A Battle Is Brewing Over Online Behavioral Advertising

There is a storm brewing in the online behavioral-advertising world, where consumer clicks are tracked and tabulated to help online advertisers better target promotional messages.

At this point, the argument boils down whether the rapidly evolving industry that makes its money advertising to people surfing the Web—and by figuring out exactly which ads those people want to see—should continue to be self-regulated with respect to consumer privacy rules, or whether state or federal legislators should step in to limit the amount of information that online advertisers such as Microsoft, Google and Yahoo can collect and use.

There are a number of factors at play. One is that the online advertising world has morphed dramatically since industry self-regulations were initially introduced in 2002, as has the technology that helps companies track consumer clicks (a consumer can be anyone online, not just shoppers).

For example, newer companies like Phorm have developed tools that can track every single click a person makes online by collecting clicks from a user's Internet service provider, which Phorm has been able to do through contracts with British telecommunications companies, to much consumer uproar. At the same time, consumers have become more aware of privacy issues related to Internet surfing—in every area from identity theft to outted shopping secrets on Facebook.

The question boils down to this: How much information—and what type of information—should companies be able to collect and utilize about people while they are online? The answers are not as forthcoming.

New York Assemblyman Richard Brodsky said behavioral advertising snips away individual privacy rights and should be regulated. He has introduced a bill in New York that would, in effect, establish an Internet advertising bill of rights for consumers. And because it would be difficult for online companies to adhere to legislation in one state without impacting interactions with consumers in other states, the New York legislation could well turn into a de facto national standard.

Brodsky said the bill is being sponsored in both the Senate and Assembly halls in Albany, N.Y.

"We're talking to people about it," he said. "This is a clear and pressing issue."

While it's difficult to determine the timeline of the legislation, Brodsky said the bill will likely change from its original form once he hears back from Microsoft, Google and Yahoo. "We want to see what their views are and what changes they want," he said.

The legislation has several main tenants geared toward online advertisers: To limit the use of "personally identifiable information about sensitive medical or financial data, sexual behavior or orientation, or social security number" for online preference marketing; to make "all reasonable efforts" to ensure information is collected from reliable sources and that the data is protected from "loss, misuse, alternation, destruction or improper access"; that any entity that collects or uses personally identifiable information post a "clear and conspicuous notice" on their Web site telling consumers about their data collection; and that consumers have a clear option for opting out of personal data collection activities.

Opponents of the New York legislation—there is a similar bill cooking in Connecticut—say the bill is lifted almost word-for-word from the prevailing self-regulation standards put forth by the Network Advertising Initiative, which are not adequate in the first place. NAI's mission it is to provide both information and a mechanism for consumers to monitor and control their online experience and to provide a platform for the development of standards and policies for online marketers, according to the group's Web site.

"The bill tracks extremely closely to the NAI initiative," said Alyssa Cooper, chief computer scientist with the Center for Democracy & Technology. "It looks to take self-regulation and put it into legislation. Is that appropriate? It depends on what the status of the self-regulatory scheme is."