Comments on FTC Behavioral
In December 2007, the Federal Trade Commission released a
paper titled "Online Behvioral Advertisement: Moving the Discussion Forward
to Possible Self-Regulatory Principles" (See:
Self-Regulatory Principles on Behavioral Advertising
). It included four
transparency and consumer control
reasonable security and data retention
consent for changes to existing privacy policies
consent to using sensitive data for behavioral
The FTC called for comments and many companies and
organisations sent statements (they can be found at
commentators agreed that the principles were a good start for the discussion,
but also critized several aspects. Google said the principles are overly
burdensome and too broadly defined.
As in Europe, Google sticks to its opinion that the IP adress
is not a personally identifying information. The paper does not
differentiate between personally identifying information and not personally
identifying information.This would be a big problem: Principle 3 e.g.
requires affirmative express consent for material changes to an online
should they be asked for their consent?
Principle 4 would either require the affirmative consent, or
simply prohibit, collection of sensitive personal data for behavioral
advertising. Google criticises that "sensitive data" is not defined: ”As
a result, Principle 4 would not allow Google to collect a search query for
“cancer treatment” or “alcoholics anonymous” from unauthenticated users
because we do not have any relationship with an unauthenticated user and we
have no way to obtain that user’s consent – affirmative and express or
otherwise – prior to collecting the search query."