EU and U.S. industry self-regulation of online behavioral advertising (OBA)...

to the head of the EU Article 29 Data Protection Working Party and the director of the FTC Bureau of Consumer Protection. The TACD forwarded a June resolution setting out recommendations for actions they want the EU and U.S. to take to counter what they see as privacy threats from new forms of online advertising and data collection. The current self-regulatory approach in Europe and the U.S. is inadequate and fails to address digital data collection practices used to identify online users, the organization told the working party and FTC. Both systems rely mostly on the use of an icon to provide notice of some data collection practices, but icons aren’t enough to tell users about the wide range of collection practices they face, the TACD said. Industry research on the icon-based program already shows that very few users click on it, let alone decide to opt out of having their personal information collected, it said. But the icon is “the foundation of what’s supposed to be a robust program of ‘best’ practices that can effectively empower users to make critical choices about their online privacy,” it said. The TACD said it agrees with the working party that Europe’s self-regulatory system uses an inadequate definition of OBA as “non-personal” data, as does the U.S. program. The advertising industry and trade associations know that OBA allows for tracking and profiling individuals, making the data “deeply personal,” it said. Consumers who click the icon are first dissuaded from taking measures to guard their privacy because they're told that online profiling is chiefly about giving them “appropriate” advertising, isn’t personal and supports their access to a “free” Internet, TACD said. Users aren’t told they'll still be tracked and profiled even if they opt out under a product or data collection service provider category, it said. Under both self-regulatory regimes, sensitive data can be gathered without ensuring users have real opportunities to protect how it’s used, it said. The working party and FTC are “well aware of current and complex OBA related practices” on both sides of the Atlantic such as mobile and online video and social network data used for real-time profile-based targeting, it said. Ad networks and exchanges now routinely integrate a wide range of data on individual users, often in real time, it said. These increasingly standard practices aren’t addressed by self-regulation, it said. The Digital Advertising Alliance in the U.S. and Interactive Advertising Bureau Europe/European Advertising Standards Alliance have created systems principally designed to allow expansion of OBA-related data practices, it said. Consumer groups aren’t opposed to digital marketing, but want to ensure that users’ privacy rights are protected, it said. That’s why the TACD recommended, among other things, that the EU and U.S.: (1) Investigate and act promptly as needed to address new threats to consumer privacy from the growth of real-time tracking and sales of information about people’s online activities on ad exchanges. (2) Commit to developing a global standard for privacy protection and consumer welfare in the digital environment. (3) Ensure that existing personal data protection laws are enforced. (4) Address the constantly evolving techniques advertisers use to profile online users. IAB Europe and the working group will meet Wednesday to discuss the issue, a spokesman for the European Consumers’ Organization said (BEUC). The EU shouldn’t accept the advertising industry’s attempts to redefine people’s Internet usage as non-personal data, BEUC Director General Monique Goyens said. There should be a clear line drawn “as this billion dollar industry is now the currency of the Digital Age,” she said.