Advertisers: Pay No Attention to the Data We Are Stealing

the-wizard-of-ozSeveral marketing associations supported by Google (s goog) have banded together and released seven principles that they believe should govern online privacy. Are you ready for a journey to the Emerald City? Because the principles are the online advertisers’ attempts to stave off government regulation around protecting consumers’ online privacy by diverting attention to the Great and Powerful Principles rather than the data scavenging that’s going on behind the curtain. Kind of like a certain self-aggrandizing wizard.

Given that Congress has been keen to see opt-in programs, and there’s no mention of that in these principles, my hope is that regulators won’t be taken in by this, and will still fight for better disclosure of advertising practices and an opt-in program. In the meantime, let’s pull back the curtain and check out what the wizards of marketing are telling us. Below are the marketing principles taken directly from the position paper — and in italics, what they really mean:

  1. The Education Principle calls for organizations to participate in efforts to educate individuals and businesses about online behavioral advertising. To this end, the digital media industry intends, in a major campaign that is expected to exceed 500 million online advertising impressions, to educate consumers about online behavioral advertising, the benefits of these practices and the means to exercise choice, over the next 18 months. (We’re gonna show you a lot of ads about how we want to invade your privacy, but since we’re making them, we’ll make sure they don’t scare you into opting out.)
  2. The Transparency Principle calls for clearer and easily accessible disclosures to consumers about data collection and use practices associated with online behavioral advertising. It will result in new, enhanced notice on the page where data is collected through links embedded in or around advertisements, or on the Web page itself. (Don’t block our ads or you may miss valuable information about how we target these ads to you.)
  3. The Consumer Control Principle provides consumers with an expanded ability to choose whether data is collected and used for online behavioral advertising purposes. This choice will be available through a link from the notice provided on the Web page where data is collected. The Consumer Control Principle requires “service providers”, a term that includes Internet access service providers and providers of desktop applications software such as Web browser “tool bars” to obtain the consent of users before engaging in online behavioral advertising, and take steps to de-identify the data used for such purposes. (Remember that notice near those ads you were blocking? You’re going to have to click through that in order to opt out. As for all you ISPs, web application companies and tool bar providers out there, you’re actually going to have to make users opt in.)
  4. The Data Security Principle calls for organizations to provide reasonable security for, and limited retention of data, collected and used for online behavioral advertising purposes. (Please ignore the fact that we’re not using anything descriptive here to define reasonable security, the type of data collected or how long we plan to keep it)
  5. The Material Changes Principle calls on organizations to obtain consent for any material change to their online behavioral advertising data collection and use policies and practices to data collected prior to such change. (When we decide to collect more information from you, we’ll tell you about it, maybe through an opt-in box that pops up right before you want to get access to something important, like your email. It could read: “Before we provide access to your inbox, click here to acknowledge these several pages of fine print about your privacy.”)
  6. The Sensitive Data Principle recognizes that data collected from children and used for online behavioral advertising merits heightened protection, and requires parental consent for behavioral advertising to consumers known to be under 13 on child-directed Web sites. This Principle also provides heightened protections to certain health and financial data when attributable to a specific individual. (We know there are some things that will really tick people off, like advertising to kids and selling ads based on confidential medical data, but since kids are so impressionable, if we can get them to ask a parent for permission then we’re going do it.)
  7. The Accountability Principle calls for development of programs to further advance these Principles, including programs to monitor and report instances of uncorrected non-compliance with these Principles to appropriate government agencies. The Council of Better Business Bureaus and Direct Marketing Association have been asked and agreed to work cooperatively to establish accountability mechanisms under the Principles. (It’s like relying on the Do Not Call List to block telemarketers. That always works out well, doesn’t it?)

To be fair, there will likely be some sites that go above and beyond these principles to protect users’ privacy, just like there will be some that will ignore them and troll for as much information as the gullible masses are willing to provide. I may be too cynical here, but in my experience, self-regulation doesn’t work when one side has a lot to gain and the other side is pretty ignorant about what that side is doing. I’m not going to put my toddler alone in a room with a bowl full of candy and expect her to self-regulate, just like I doubt that advertisers and Google are the best stewards of my privacy online.