The United States Federal Trade Commission (FTC) has been involved in oversight of the behavioral targeting techniques used by online advertisers since the mid-1990s. These techniques, initially called "online profiling", are now referred to as "behavioral targeting"; they are used to target online behavioral advertising (OBA) to consumers based on preferences inferred from their online behavior. During the period from the mid-1990s to the present, the FTC held a series of workshops, published a number of reports, and gave numerous recommendations regarding both industry self-regulation and Federal regulation of OBA. In late 2010, the FTC proposed a legislative framework for U.S. consumer data privacy including a proposal for a "Do Not Track" mechanism. In 2011, a number of bills were introduced into the United States Congress that would regulate OBA.H.R. 654, Rep. Jackie Speier (D-CA), Do Not Track Me Online Act of 2011, http://speier.house.gov/uploads/Do%20Not%20Track%20Me%20Online%20Act.pdf , Sen. John Kerry (D-MA), cosponsor Sen. John McCain (R-AZ), Commercial Privacy Bill of Rights Act of 2011 (April 12, 2011), http://kerry.senate.gov/work/issues/issue/?id=74638d00-002c-4f5e-9709-1cb51c6759e6&CFID=86949172&CFTOKEN=10485539

Early history “The Federal Trade Commission has been involved in addressing online privacy issues for almost as long as there has been an online marketplace.”FTC, Privacy Online: A Report to Congress (June 1998), http://www.ftc.gov/reports/privacy3/priv-23a.pdf The FTC is now responsible for the enforcement of a number of sector-specific privacy statues, including the Gramm-Leach-Bliley Act, the Children's Online Privacy Protection Act, the CAN-SPAM Act of 2003, and the Telemarketing and Consumer Fraud and Abuse Prevention Act (“Do Not Call Rule”).

In 1995,FTC Staff Report, Public Workshop on Consumer Privacy on the Global Information Infrastructure, Dec. 1996, http://www.ftc.gov/reports/privacy/Privacy1.shtm . 1996, and 1997See - FTC, FTC Announces Two Significant Efforts In Its Comprehensive Examination Of Consumer Privacy (March 4, 1997), http://www.ftc.gov/opa/1997/03/conspriv.shtm . the FTC held public workshops exploring consumer data privacy issues. At these workshops, online advertising industry advocates pressed for self-regulation, while privacy advocates argued that self-regulation could only be successful when backed up by “legally enforceable rights to information privacy”.FTC Staff Report, Public Workshop on Consumer Privacy on the Global Information Infrastructure (December 1996), at 2, http://www.ftc.gov/reports/privacy/Privacy1.shtm . Industry lobbyists argued for opt-out, which allows companies to use personal information for the purposes stated in a privacy policy or other form of notification, unless the consumer “opts-out” and notifies the company not to use the personal information in a certain manner, such as for marketing. Privacy advocates argued for prior affirmative consent, and suggested that software could be used by consumers to communicate their privacy preferences automatically.

In 1998, the FTC released a report in which it undertook a comprehensive review of commercial websites’ disclosures of their privacy practices and laid out the Fair Information Practice Principles (FIPPs). The report concluded that, “[a]s evidenced by the Commission’s survey results, and despite the Commission’s three-year privacy initiative supporting a self-regulatory response to consumers’ privacy concerns, the vast majority of online businesses have yet to adopt even the most fundamental fair information practice (notice/awareness)”.FTC, Privacy Online: A Report to Congress (June 1998), at 41, http://www.ftc.gov/reports/privacy3/priv-23a.pdf .

The FTC held a further public workshop in 1999,FTC Press Release, FTC and Commerce Dept. to Hold Public Workshop on Online Privacy (September 15, 1999), http://www.ftc.gov/opa/1999/09/profiling.shtm . and in May 2000, released a report which for the first time recommended that Congress pass online privacy legislation to create a basic level of data privacy protection for consumer-oriented commercial web sites.FTC, Privacy Online: Fair Information Practices in the Electronic Marketplace (May 2000), http://www.ftc.gov/reports/privacy2000/privacy2000.pdf.

In July 2000, the FTC recommended for the first time that legislation should be passed to protect Internet user’s privacy vis-à-vis online profiling.FTC, Online Profiling: A Report To Congress, Part 2 Recommendations (July 2000), at 11, http://www.ftc.gov/os/2000/07/onlineprofiling.pdf . The FTC further stated that “backstop legislation addressing online profiling is still required to fully ensure that consumers’ privacy is protected online” and recommended that [technology neutral] legislation be passed that created a basic level of privacy protection for users of “consumer-oriented commercial websites with respect to profiling”.FTC, Online Profiling: A Report To Congress, Part 2 Recommendations (July 2000), at 10, http://www.ftc.gov/os/2000/07/onlineprofiling.pdf . Under the FTC’s 2000 proposal, all online advertising networks and consumer-oriented commercial websites that allowed the collection of information from or about consumers would be required to implement and comply with the FIPPs.

Congress did not enact the FTC’s recommended legislation, and another decade would pass before the FTC again proposed legislation to regulate OBA.FTC, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers (December 1, 2010), http://www.ftc.gov/os/2010/12/101201privacyreport.pdf.

FTC Commissioner Timothy Muris turned the FTC’s attention away from online privacy and OBA regulation in 2001, stating, “[t]he slowing of the growth of the Internet emphasizes the need to understand the cost of online privacy legislation…At this time, we need more law enforcement, not more laws”.Timothy J. Muris, Protecting Consumers' Privacy: 2002 and Beyond, Remarks delivered at the Privacy 2001 Conference (October 4, 2001), http://www.ftc.gov/speeches/muris/privisp1002.shtm .

Return to regulatory focus

In 2006 the FTC once again took up the mantle of online privacy protection at the November 2006 FTC forum, “Tech-ade”, which examined the “key technological and business developments that will shape consumers’ core experiences in the coming ten years”.FTC, Protecting Consumers in the Next Tech-ade: A Report by the Staff of the Federal Trade Commission (March 2008), http://www.ftc.gov/os/2008/03/P064101tech.pdf. Participants at the forum described how technological advances in online profiling (now called “behavioral” advertising, targeting, or marketing), had allowed the practice to become more widespread and efficient.FTC Staff Report, Self-Regulatory Principles For Online Behavioral Advertising, Behavioral Advertising Tracking, Targeting, & Technology (February 2009), at 8, .

Building on the Tech-ade hearings, the FTC hosted a town hall meeting in November 2007 focused specifically on the privacy implications of behavioral advertising practices called, “Behavioral Advertising: Tracking, Targeting, and Technology”.FTC, Town Hall, Behavioral Advertising: Tracking, Targeting, and Technology, http://www.ftc.gov/bcp/workshops/ehavioral/index.shtml. The public meeting was prompted, in part, by the growth of behavioral advertising and the interest of large Internet companies in using such techniques to deliver narrowly targeted ads. These developments included Google’s plans to acquire DoubleClick, AOL’s interest in Tacoda, and Microsoft and Yahoo’s continued expansion of their own behavioral advertising products.See FTC to Examine Consumer Tracking Practices Used by Online Ad Industry, 6 PVLR 1275 (2007). They also included a presentation by eBay with a live demonstration of the ebay.com website, highlighting the first on ad links enabling consumers to opt out of behavioral ads via an eBay program called AdChoice.

In December 2007, the FTC promulgated a set of proposed “Principles” intended to provide a basis for the online advertising industry’s self-regulatory efforts to address privacy concerns.FTC, Online Behavioral Advertising Moving the Discussion Forward to Possible Self-Regulatory Principles (December 2007), http://www.ftc.gov/os/2007/12/P859900stmt.pdf . The Principles “call for companies to obtain affirmative express consent from consumers before they use data in a manner that is materially different than promised at the time of collection and before they collect and use 'sensitive' consumer data for behavioral advertising”.FTC, Online Behavioral Advertising Moving the Discussion Forward to Possible Self-Regulatory Principles (December 2007), at 5, http://www.ftc.gov/os/2007/12/P859900stmt.pdf .

The FTC followed up this 2007 report with a further report in 2009, which further clarified the self-regulatory principles.FTC Staff Report, Self-Regulatory Principles For Online Behavioral Advertising, Behavioral Advertising Tracking, Targeting, & Technology (February 2009), . At the time, a coalition of consumer groups proposed a “Do Not Track List” in their comments to the 2007 town hall meeting.FTC Staff Report, Self-Regulatory Principles For Online Behavioral Advertising, Behavioral Advertising Tracking, Targeting, & Technology (February 2009), at 32, .

The FTC’s 2010 report

In a December 2010 report, the FTC proposed a new regulatory framework for consumer data privacy, including a proposal for a “Do Not Track” mechanism which would allow Internet users to opt out of OBA.

In the report the FTC describes the limitations of the existing notice and choice model, which it states, “have become increasingly apparent in recent years”.FTC, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers (December 1, 2010), at 19, http://www.ftc.gov/os/2010/12/101201privacyreport.pdf. The FTC states that the notice and choice-based model, “encourages companies to develop privacy notices describing their information collection and use practices to consumers, so that consumers can make informed choices”.FTC, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers (December 1, 2010), at iii, http://www.ftc.gov/os/2010/12/101201privacyreport.pdf. However, “the notice-and-choice model, as implemented, has led to long, incomprehensible privacy policies that consumers typically do not read, let alone understand. Likewise, the harm-based model has been criticized for failing to recognize a wider range of privacy-related concerns, including reputational harm or the fear of being monitored”.

In order to address the issues with the notice-and-choice-based model, the FTC’s proposed privacy framework calls on companies to provide consumers with a meaningful choice in regards to OBA tracking, but sets forth “a limited set of data practices for which choice is not necessary” called “commonly accepted practices”.FTC, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers (December 1, 2010), at 53, http://www.ftc.gov/os/2010/12/101201privacyreport.pdf. The commonly accepted practices include: Product and service fulfillment, internal operations, fraud prevention, legal compliance and first-party marketing, including contextual marketing.FTC, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers (December 1, 2010), at 53 – 55, see also note 134 at 55, http://www.ftc.gov/os/2010/12/101201privacyreport.pdf.