• by Wendy Davis  @wendyndavis, March 26, 2012

The Federal Trade Commission is urging the ad industry to continue efforts to develop a universal do-not-track tool that will allow consumers to easily opt out of all online behavioral advertising. But it did not specifically call on Congress to enact a law mandating it.

"While more work remains to be done on Do Not Track, the Commission believes that the developments to date are significant and provide an effective path forward," the FTC said in its report, "Protecting Consumer Privacy in an Era of Rapid Change."

The report, approved by a vote of 3-1, included many recommendations from the FTC's 2010 preliminary staff report, including the concept that Web companies should offer consumers a simple way to opt out of behavioral targeting.

 "Simply put, your computer is your property; no one has the right to put anything on it that you don't want," FTC Chairman Jon Leibowitz said in a prepared statement. He added in a conference call with reporters that he was "very, very hopeful" that the industry will develop a tool by the end of the year that enables consumers to opt out of third-party tracking.

Currently, consumers that wish to opt out can do so via privacy policies on a site-by-site basis, or by visiting an opt-out page run by a self-regulatory group. The pages run by self-regulatory groups allow consumers to opt out of dozens of ad networks at once. But those opt-outs are cookie-based, which means they get deleted when users erase their cookies. A browser-based tool would be more persistent, and could be read by any ad networks -- not just those that belong to a self-regulatory organization.

In the last year, efforts to create a browser-based do-not-track tool have advanced on several fronts. Mozilla introduced a do-not-track setting for its Firefox browser, the World Wide Web Consortium launched an initiative aimed at developing standards for do-not-track, and the self-regulatory group Digital Advertising Alliance promised to require its members to honor a browser-based do-not-track header.

The FTC's final report further refined the definition of "tracking" -- a term that has been subject to a good deal of interpretation since the agency proposed the concept. Critically, the FTC says that ad networks should stop collecting data that can be used to create marketing profiles of consumers who opt out of online behavioral advertising.

In the past, ad networks promised that they would stop serving targeted ads to opted-out consumers, but didn't necessarily stop amassing data about them.

The FTC did not say that ad networks should stop all data collection in response to a do-not-track command. Instead, the agency said ad networks can still gather information for analytics purposes as long as the data is "de-identified."

At this point it's not entirely clear how companies will interpret the meaning of de-identifed.

Ed Felten, the FTC's chief technologist, offered some preliminary thoughts on the topic. "Data that is truly de-identified (or anonymous) can’t be used to infer anything about an individual person or device, so it doesn’t raise privacy concerns," he says in a blog post. "Here’s a good rule of thumb: if you plan to use a dataset to personalize or target content to individual consumers, it’s probably not de-identified."

In the report, the FTC specifies for the first time that online retailers engaged in retargeting should allow consumers to opt out. Retargeting generally involves dropping cookies on visitors to e-commerce sites like Zappos.com and then sending ads to those users when they're on other publishers' sites. Some companies previously argued that re-targeteters need not follow the same rules as ad networks that track people across a variety of sites in order to deduce their interests.

Even though the FTC didn't specifically recommend a do-not-track law, the agency urged Congress to "consider enacting baseline privacy legislation."

The commission also specifically urged Congress to pass a law that would give consumers more control over the collection and sale of their information by data brokers. The FTC also said that data brokers should develop a centralized site where they can describe how they collect and use data about consumers.

Commissioner J. Thomas Rosch dissented from the report, writing that many of the recommendations were too broad. "If implemented as written, many of the report’s recommendations would ... apply to almost all firms and to most information collection practices. It would install 'Big Brother' as the watchdog over these practices not only in the online world but in the offline world," he wrote.