NAI Blog

Earlier this week a Stanford graduate student posted a blog entry announcing “preliminary findings from experimental software” about how companies participating in the Network Advertising Initiative (NAI) handle opt outs to online behavioral advertising.

Unfortunately, these preliminary findings confuse the important distinction between longstanding “Do Not Target” choices offered by online advertisers, and new browser technologies that offer users the promise of not being “tracked.”

Under the NAI self-regulatory code, companies commit to providing an opt out to the use of online data for online behavioral advertising purposes. We’ve long recognized that consumers should be provided a choice about whether data about their likely interests can be used to make their ads more relevant. But the NAI code also recognizes that companies sometimes need to continue to collect data for operational reasons that are separate from ad targeting based on a user’s online behavior. For example, online advertising companies may need to gather data to prove to advertisers that an ad has been delivered and should be paid for; to limit the number of times a user sees the same ad; or to prevent fraud. Gathering this operational data may involve the use of cookies separate from those used to enable interest-based ad targeting, or to maintain a consumer’s opt out preference.

We want to be very clear that we are firmly committed to enforcing the NAI Code’s requirements that companies provide users with an opt out to behaviorally-targeted ads. As part of our annual review process, we routinely review a broad variety of inputs, including reports in the media and from advocates. The online medium is remarkably transparent, allowing for evaluation of company data collection practices and of the effectiveness of self regulation. If there are credible allegations of a violation of the NAI Code, we investigate them; and if there are violations, we report them.

However, it’s also important to draw a fair distinction between existing industry self regulatory commitments to limit ad targeting based on user interests, and the views of proponents of newly emerging “Do Not Track” technologies who argue that advertising companies should be stopped from collecting any data. We’ve been following with interest the recent introduction by browser manufacturers of “Do Not Track” features that promise in various degrees to limit browser data collection. A robust debate is going on about how these browser features might be integrated with the existing industry self-regulatory programs, but for now there is no universally agreed upon definition of what “Do Not Track” means.

Given the rapidly evolving nature of Internet technology, it’s entirely appropriate for self regulatory programs to evaluate how best to adapt these new browser technologies. But in order for consumers and companies to understand what is being offered on the “Do Not Track” playing field, the goal posts can’t be a moving target. More importantly, we should be clear about when rules changes will have profound consequences: prohibiting the gathering and use of operational data may inhibit the ability of companies to serve even non-targeted ads; impair efforts to stop fraud by bad actors; and seriously jeopardize the viability of advertising supported free content and services on the Web. There is a vital distinction between limiting the use of online data for ad targeting, and banning data collection outright. We look forward to being part of the dialogue about how best to define – and deploy – a “rulebook” for online choices that are not only consistent with consumers’ privacy expectations, but that also preserves the viability of ad-supported online services that millions of consumers enjoy every day.

-Chuck Curran, Executive Director, NAI

Adopting new best practices in a large industry like online advertising can seem a little like turning a large ship. At first, to the outside observer, it may not seem like much is happening, as the changes start slowly and the ship has its existing momentum to overcome. As the ship continues to turn, however, the new course becomes clear, and it can accelerate with ever-increasing momentum.

Today, the Digital Advertising Alliance (DAA) announced that the online advertising industry is fully turned onto the course of adoption of the “ad choices” icon, with broad participation by a hundred of the largest brand marketers, agencies and ad networks.

Not surprisingly, members of the Network Advertising Initiative (NAI) have been among the leaders in adopting, promoting, and distributing the icon to consumer advertisers. Dozens of NAI members have enabled the use of the icon on the ads they serve today, or are rolling it out with their advertising partners within the coming weeks.

Showing that the industry is moving from development to deployment, the DAA also announced that enhanced notice using the “ad choices” icon has been served with more than 2 trillion ads. The icon is visible not just on ads served by NAI companies, but also on the sites of NAI members like Microsoft and Yahoo! that are also Web publishers. If you haven’t already seen the icon, you will soon see if far more across hundreds of other sites as this rollout reaches full deployment.

For anyone who wants to see the changes taking place in the online advertising industry to provide consumers with ubiquitous access to enhanced notice and choice, you won’t have to look far for the “ad choices” icon.

-Chuck Curran, Executive Director

A study released yesterday by several privacy researchers outlines the authors’ efforts to assess the notice and compliance requirements implemented by the NAI and Digital Advertising Alliance (DAA) as part of our respective self-regulatory programs. The study makes a number of assertions at the margins to which we take exception, in particular the claim that some NAI members are not providing sufficient notice about their collection and retention practices for online behavioral advertising.

On the whole, however, we think the study shows how robust and far-reaching the industry’s self-regulatory regimes have become, and we believe the authors may have missed that forest by peering too closely at the bark of the trees.

In fact, on core issues of self-regulation like reach, effectiveness, and compliance, the study shows the remarkable progress that has been made by the online industry in expanding the number and reach of companies involved, deploying new and innovative solutions for consumer transparency and choice, and strengthening the existing self-regulatory regime.

According to the study’s own findings, the NAI’s members enumerate their OBA activities in their privacy policies and comply with those policies. As the study affirms, “All NAI members mention their behavioral advertising activities, and all provide an opt-out mechanism.” Equally important, when testing a central feature of the NAI program, its consumer opt-out platform for more than 60 companies, the study found that the “NAI mechanism was able to set all opt-out cookies successfully.” Similarly, except for one company that was temporarily unable to set an opt out in one particular browser type, the study acknowledges that the new AboutAds opt out platform “worked with the other browsers” for all participating companies. Even if there is a rare technological glitch, these tools notify users when a particular company’s opt out is not set.

Beyond that, the study claims only one instance of non-compliance (out of 66 member companies) with respect to the requirement to disclose the type of data collected, and acknowledges that all NAI member companies are in compliance with the requirement to disclose how data collected will be used. We differ with the authors in their belief that any of the reviewed companies did not adequately make such disclosures.

We have a more substantive disagreement with the authors’ claims that several NAI members are not providing sufficient notice about how long they retain data for online behavioral advertising purposes. On this point, the study is not accurate, and we have provided the authors with excerpts from the policies of every NAI member in question showing their compliance with this requirement. For example, the authors claim that Yahoo does not disclose how long data will be retained. However, Yahoo!’s publicly-posted data storage policy explicitly states that “Yahoo!’s anonymization policy applies to user log file data and includes searches, ad views, ad clicks, page views and page clicks” and that “Yahoo! stores this data in an identifiable form for up to 90 days for most log file data.” Microsoft has made a similar public commitment: “Microsoft will no longer retain web log data in a profile used for display advertising for more than 13 months, unless a consumer consents to a longer retention period.” Other NAI members provide similar disclosures. Given that the NAI’s retention disclosure requirement is a best practice that exceeds current legal requirements, it’s particularly ironic that the authors have chosen to criticize the efforts of our members to provide robust consumer disclosures.

More importantly, the study ignores the many areas where the past year has seen dramatic – and ongoing – improvements in self-regulation. For example, nearly 3 million unique visitors viewed the NAI’s main web page in 2010, an increase of nearly 150% over the prior year. Use of the NAI’s opt-out tool increased by 58%, and traffic to the educational section of the NAI quadrupled to more than 500,000 unique visitors. This year, in the past two months alone, another 500,000 unique visitors have learned about online behavioral advertising through the NAI’s educational efforts.

Put another way, this study, and the NAI’s own data, validate that consumers who want to find out about their behavioral advertising choices are finding our site, reviewing our educational materials, and using the opt out platform itself.

Equally important, the NAI itself has dramatically extended its reach over the past year, increasing its membership from 35 companies a year ago more than 60 today. Our membership now includes all fifteen of the largest ad networks in the United States, the companies who enable and deliver the overwhelming majority of network ads to users. Moreover, the new DAA program (in which the NAI participates) offers other companies within the ecosystem another means participate in broader cross-industry self regulation. The study, quixotically, cites this remarkable growth in participation as a “problem,” on the grounds that consumers have more companies from which they can opt out using the “select all” feature of industry opt out tools. We think a reasonable observer would consider the rapid growth of participation in self-regulatory regimes to be a good thing for consumers.

Nor are skyrocketing usage and broad industry-wide participation the only significant changes. In the past several months, the online industry has started to deploy enhanced notice through the most effective device possible: an icon in or near the ads being delivered.

The study attacks the current state of deployment of that icon, as if trying to predict the final score of the game during the first inning, and it’s too early to make that claim. Indeed, just a week ago Google announced the implementation of the industry icon within its ads, joining MSN and Yahoo! as the industry’s three largest ad companies now using the icon. Other NAI member companies are now also participating in the rollout, offering advertisers the capability to incorporate the icon in or around their ads. The industry deserves enough time to make the technical changes necessary to integrate the icon, and users will become increasingly familiar with it across a wide range of advertising providers over coming months.

Companies that commit to self-regulatory programs are promoting transparency not just in the technologies they use for interest-based advertising, but also about the success of their compliance efforts. Practices in the online advertising marketplace are visible to consumers, policymakers, and privacy advocates, and we believe it is appropriate for others to evaluate the efficacy of self-regulatory initiatives. We also hope that at the same time equivalent efforts will be made to encourage any remaining companies outside current self-regulatory programs to join the collaborative industry initiative. That way, we can work towards ensuring the glass is full for all consumers.

Charles Curran
Executive Director
Network Advertising Initiative

The Department of Commerce’s Internet Policy Task Force recently initiated a comprehensive review of the nexus between privacy and innovation in the Internet economy, seeking public comment from all Internet stakeholders. The Department intends to analyze the comments received and then issue a report that will contribute to the Administration’s domestic policy and international engagement in the area of Internet commerce.

The NAI yesterday filed comments with the Department addressing specific questions posed in its Notice of Inquiry as applied in the context of online behavioral advertising. Our comments discuss how the free flow of data has been critical to innovation on the Internet by enabling advertising models that permit increasingly diverse content and services to be offered to consumers free of charge. We then address some of the Department’s questions with respect to the U.S. privacy framework going forward, with particular emphasis on the importance of self-regulation. Finally, we describe privacy-enhancing technologies that have recently been developed by the NAI and its member companies to offer consumers greater transparency and choice with respect to the collection and use of data for online advertising, including the development of technical specifications for in-ad notice, ad preference managers developed by various NAI member companies, and the NAI’s durable opt-out protector.

The NAI’s comments can be found here. We look forward to working with the Department and other policymakers in addressing these important issues.

–Meredith Halama, NAI Assistant General Counsel, Policy

Today the NAI is releasing a first-of-its-kind study about the economic value of behavioral advertising.   The study was conducted by former FTC Consumer Protection Bureau Chief Howard Beales, based on data from twelve NAI members with total ad revenue of $3.32 billion in 2009. Read the study and the NAI’s accompanying press release.

The study finds that behavioral-targeted ads sell for twice the price and offer twice the effectiveness of ordinary run-of-network advertising.   This added revenue flows back to publishers: the survey found that more than half (54.6%) of revenue went towards the purchase of advertising inventory. The study also finds that behavioral advertising revenue accounted for an average of 17.9% of the survey respondents’ overall revenue.
 
The Beales/NAI study highlights the importance of behavioral targeting to the advertising model that supports free online content and services for consumers.  The growing significance of behavioral advertising as a source of revenue for Internet content and services providers underscores the need for careful consideration of policies that would affect the current advertising marketplace and the innovation it supports.
 
We hope that this new economic data will help inform the public policy debate, and the NAI will be filing the study as a comment for the FTC’s “Exploring Privacy” Roundtable process.

Chuck Curran
NAI Executive Director

For its third town hall on online privacy issues, the FTC asked for comment from the online advertising industry and other interested parties on how we could achieve accountability for best practices or standards for commercial handling of data.  The NAI filed comments on that issue last week that we thought might be of interest. NAIFTCThirdRoundtableComments

Our comments focus on how the NAI’s self-regulatory program helps ensure compliance by the 40 companies who have pledged to abide by the NAI’s code for online behavioral advertising.  We also review how the NAI’s compliance process serves as an effective “first line” of accountability that helps the government by allowing it to focus its enforcement efforts on emerging privacy threats and true “bad actors.”  We also discuss the breadth of participation in the NAI’s compliance program by companies in the OBA marketplace and how such broad participation in self regulation promotes continued technological innovation for consumer privacy protection and the adoption of best practices.  We encourage you to take a look and see what you think.

–Chuck Curran, NAI Executive Director