By Mehmet Munur
The Federal Trade Commission announced an enforcement
action today against an online advertising network that restarted tracking of users 10 days after those users had opted out of online tracking. This is likely the first FTC enforcement action in the behavioral tracking context and likely the first time browser cookies played a central role in an FTC enforcement action. The enforcement action sets a serious precedent for importance of making accurate statements regarding the use of behavioral tracking and following through on those statements.
The consent order also includes numerous requirements regarding the deletion of data, displaying new notices regarding the opt-out, and developing a method of opting out apart from the controls already present in users’ browsers. Clearly, the FTC remains willing to bring enforcement actions against online practices it believes to be deceptive, regardless of congressional action in the field of online behavioral tracking and regardless of how small the harm may seem.
is an online advertising network and works in the field of online behavioral targeting. Chitika tracks its users with the aid of browser tracking cookies placed on a user’s device. Chitika adds information to the tracking cookie about the user’s browsing activities after it is set and uses this information to serve the user with relevant advertisement. However, this tracking, according to the FTC, is “not visible to the consumer, unless the consumer uses sophisticated web diagnostics tools.” Furthermore, the FTC was concerned that the tracking would continue indefinitely so long as the user visited a website using the Chitika network with the same browser.
played a central role. It stated:
After users clicked the opt-out button, Chitika told the user that they were opted out. However, these opt-out cookies expired after 10 days and Chitika restarted tracking after this time. Users were not told that the opt-out cookie would expire after 10 days. The FTC concludes that Chitika represented “expressly or by implication, that when consumers opt out of targeted advertising by Chitika, such opt-out [would] last for a reasonable period of time.” The fact that the tracking resumed after 10 days, resulted in deception in the FTC’s view.
The consent order
that followed the FTC investigation requires Chitika not to
misrepresent in any manner, expressly or by implication: (A) the extent to which consumers may exercise control over the collection, use, disclosure, or sharing of data collected from or about them, their computers or devices, or their online activities, or (B) the extent to which data from or about a particular consumer, computer, or device is collected, used, disclosed, or shared.
The consent order also requires Chitika to place disclosures on its websites about the expired opt out and
provide a mechanism, separate and apart from any preferences or controls offered by consumers’ browsers, to enable Chitika users to prevent respondent from collecting data that can be associated with a Chitika user or a Chitika user’s computer or device, or that contains any unique identifier, including Chitika user ID or Internet Protocol (IP) address; from redirecting Chitika users’ browsers to third parties that collect data, absent a click or other affirmative action by such Chitika user; and from associating any previously collected data with any Chitika user’s computer or device. This mechanism shall require no more than one additional click for consumers to exercise their choice(s), and shall remain in effect for a minimum time period of five (5) years, unless the consumer deletes his or her cookies or takes deliberate action to disable the mechanism.
Finally, within 90 days, Chitika must include a link in its ads to the website that would allow individuals to opt out of the tracking. Chitika must also destroy all IP addresses and unique identifiers and all information stored in user’s cookies.
This most recent enforcement action from the FTC is not unexpected. FTC recently released the Do Not Track report
that we blogged
about. There, the FTC stated that consumers should be entitled to choice about online behavioral tracking and that
The most practical method of providing such universal choice would likely involve the placement of a persistent setting, similar to a cookie, on the consumer’s browser signaling the consumer’s choices about being tracked and receiving targeted ads. Commission staff supports this approach, sometimes referred to as “Do Not Track.”
Thus, the Chitika enforcement action is completely in line with the persistent online tracking choices that FTC would like to encourage.
The FTC now reiterates its willingness to change practices in the arena of online behavioral tracking by putting the cookies center stage. It is also noteworthy that the enforcement action comes before the Do Not Track report is finalized. After all, that report was a preliminary report.
As a result, statements and practices about cookies, especially behavioral tracking cookies, are now more important than ever. These practices will only increase in importance as the FTC reviews all the comments relating to its report and issues a final report. It appears that regardless of legislation in this area, the FTC will continue to bring enforcement actions against deceptive practices relating to behavioral tracking.
Labels: behavioral advertising, Cookie, Enforcement Action, Federal Trade Commission, FTC