicly available personal information can be collected, used and disclosed without an individual’s consent; however, that information may be collected, used or disclosed only for limited purposes.

Due to the contentious nature of the privacy implications associated with behavioral advertising, the Office of the Privacy Commissioner in Canada is continuing its research with respect to online tracking (especially with respect to children) and working with Industry Canada on how to integrate privacy legislation to protect consumers against online tracking and profiling. It may be that a type of opt-in or opt-out consent may be required for online tracking, profiling and targeting of consumers, and an associated greater transparency.

The bottom line is that although the future regarding this issue is yet to be written, it appears that Canada is moving toward applying more restrictive measures to behavioral advertising to ensure that consumers are protected from privacy violations. It will likely be a matter of time before behavioral advertising is further regulated in Canada.

US: Do Not Track

In the United States, the Federal Trade Commission has endorsed a “Do Not Track” mechanism. In its report, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers, the FTC addresses the benefits of such a mechanism. It involves placing a permanent cookie on a consumer’s browser to indicate to all sites whether the consumer wishes to be tracked or receive targeted advertisements. The fact that the cookie would remain in the consumer’s browser would eliminate the need for consumers to make privacy protection choices on a “company-by-company” or “industry-by-industry” basis.

At the same time, however, the FTC report identifies several important considerations associated with a “Do Not Track” mechanism. First, online behavioral advertising can sometimes be beneficial, by alerting consumers to online products and services. The “Do Not Track” mechanism should not undercut these types of advantages. The FTC report suggests that it may be useful for consumers to have a choice either to opt out of online behavioral advertising completely or to select which types of advertising they would like to receive.

Ultimately, the FTC report shows that the issues surrounding the collection and use of consumer data in the U.S., as in Canada, are complex.