Comments Of Nebuad, Inc., On The Ftc/'s Proposed Behavioral ...
UNITED STATES OF AMERICA
BEFORE THE FEDERAL TRADE COMMISSION
____________________________________
)
In the Matter of
)
)
Proposed Self-Regulatory Principles for
)
Online Behavioral Advertising; Request
)
For Com
ments
)
____________________________________)
COMMENTS OF NEBUAD, INC., ON THE COMMISSION STAFF’S
PROPOSED SELF-REGULATORY PRINCIPLES
FOR ONLINE BEHAVIORAL ADVERTISING
NebuAd, Inc. (“NebuAd”) hereby submits these comments to assist Federal Trade
Commission (“FTC” or “Commission”) Staff in its consideration of the appropriateness
and feasibility of its proposed self-regulatory principles for online behavioral advertising.
NebuAd appreciates the opportunity to comment on these proposed principles and
appreciates the Commission Staff’s interest in fostering effective self-regulation of
behavioral advertising generally.
1. Behavioral
Advertising
Today
Online behavioral advertising is a relatively new advertising mechanism that has, to date,
exhibited an extraordinary capacity to deliver targeted advertising to consumers and to
provide an enhanced revenue stream for web publishers and others. This advertising
revenue has been a significant driver in the ability of publishers to deliver their content
and for consumers to have an expansive array of free content to view. In fact, the
Commission Staff has noted the potential benefits of behavioral advertising: “access to
newspapers and information from around the world, provided free because it is
subsidized by online advertising; tailored ads that facilitate comparison shopping for the
specific products that consumers want; and, potentially, a reduction in ads that are
irrelevant to consumers’ interests and that therefore may be unwelcome.”1
There are several models of online behavioral advertising today and likely many more to
emerge in coming years. Advertising networks, for example, which partner with
publishers to deliver relevant advertisements to consumers who visit their websites, have
existed for several years and shown exceptional promise in helping so much content on
the Internet remain free. More recently, a new form of advertising targeted to consumers’
likely interest in commercial categories has arisen; this model involves companies, like
1
See “Online Behavioral Advertising: Moving the Discussion Forward to Possible Self-Regulatory
Principles” (“FTC Staff Principles”), at p. 2, available at http://www.ftc.gov/os/2007/12/P859900stmt.pdf.
NebuAd, that partner with Internet service providers (“ISPs”) to deliver tailored
advertising to their subscribers, based on their activity while they are online.2
In examining these and other business models and in developing self-regulatory
principles for behavioral advertising, two principles consistent with the FTC’s mission
are critical:
First, any self-regulatory regime must be technology-neutral, allowing companies
that engage in behavioral advertising through different technologies to operate on
a level playing field. This principle also will enable the self-regulatory principles
to capture new behavioral advertising technologies as they arise, and, very
importantly, provide consumers with similar expectations of privacy protections
over time.
Second, the self-regulatory principles must be provider-neutral and publisher-
neutral. The Commission Staff should not inadvertently skew the marketplace by
adopting proposed self-regulatory principles that foster a regime where some
types and sizes of companies enjoy the benefits of behaviorally-targeted ad
revenue, while others do not.
NebuAd agrees with the Commission Staff that the self-regulatory principles that emerge
from this process must rest within an overall framework that promotes transparency,
consumer control, limited use of sensitive information, limited data storage, and strong
security. Any set of final proposals for self-regulation, however, should focus on the
ultimate goal – preventing consumer harm – and not on regulating different behavioral
advertising technologies and companies in different ways based simply on the underlying
technology used or individual entities involved. The principles must be consistent with
the twin objectives of technology-neutrality and provider and publisher-neutrality.
NebuAd’s comments below are directed at the FTC Staff’s proposed principles that are
most closely related to NebuAd’s business model.
2.
The Commission Staff’s Proposals
A.
The Staff’s Definition of Behavioral Advertising
The FTC Staff’s proposed principles use a broad definition of behavioral advertising:
“the tracking of a consumer’s activities online – including the searches the consumer has
2
NebuAd’s business model is to anonymously identify ISP subscribers via a one-way hash of
unique identifiers and to map against the anonymous identification, not the raw data, but only the fact that
the user qualifies for certain product interest segments. NebuAd’s production system retains some
aggregated non-personally identifiable information for research and reporting purposes; such information is
not mapped or mappable to the anonymous identifier.
2
conducted, the web pages visited, and the content viewed – in order to deliver
advertisements targeted to the consumer’s interests.”3
NebuAd believes that this definition may be too broad, thus unnecessarily capturing some
activities that pose little if any risk of harm to increased self-regulatory standards. For
example, contextual advertising is distinguishable from behavioral advertising, and
should probably operate under a separate self-regulatory regime. To this end, the Staff
may consider whether the definition of behavioral advertising could be such that near-
instantaneous use of non-personally identifiable information – without the long-term
storage of any of the raw data observed – could be treated under a framework that is
separate from the framework that ultimately applies to those that store any observed raw
data for a significant period of time. Similarly, the Staff may also consider whether
behavioral advertising that does not use personally identifiable information to deliver
advertisements should operate in a self-regulatory regime that is separate from a
framework that ultimately applies to behavioral advertising that directly uses personally
identifiable information to deliver advertisements.
B.
Transparency and Consumer Control
Regardless of the form behavioral advertising takes, NebuAd agrees with the
Commission Staff that transparency and consumer control are important parts of a self-
regulatory regime. As stated above, we believe that these principles should be kept
general to allow different business models using different technologies to meet them in a
manner that is appropriate for their model. To the extent that self-regulatory principles
articulate differing standards for notice and consumer control based on the underlying
technology, the regime will have the effect of giving an advantage to one form of
technology – and the companies that use it and benefit from it – over companies that use
and benefit from differing technologies for the same purpose. This would limit
competition and stifle innovation for a nascent and promising industry.4
NebuAd’s business model gives it and its ISP partners a great deal of flexibility to deliver
direct notice to ISP subscribers regarding NebuAd’s service and to provide consumers
with the opportunity exercise control by opting-out. NebuAd welcomes the opportunity
to work with FTC Staff, industry associations, and privacy advocates to develop the self-
regulatory principle for notice that is appropriate for its business model.
3
See Staff Principles at p. 2.
4
NebuAd’s business is mainly focused on adding value to the large number of smaller web sites,
which today do not have enough mass of visitors or frequency of user visits to be able to develop
behavioral advertising themselves. In addition, NebuAd’s business model provides a revenue share with
ISPs. In the United States today, there are hundreds of ISPs of all sizes that must spend considerable
amounts to increase their bandwidth to cope with the growth of the Internet, particularly the recent growth
of video moving across the Internet. To impede NebuAd’s behavioral advertising model by means of self-
regulatory standards that are not technology-neutral and provider and publisher-neutral would be to
inadvertently discriminate against small web publishers and to deny the benefits of the online advertising
revolution to ISPs.
3
NebuAd has a single proposal related to the proposed transparency principle. The
Commission Staff has proposed that behavioral advertising companies provide notice of
their practices to consumers on every website on which data is collected for behavioral
advertising purposes. This proposal is apparently addressed to behavioral advertising
companies that, unlike NebuAd, have direct relationships with those websites, typically
as part of a network. Because NebuAd works through ISPs and other ad networks and
does not necessarily have direct relationships with the websites consumers visit, it has no
way to require them to post the proposed notice. For this reason, NebuAd respectfully
asks the Commission Staff to consider alternative methods of notice, such as direct notice
provided by ISPs to their subscribers, together with an opportunity to opt-out, as an
appropriate means of meeting the Staff’s proposed transparency principle.
C.
Reasonable Security and Limited Data Retention for Consumer Data
NebuAd does not, for purposes of its business model,5 take issue with the Commission
Staff’s proposed principle that data used for behavioral advertising and held in storage
should be secured in a manner appropriate for the sensitivity of the data, the nature of the
company’s business operations, the types of risks a company faces, and the reasonable
protections available to the company.6 Nor does NebuAd, for purposes of its business
model, take issue with the Commission Staff’s proposed data retention principle.
D.
Affirmative, Express Consent to Using Sensitive Data for Behavioral
Advertising
NebuAd has been careful to avoid creating categories that relate to sensitive medical or
health conditions such as HIV/AIDS, psychiatric conditions, and cancer, or sensitive
financial information such as online banking transactions. Importantly, NebuAd sees
only HTTP traffic; it does not, and cannot, see HTTPS traffic, such as consumers’ online
banking activity. NebuAd therefore looks forward to the final set of “sensitive”
categories, for a self-regulatory regime, which NebuAd assumes will be carefully tailored
to prevent consumer harm, and, assuming so, will exclude those categories from the data
used for behavioral advertising purposes or require an affirmative opt-in for them.
3. Additional
Comments
A.
The Commission Staff Should Allow for Two Sets of Industry
Comments
NebuAd appreciates that the Commission Staff has approached the privacy issues
associated with behavioral advertising carefully and thoughtfully, and it urges it to
continue to do so. Any final self-regulatory principles will have far-reaching and,
perhaps, unintentional consequences to the operations and sustainability of the variety of
businesses engaged in online behavioral advertising, including the sites that accept third-
5
NebuAd notes that other commentors may suggest that different security and data retention
standards should apply to personally identifiable information and non-personally identifiable information.
6
See FTC Staff Principles at p. 4.
4
party advertising. For instance, online advertising supports not only large publishers, but
also small publishers, such as bloggers, who often have views that would not be possible
to express but for advertising. Behavioral advertising supports those sites by making
their advertising inventory more valuable than it otherwise would be.
Given the fragile e-commerce ecosystem, and because the industry is new, complicated,
and rapidly developing, NebuAd respectfully suggests that the Commission Staff
approach the self-regulatory principles in a two-tiered fashion. Specifically, NebuAd
recommends that the Staff evaluate the initial set of public comments, refine its proposed
principles accordingly, and then publish the revised principles for a second round of
comments before issuing a final proposal. The Commission Staff should also allow for
reply comments in both rounds, to ensure that it receives all points of view in each round.
We believe that such a process would result in the best-informed, and most appropriately
tailored, set of proposed self-regulatory principles to address all online behavioral
advertising business models and simultaneously protect consumers, without
unintentionally stifling innovation in online commerce.
* * *
NebuAd appreciates the opportunity to comment on these important issues, and looks
forward to continuing to work with the Commission, industry associations, and the
privacy advocacy community to develop a self-regulatory regime for behavioral
advertising that strikes an appropriate balance between privacy and innovation, and that
is agnostic in its application to differing technologies.
Respectfully submitted by:
Robert Dykes
CEO
NebuAd, Inc.
Of Counsel:
D. Reed Freeman, Jr., Esq.
Kelley Drye & Warren, LLP
Suite 400
3050 K Street, N.W.
Washington, D.C. 20007
202.342.8880
rfreeman@kelleydrye.com
5
