Advertising Law Blog

The FTC recently issued its Final Privacy Report, "Protecting Consumers Privacy in an Era of Rapid Change: Recommendations For Businesses and Policymakers". The Report sets forth best practices for businesses regarding users' personal data.

The final privacy report expands on a preliminary December 2010 staff report. The final report calls on companies handling consumer data to implement recommendations for protecting privacy, including:

• Privacy by Design - companies should build in consumers' privacy protections at every stage in developing their products. These include reasonable security for consumer data, limited collection and retention of such data, and reasonable procedures to promote data accuracy;
• Simplified Choice for Businesses and Consumers - companies should give consumers the option to decide what information is shared about them, and with whom. This should include a Do-Not-Track mechanism that would provide a simple, easy way for consumers to control the tracking of their online activities.
• Greater Transparency - companies should disclose details about their collection and use of consumers' information, and provide consumers access to the data collected about them.

The report refines guidance regarding providing consumers with choice. The FTC clarifies its position that choice should depend on the extent to which the practice is consistent with the context of the transaction (such as product fulfillment) or the consumer's existing relationship with the business or is required or specifically authorized by law (such as fraud prevention).

While the report stopped short of calling for "do not track" legislation, the report places significant heat on data brokers such as Lexis Nexis, Experian, Acxiom, and U.S. Search, to create a centralized website where consumers can get information about their data collection practices and their options for controlling data. The report also reiterates FTC's support for legislation that would provide consumers with access to the personal and financial information held by data brokers.

The report also includes a small business exemption which provides that the framework should not apply to companies that collect and do not transfer only non-sensitive data from fewer than 5,000 consumers a year.

Take away: The FTC's continuing focus on providing consumers with notice and the ability to opt-out is a strong signal to industry that it should address this issue proactively or face legislation. Given the significance of targeted advertising which relies on the data, the issue is critical for online advertising.