Despite months of effort, Internet advertisers are having a tough time convincing Washington that they can police themselves.
The Federal Trade Commission and the advertisers said yesterday that they had made progress negotiating a set of voluntary privacy standards that the companies should follow when building profiles of Web surfers. But the commission was not ready to say whether such an agreement would go far enough to eliminate the need for federal legislation.
Jodie Bernstein, who heads the F.T.C.'s consumer protection division, told the Senate Commerce Committee that the agency and the major online advertising firms were "better than half and half" in agreement on voluntary principles the firms should follow in tracking people's movements around the Internet and building consumer dossiers based on that information.
The talks center on the way the companies should disclose such practices and how and when consumers should be able to exclude themselves from scrutiny. If an agreement is reached and endorsed by the commission, it would allow the commission to seek fines and other disciplinary actions against companies that violate those standards and collect information surreptitiously. The rules, however, would apply only to those companies that voluntarily agreed to the framework.
Ms. Bernstein said the major advertising firms, representing about 90 percent of the companies that use tracking technology in banner advertisements on the Web, are part of the talks.
"So people who are not signatories to this voluntary agreement can do anything they darn well want," said Senator Ron Wyden, an Oregon Democrat who has sponsored a bill to regulate how and when companies can collect personal information from people on the Internet. "I don't think that's right."
Ms. Bernstein said the commission had not yet made any decisions on how best to deal with online profiling companies. The commission has already recommended that Congress give it considerable new authority to regulate Internet privacy.
Those recommendations, however, dealt with the basic collection and use of personal information by Web sites. The hearing today focused on profiling technologies that are used by the companies that place banner ads on Web sites.
At issue are so-called cookies and other methods that allow advertisers to collect data on the surfing habits of consumers, often without the users' knowledge. That information is used to deliver advertisements geared toward the Web surfers' personal interests.
Plans earlier this year by one of the Internet's top advertising firms, DoubleClick, to combine anonymous data about Web surfers with personal information it has in other databases outraged privacy-rights advocates and prompted an investigation of that company by the F.T.C.
DoubleClick has suspended the plan until there is industry-government agreement on what practices are appropriate. DoubleClick's chief privacy officer, Jules Polonetsky, told the Senate Commerce Committee that the company did not place ads based on personal profiles. But he acknowledged that the company would "probably have 40 million to 50 million" such dossiers on Internet users "when we do."
DoubleClick and another key Internet advertising firm, Engage Technologies, said that the ability to monitor people's movements on the Internet and offer advertising targeting their personal preferences were key to the success of the Internet, whose free content is largely financed through advertising. But not all of the companies collect personally identifiable information. Daniel Jaye, chief technology officer of Engage Technologies, said his company did not collect any information that tied cookies to names.
"From the outset, we developed an innovative technology to enable online marketers to understand the interests of Web site visitors based strictly on anonymous, nonpersonally identifiable data," he said.
Mr. Polonetsky said DoubleClick was currently rewriting its lengthy policy so that consumers could more easily understand which technologies were being used to build profiles about them. And DoubleClick and Engage said they were making an effort to do business with companies that promise contractually to abide by their privacy standards.
Still, an Internet security expert, Richard Smith, testified that he had found evidence of personal information being leaked from Web sites to advertisers. And in many cases, Internet users are completely unaware that their movements are being tracked, anonymously or otherwise.
Ms. Bernstein gave a presentation showing that during 15 minutes of Web surfing by an F.T.C. staff member, 124 cookies were planted on that staff member's computer.
Marc Rotenberg, director of the Electronic Privacy Information Center, said Internet users should have the choice up front about whether they want companies collecting information about them online. And they should be able to have their profiles deleted upon request.
"In the matter of DoubleClick, we first brought the committee's attention to this problem at a similar hearing a year ago," he told the committee. "We warned that self-regulation would fail to protect privacy and that there would be a public backlash against the company's plan to profile Internet users. We think the lesson is clear that legislation is necessary. Even good models for online advertising can quickly change without baseline privacy rules."
Jeri Clausing, The New York Times. June 14, 2000
Copyright © 2000 The New York Times. All rights reserved.