Measuring A Glass As It Fills Up
A study released yesterday by several privacy researchers outlines the authors’ efforts to assess the notice and compliance requirements implemented by the NAI and Digital Advertising Alliance (DAA) as part of our respective self-regulatory programs. The study makes a number of assertions at the margins to which we take exception, in particular the claim that some NAI members are not providing sufficient notice about their collection and retention practices for online behavioral advertising.
On the whole, however, we think the study shows how robust and far-reaching the industry’s self-regulatory regimes have become, and we believe the authors may have missed that forest by peering too closely at the bark of the trees.
In fact, on core issues of self-regulation like reach, effectiveness, and compliance, the study shows the remarkable progress that has been made by the online industry in expanding the number and reach of companies involved, deploying new and innovative solutions for consumer transparency and choice, and strengthening the existing self-regulatory regime.
According to the study’s own findings, the NAI’s members enumerate their OBA activities in their privacy policies and comply with those policies. As the study affirms, “All NAI members mention their behavioral advertising activities, and all provide an opt-out mechanism.” Equally important, when testing a central feature of the NAI program, its consumer opt-out platform for more than 60 companies, the study found that the “NAI mechanism was able to set all opt-out cookies successfully.” Similarly, except for one company that was temporarily unable to set an opt out in one particular browser type, the study acknowledges that the new AboutAds opt out platform “worked with the other browsers” for all participating companies. Even if there is a rare technological glitch, these tools notify users when a particular company’s opt out is not set.
Beyond that, the study claims only one instance of non-compliance (out of 66 member companies) with respect to the requirement to disclose the type of data collected, and acknowledges that all NAI member companies are in compliance with the requirement to disclose how data collected will be used. We differ with the authors in their belief that any of the reviewed companies did not adequately make such disclosures.
We have a more substantive disagreement with the authors’ claims that several NAI members are not providing sufficient notice about how long they retain data for online behavioral advertising purposes. On this point, the study is not accurate, and we have provided the authors with excerpts from the policies of every NAI member in question showing their compliance with this requirement. For example, the authors claim that Yahoo does not disclose how long data will be retained. However, Yahoo!’s publicly-posted data storage policy explicitly states that “Yahoo!’s anonymization policy applies to user log file data and includes searches, ad views, ad clicks, page views and page clicks” and that “Yahoo! stores this data in an identifiable form for up to 90 days for most log file data.” Microsoft has made a similar public commitment: “Microsoft will no longer retain web log data in a profile used for display advertising for more than 13 months, unless a consumer consents to a longer retention period.” Other NAI members provide similar disclosures. Given that the NAI’s retention disclosure requirement is a best practice that exceeds current legal requirements, it’s particularly ironic that the authors have chosen to criticize the efforts of our members to provide robust consumer disclosures.
More importantly, the study ignores the many areas where the past year has seen dramatic – and ongoing – improvements in self-regulation. For example, nearly 3 million unique visitors viewed the NAI’s main web page in 2010, an increase of nearly 150% over the prior year. Use of the NAI’s opt-out tool increased by 58%, and traffic to the educational section of the NAI quadrupled to more than 500,000 unique visitors. This year, in the past two months alone, another 500,000 unique visitors have learned about online behavioral advertising through the NAI’s educational efforts.
Put another way, this study, and the NAI’s own data, validate that consumers who want to find out about their behavioral advertising choices are finding our site, reviewing our educational materials, and using the opt out platform itself.
Equally important, the NAI itself has dramatically extended its reach over the past year, increasing its membership from 35 companies a year ago more than 60 today. Our membership now includes all fifteen of the largest ad networks in the United States, the companies who enable and deliver the overwhelming majority of network ads to users. Moreover, the new DAA program (in which the NAI participates) offers other companies within the ecosystem another means participate in broader cross-industry self regulation. The study, quixotically, cites this remarkable growth in participation as a “problem,” on the grounds that consumers have more companies from which they can opt out using the “select all” feature of industry opt out tools. We think a reasonable observer would consider the rapid growth of participation in self-regulatory regimes to be a good thing for consumers.
Nor are skyrocketing usage and broad industry-wide participation the only significant changes. In the past several months, the online industry has started to deploy enhanced notice through the most effective device possible: an icon in or near the ads being delivered.
The study attacks the current state of deployment of that icon, as if trying to predict the final score of the game during the first inning, and it’s too early to make that claim. Indeed, just a week ago Google announced the implementation of the industry icon within its ads, joining MSN and Yahoo! as the industry’s three largest ad companies now using the icon. Other NAI member companies are now also participating in the rollout, offering advertisers the capability to incorporate the icon in or around their ads. The industry deserves enough time to make the technical changes necessary to integrate the icon, and users will become increasingly familiar with it across a wide range of advertising providers over coming months.
Companies that commit to self-regulatory programs are promoting transparency not just in the technologies they use for interest-based advertising, but also about the success of their compliance efforts. Practices in the online advertising marketplace are visible to consumers, policymakers, and privacy advocates, and we believe it is appropriate for others to evaluate the efficacy of self-regulatory initiatives. We also hope that at the same time equivalent efforts will be made to encourage any remaining companies outside current self-regulatory programs to join the collaborative industry initiative. That way, we can work towards ensuring the glass is full for all consumers.
Charles Curran
Executive Director
Network Advertising Initiative
