Online-ad group to protect consumers' privacy

WASHINGTON -- The Clinton administration and online-advertising firms unveiled a landmark agreement on rules governing the tracking of Web surfers, demonstrating that federal regulators still hold some faith in the Internet industry's stab at self-regulation.

Under the pact, hammered out during months of negotiations with senior officials at the Federal Trade Commission and the Commerce Department, member companies of the Network Advertising Initiative pledged to adopt restrictions on their business practices to ensure that consumers' personal information isn't misused. The NAI covers some 90 percent of the nascent industry.

The deal, avidly sought by the industry, is an enormous but perhaps necessary gamble by Internet advertisers that consumers will voluntarily consent to some degree of surveillance of their preferences and buying habits. Spearheading the drive for an agreement was industry leader DoubleClick Inc. (dclk), which previously bucked proposed limits on its information-gathering practices but lost more than half of its market value after it became involved in privacy-related controversies.

The pact also is the industry's attempt to blunt calls for tough and potentially crippling privacy legislation. As an alternative to new laws, the firms agreed to surrender substantial legal freedom by stating their new policies in legally binding documents subject to enforcement by the FTC under existing deceptive-practices laws.

The concession failed to satisfy some privacy advocates, and the FTC renewed its call for new legislation. Still, the agency signaled that it thinks the NAI deal is strong and enforceable, saying it wants new laws only to cover firms that don't sign on to the agreement.

The Commerce Department was less equivocal, saying the deal covers "all significant participants" in the online-ad industry. "These principles will constitute an effective and meaningful self-regulatory approach to privacy protection," said Commerce Secretary Norman Mineta.

Among the most significant elements of the deal, which was submitted to Congress for review along with an FTC report on so-called online profiling, DoubleClick, Engage Inc. and the other online marketers agreed to hold off on combining online data with offline banks of information. To combine the two, which would be a valuable source of potential revenue for the firms, the companies agreed to first secure consumers' approval by giving Internet users the opportunity to opt out.

The companies pledged broadly to adhere to the FTC's privacy guidelines and said they would give consumers "robust notice and choice" on how online marketers use their personal information. Essentially, that means posting warnings that are impossible to overlook and referring Web surfers to "gateway" sites where they can opt out of being tracked by online marketers.

Broader restrictions also were agreed to, such as a categorical ban on using sensitive personal information such as medical history, sexual orientation and Social Security numbers for marketing. In another major concession, the industry also agreed to give consumers access to the personally identifiable data that have been collected on them, a step it had previously resisted as unnecessary and technologically unfeasible.

But perhaps the biggest draw for regulators was the industry's promise to use its leverage for a broader clean-up of e-commerce. Under the deal, advertisers will demand that e-commerce sites using their services contractually commit to observe the ad firms' privacy practices. Under existing law, the government has little authority to force e-commerce firms to respect FTC privacy guidelines. Compliance with such contracts and other commitments by the ad firms will be enforced by a new independent group financed by the industry.

Despite the concessions, privacy advocates derided the pact, saying it was too weak and technically flawed. "The NAI principles fall short," said Jason Catlett, head of Junkbusters Corp. (www.junkbusters.com). "Before merging online profiles with real-world identity, affirmative consent should be required," as opposed to asking consumers to opt out of participating.

WASHINGTON -- The Clinton administration and online-advertising firms unveiled a landmark agreement on rules governing the tracking of Web surfers, demonstrating that federal regulators still hold some faith in the Internet industry's stab at self-regulation.

Under the pact, hammered out during months of negotiations with senior officials at the Federal Trade Commission and the Commerce Department, member companies of the Network Advertising Initiative pledged to adopt restrictions on their business practices to ensure that consumers' personal information isn't misused. The NAI covers some 90 percent of the nascent industry.

The deal, avidly sought by the industry, is an enormous but perhaps necessary gamble by Internet advertisers that consumers will voluntarily consent to some degree of surveillance of their preferences and buying habits. Spearheading the drive for an agreement was industry leader DoubleClick Inc. (dclk), which previously bucked proposed limits on its information-gathering practices but lost more than half of its market value after it became involved in privacy-related controversies.

The pact also is the industry's attempt to blunt calls for tough and potentially crippling privacy legislation. As an alternative to new laws, the firms agreed to surrender substantial legal freedom by stating their new policies in legally binding documents subject to enforcement by the FTC under existing deceptive-practices laws.

The concession failed to satisfy some privacy advocates, and the FTC renewed its call for new legislation. Still, the agency signaled that it thinks the NAI deal is strong and enforceable, saying it wants new laws only to cover firms that don't sign on to the agreement.

The Commerce Department was less equivocal, saying the deal covers "all significant participants" in the online-ad industry. "These principles will constitute an effective and meaningful self-regulatory approach to privacy protection," said Commerce Secretary Norman Mineta.

Among the most significant elements of the deal, which was submitted to Congress for review along with an FTC report on so-called online profiling, DoubleClick, Engage Inc. and the other online marketers agreed to hold off on combining online data with offline banks of information. To combine the two, which would be a valuable source of potential revenue for the firms, the companies agreed to first secure consumers' approval by giving Internet users the opportunity to opt out.

The companies pledged broadly to adhere to the FTC's privacy guidelines and said they would give consumers "robust notice and choice" on how online marketers use their personal information. Essentially, that means posting warnings that are impossible to overlook and referring Web surfers to "gateway" sites where they can opt out of being tracked by online marketers.

Broader restrictions also were agreed to, such as a categorical ban on using sensitive personal information such as medical history, sexual orientation and Social Security numbers for marketing. In another major concession, the industry also agreed to give consumers access to the personally identifiable data that have been collected on them, a step it had previously resisted as unnecessary and technologically unfeasible.

But perhaps the biggest draw for regulators was the industry's promise to use its leverage for a broader clean-up of e-commerce. Under the deal, advertisers will demand that e-commerce sites using their services contractually commit to observe the ad firms' privacy practices. Under existing law, the government has little authority to force e-commerce firms to respect FTC privacy guidelines. Compliance with such contracts and other commitments by the ad firms will be enforced by a new independent group financed by the industry.

Despite the concessions, privacy advocates derided the pact, saying it was too weak and technically flawed. "The NAI principles fall short," said Jason Catlett, head of Junkbusters Corp. (www.junkbusters.com). "Before merging online profiles with real-world identity, affirmative consent should be required," as opposed to asking consumers to opt out of participating.