• by Wendy Davis  @wendyndavis, October 31, 2011

In a new critique of the ad industry's self-regulatory efforts, researchers at Carnegie-Mellon University said in a new report that current tools for opting out of online behavioral advertising are hard for people to understand and use.

“Our results suggest that the current approach for advertising industry self-regulation through opt-out mechanisms is fundamentally flawed,” states the report, “Why Johnny Can't Opt Out.”

The paper detailed several problems with the current opt-out tools, including ones operated by the umbrella trade group Digital Advertising Alliance and by privacy company Evidon, which powers the many of the DAA's “ad choices” icons.

For the study, researchers asked 45 people to test nine different opt-out mechanisms, including cookie-based tools offered by the DAA and Evidon, as well as browser-based mechanisms and add-ons. Five people tested each of the tools. Two of the five who tested the DAA's mechanism couldn't find the opt-out page without additional written instructions from a moderator. Instead, both ended up on the page for ad companies to register with the DAA, prompting one participant to complain, “The application to opt out it is a bit expensive, $5,000 a year.”

Two DAA testers who attempted to opt out of all behavioral advertising, only ended up opting out of ads by Yahoo. The other three opted out of all sites, but the process “took a relatively long time,” the report says. Also, the testers “expressed displeasure when the DAA website displayed an error message stating that certain opt-outs had failed.”

The group that tested Evidon had better luck finding the opt-out page, but those people also appeared to spend a long time actually opting out; it took one tester 47 minutes to do so. The cookie-based opt-outs are key to the industry's self-regulatory program.

The DAA -- made up of industry groups including the Interactive Advertising Bureau, Direct Marketing Association, Association of National Advertisers, and American Association of Advertising Agencies -- requires ad companies to allow people to opt out of receiving ads targeted based on Web-surfing behavior. (DAA principles allow ad networks and other companies to collect data used for analytics or site optimization, even when users have opted out.)

The DAA also requires behavioral targeting companies to notify users about the technique via icons; Evidon powers those icons for many companies, and also operates its own opt-out page.

Mike Zaneis, general counsel of the IAB, disputed the report's conclusions. He says that DAA's ad-choices icons take people to a page with a large “Choose all companies” button, which allows people to opt out of all tracking at once.

“It is easy to create consumer confusion in the laboratory, but we are interested in delivering transparency and meaningful choice in the real world,” he says.

Evidon CEO and founder Scott Meyer says the company has “much broader, more complicated objectives to fulfill” than enabling opt-outs.

“It's important to remember that the DAA program is a transparency program, not merely an 'opt-out' program,” he stated. “Transparency enables consumers to make more informed decisions, and the fact is that the vast majority choose not to opt-out when presented with more information.”

The Carnegie Mellon study also examined cookie-blocking tools available through IE9 and Mozilla's Firefox, as well as various add-ons. Those, too, proved problematic for users, according to the report.

“The default settings for most of the tools we tested were not appropriate for users who are interested in protecting their privacy,” the report states. “Web browsers do not enable most of their privacy features by default, which is likely appropriate for a general audience. On the other hand, once a user enables a privacy feature, a protective default for that feature seems reasonable.”