Will Congress Squelch Behavioral Marketing?

Congress has become increasingly interested in the privacy implications of behavioral marketing. This summer, the Senate has held hearings, and the House Committee on Energy and Commerce has followed the charge by seeking more information from Internet service providers (ISPs) and technology companies regarding their privacy policies and targeted advertising. These developments have led commentators to anticipate omnibus privacy legislation from Congress related to behavioral advertising in the short term.

Whether this will come to pass, or whether Congress will defer to the Federal Trade Commission’s recommendation that privacy and advertising remain in the domain of self-regulation, is an issue that businesses should be following closely this fall. Below is a brief summary of Congressional activities on the subject of behavioral advertising this summer.

Ehavioral Advertising

On July 9, the Senate Committee on Commerce, Science, & Transportation (a.k.a. “Senate Commerce Committee”) addressed growing governmental interest in behavioral (or “ehavioral”) advertising. Ehavioral advertising has been described by the Federal Trade Commission (FTC) as the process of tracking consumer activities online to deliver targeted advertising. The Senate Commerce Committee’s July 9 hearing occurred in the midst of a flurry of recent self-regulatory and state legislative initiatives focused on whether heightened regulation is necessary to address privacy interests in the context of collecting and/or using consumers’ personally identifiable and non-personally identifiable information to deliver targeted advertising. See “Online Behavioral Advertising — Key to Internet Monetization or Privacy Probes?” for further background.

Sen. Byron Dorgan (D-N.D.), who chaired the hearing, opened the discussion by recognizing the importance of advertising on the Internet and its key role in facilitating the availability of free services for consumers online. He also expressed understanding for advertisers’ interests in finding ways to better target their information. But he added that there were privacy concerns that should be explored.

Though it is currently reviewing public comments on its proposed guidelines on online advertising, the FTC testified that self-regulation is the best approach to balancing consumer protection with ad-supported business models that allow for free Internet content and services. A date has not been set for the release of the guidelines. However, the guidelines will likely encourage companies collecting data online to:

• Provide disclosure of the practice, as well as an opportunity not to have the data collected;
• Provide reasonable security;
• Get consumer permission to use data in a way other than previously disclosed; and
• Obtain consent before using any sensitive information — e.g., health, financial data — for behavioral advertising purposes.

Do Not Track

Google and Microsoft representatives both testified that the companies support federal privacy legislation, combined with consumer education and self-regulation.

NebuAd, a Silicon Valley startup which helps Internet service providers track their customers using “deep-packet inspection” in order to send them highly targeted advertisements, also supports self-regulation and privacy regulation focusing on the sensitivity of the type of information. NebuAd’s product places a hardware device in an Internet service provider’s network that can track where users are going online. Recently, NebuAd’s planned initiative with Charter Communications to track the Web usage of subscribers drew criticism from Congress and has been indefinitely delayed.

The Center for Democracy & Technology (CDT) testified that self-regulation was insufficient and recommended (1) additional hearings on ISP targeting and sensitive information; (2) general privacy laws; (3) enforceable FTC guidelines; and (4) the development of a “do not track” regime similar to the “do not call” list. Representatives from Facebook and Competitive Enterprise Institute also testified.

Dorgan promised to hold another hearing with representatives from ISPs, who were invited to testify at the July 9 hearing but declined to attend. Thus, the significant controversy surrounding this issue will continue as lawmakers grapple with balancing the benefits of online advertising with growing concerns about consumer privacy.

On Aug. 1, four members of the House Committee on Energy and Commerce [Representatives John David Dingell (D-Mich.), Joe Barton (R-Texas), Ed Markey (D-Mass.) and Cliff Stearns (R-Fla.)] ordered 33 cable and Internet companies (e.g., AT&T, Google, Microsoft, Comcast and Cox Communications), to provide details about their privacy standards for behavioral marketing. The responses were received the week of Aug. 11. They varied from companies who stated they are not currently using behavorial marketing techniques (e.g., AT&T) to others who provided more detail behind their use of deep-packet inspection technologies.

Based upon the ubiquitous use of these technologies, some legislative advocates are calling for increased regulation of behavioral advertising. Companies who work with third-party advertising networks or directly track the online activities of Internet users to serve ads should (a) follow the behavioral advertising debate closely; and (b) where appropriate, make their positions known to Congress and the FTC, both of which are actively considering policies and recommendations for this highly effective form of marketing.