What's behind this announcement, what is "interest-based" advertising, and what modifications may be required for your privacy policy if you use this advertising option?



Contextual Advertising; Behavioral Advertising

In its beginning, Google AdSense pioneered in the field of contextual advertising. In simple terms, the goal of Google AdSense with contextual ads was to match the context of a website with relevant ads from the Google inventory of advertisers and to serve these ads to the site. Relevance was determined by the context of the site. So, for example a sports-related site would attract relevant ads for sporting goods.

Behavioral ads take relevancy a step or two deeper. Behavioral technology tracks a user's behavior on the Web, including sites visited, length of visits, content read, and searches made. All this data is then analyzed and a behavioral pattern is produced for a user which classifies that user by his or her online demographic. Behavioral ad networks then serve targeted ads that are relevant to that online demographic.

Google's new advertising approach clearly involves another pioneering effort -- this time into the field of behavioral advertising. Google's recent announcement regarding its "interest-based" ads states: "Interest-based advertising will allow advertisers to show ads based on a user's previous interactions with them, such as visits to advertiser website and also to reach users based on their interests (e.g. 'sports enthusiast'). To develop interest categories, we will recognize the types of web pages users visit throughout the Google content network. As an example, if they visit a number of sports pages, we will add them to the 'sports enthusiast' interest category."

The FTC Weighs In

Since behavioral ads facilitate the display of targeted and personalized online ads, they represent a more effective way to monetize free websites. This is a good thing.

The not-so-good thing - behavioral ads raise serious privacy concerns such as the lack of transparency regarding collection practices and the risk of disclosure of the information collected, particularly sensitive information.

The Federal Trade Commission (FTC) has been following the development of behavioral advertising with great interest. In November 2007, the FTC conducted a town hall discussion to discuss privacy issues raised by online behavioral advertising. Afterward, the FTC developed proposed principles based on comments received at the town hall discussions.

In February 2009, the FTC issued a staff report entitled "Self-Regulatory Principles For Online Behavioral Advertising" (Principles). It's important to note that the FTC report excluded from its Principles:

* "first party" behavioral advertising, in which a website collects consumer information to deliver targeted advertising at its site, but does not share any of that information with third parties, and

* contextual advertising, which targets advertisements based on the web page a consumer is viewing or a search query the consumer has made, and involves little or no data storage.

Included within the scope of the Principles is "third party behavioral advertising". The FTC report states: "If a website collects and then sells or shares data with third parties for purposes of behavioral advertising, or participates in a network that collects data at the site for purposes of behavioral advertising, however, such practices would remain within the scope of the Principles."

What's Required?

Given Google's specific language in its announcement - "we will recognize the types of web pages users visit throughout the Google content network" - it's clear that the new AdSense policy will involve third party behavioral advertising that is regulated by the Principles set out in the FTC report.

So, what's required? Here's a brief summary of the applicable Principles.

* Transparency and Consumer Control - provide consumers with clear notice if behavioral data is collected for behavioral advertising purposes. Consumers should be provided with a choice if data is collected that could be associated with a specific consumer or with a specific computer or device.

* Reasonable Data Security Measures and Limited Data Retention - provide consumers with reasonable data security measures. Data should be retained for only as long as necessary for legitimate business use or law enforcement requirements.

* Obtain Affirmative Consent Before Using Sensitive Data - sensitive data includes social security numbers and data about children, health, finances, sexual orientation, and precise geographic location.

* Obtain Express Affirmative Consent Before Making Material, Retroactive Changes - consumers are protected from the practice of collecting data under one set of policies and subsequently changing these policies to allow effective retroactively. For new policies to be effective retroactively, express, affirmative consent from affected consumers is required.

The Deadline Is April 8, 2009 For Google AdSense Users

Google states that if you use AdSense and its "interest-based advertising", you should make any necessary changes to your privacy policy by April 8, 2009. This does not leave much time for participating websites.

For many sites, strict compliance with the Principles of the FTC report may not be as simple as merely posting a new privacy policy notice regarding third party behavioral ads. This is due the fourth principle -- Obtain Express Affirmative Consent Before Making Material, Retroactive Changes. So, if data collected prior to the notice is going to be used in behavioral ads, prior, express, affirmative consent from the affected consumers is required.