Online Behavioral Advertising: Technical Steps Needed to Ensure Consumer Control

By Peter Swire, Annie I. Antón | April 10, 2008

• Print
• Email
• Text-size: A A A
• Share:

Read the full testimony (pdf)

These comments are submitted jointly by a law professor and computer science professor to address key technical issues in online behavioral profiling.

The Federal Trade Commission has asked for comments on its Proposed Self-Regulatory Principles for Online Behavioral Advertising. The first principle is “transparency and consumer control.” The essence of “consumer control,” under the proposed principle, is that consumers “can choose whether or not to have their information collected for such purpose.”

These comments examine what technical steps are needed to implement the Consumer Control Principle. The comments do not take any position on whether this principle of consumer control should become part of a self-regulatory or regulatory system.

Our principle findings are the following:

1. Cookies, as flawed as they are, are the primary existing mechanism for a website to determine that the same computer (or similar device) is returning to the website. We thus propose mechanisms for making cookies much more effective at upholding consumer choice with respect to behavioral targeting. Although “opt-in” cookies are technically feasible, we assume that the current policy discussion concerns “opt-out cookies,” which support consumers who choose not to participate in behavioral profiling.

2. Opt-out cookies today are often deleted by anti-spyware software. We recommend that anti-spyware software should be modified to honor opt-out cookies. It is technically feasible to create standards for opt-out cookies, and we believe security risks can be effectively addressed through creation of a public “white list” of opt-out cookies that will not be used for tracking.

3. Similarly, opt-out cookies are often deleted today when consumers use their browser software to delete all cookies. We recommend that browser software be updated to manage opt-out cookies better. As with anti-spyware software, the standards and security issues appear manageable.

In short, modest steps for anti-spyware and browser software can make opt-out cookies a much more effective tool for consumer choice about behavioral profiling. Unless these or similar technical measures are taken, the proposed FTC Consumer Control Principle will fail. Consumers will lack a feasible way to exercise their choice.

Read the full testimony (pdf)
 

Peter P. Swire is a Senior Fellow at American Progress and the C. William O’Neill Professor at the Moritz College of Law of the Ohio State University. Annie I. Antón is Associate Professor of Software Engineering at North Carolina State University.