The FTC staff's revised behavioral advertising principles make it clear that the FTC understands the Internet’s growing privacy-publicacy fault-line. The FTC’s new guidelines are all about tackling the growing problem of unauthorized publicacy – meaning the tracking, collecting and “mashing-up” of information consumers reasonably expected to be kept private. (“Publicacy” is the opposite of privacy.)
-
Privacy-Publicacy Fault-line Part I, II, III.
Why are the FTC’s new guidelines a much bigger deal than most appreciate?
First, the new guidelines put a new and brighter privacy regulatory spotlight on Google, the world’s dominant behavioral-advertiser, and to a lesser extent, Yahoo, Google’s distant #2 competitor.
Importantly, the FTC tightened the definition of behavioral advertising to mean: “the tracking of a consumer’s online activities – over time – including the searches the consumer has conducted, the web-pages visited, and the content viewed – in order to deliver advertising targeted to the consumer’s individual interests.”
Given that definition, the combined Google-DoubleClick-YouTube is really the only entity capable of tracking most of the world’s searches, web-page visits and viewed content.
-
Yahoo, Google’s distant #2 behavior advertiser competitor, can only track a fraction of what Google can, but still substantially more than any other behavioral advertiser in the world.
It’s not hard to discern that Google is the primary focus and concern of these revised guidelines given the FTC’s recent past with Google. Remember, the FTC approved its original behavioral advertising principles, the same day it approved the Google-DoubleClick merger. The original guidelines were released that day because the FTC was concerned about the privacy implications of the merger. Those original guidelines were weaker than the revised guidelines because the FTC assumed at the time that the behavioral advertising market was competitive and likely to stay competitive.
-
Wrong. Less than eleven months later, the DOJ found that the world’s dominant behavioral-advertiser, the now-combined Google-DoubleClick-YouTube, which could track ~70+% of online activity overall, was attempting to monopolize the search advertising/syndication markets through the Google-Yahoo ad agreement.
-
Moreover, the FTC understands the network effects/scale required to most effectively target online advertising.
-
Simply, Google probably represents more than half of the overall publicacy problem stemming from behavioral advertising.
Second, the FTC greatly expanded the scope of what it considers “private” (i.e. PII, or personally identifiable information), in order to capture any data/information that “reasonably could be associated with a particular consumer or device.” This change is a big deal, particularly for Google and Yahoo, because most of the oomph in their business model is privacy-arbitrage between PII and non-PII information that competitors simply cannot or will not do. Google, and to a much lesser extent Yahoo, have the data, multiple data sets, and cross-referencing/mash-up ability to practically transform non-PII info into PII info.
-
In other words, under the previous more lax FTC guidelines most of Google/Yahoo’s information could be classified as non-PII. Not so under the new FTC guidelines. The new “reasonably could be associated with” FTC privacy standard effectively could capture most all of the treasure trove of consumer metadata that heretofore Google and others could self-classify as outside the privacy realm.
-
Simply, the single biggest U.S. online privacy loophole may have been taken away.
Third, the revised FTC staff principles create a new important dichotomy of what’s acceptable for privacy and what is not. They view tracking on one website as acceptable because it meets consumer expectations, but frown upon tracking across multiple websites because that activity does not meet consumer expectations.
-
This significant privacy dichotomy could prove important competitively, because Google’s dominance in the monetization of private information could be found eventually to be an illegal practice and or anti-competitive.
-
Simply, the FTC obviously understands that Google’s unique capability to track most everyone, most everywhere, most anytime on the Internet, is a unique threat to Americans’ privacy.
Fourth, the Web 2.0 application crowd, (i.e. those that don’t believe they should have to ask permission from anyone or pay anyone anything to operate their application on the Internet), probably will have a cow when they grasp the implications of the new FTC staff behavioral advertising principles.
-
That’s because, any advertising-driven business model that involves the new vogue of “mash-ups” -- i.e. combining two previously separate data sets in a new or innovative way -- could now find themselves on the FTC’s privacy radar.
-
Why? Well the new “reasonably could be associated with” scope language means that applications need to be more responsible that their “mash-up” of separate non-personally identifiable data sets, do not transform those data sets into personally identifiable information.
-
In short, those involved in the mash-up field of “collective intelligence” now have to worry about privacy concerns where they did not before.
Bottom line:
The FTC’s new behavioral advertising guidelines may be the first high-profile and far-reaching government decision addressing the privacy-publicacy fault-line.
This FTC decision is much more significant and important than most appreciate.
