Network Advertising Initiative

Network Advertising Initiative
Website	http://www.networkadvertising.org

The Network Advertising Initiative is an industry trade group formed in 1999 that develops self-regulatory standards for online advertising. Advertising networks created the organization in response to concerns from the Federal Trade Commission and consumer groups that online advertising — particularly targeted or behavioral advertising — harmed user privacy. The NAI seeks to provide self-regulatory guidelines for participating networks and opt-out technologies for consumers in order to maintain the value of online advertising while protecting consumer privacy. Membership in the NAI has fluctuated greatly over time and both the organization and its self-regulatory system have been criticized for being ineffective in promoting privacy.

History

The NAI was formally announced at the Public Workshop on Online Profiling [1] held by the FTC and the Department of Commerce on November 8, 1999.^[1] At that time, membership consisted of 24/7 Media, AdForce, AdKnowledge, Adsmart, DoubleClick, Engage, Flycast, MatchLogic, NetGravity (a division of DoubleClick) and Real Media.

In July 2000, the NAI published a set of Principles, negotiated with the FTC and endorsed by the FTC in their report to Congress on online profiling.^[2] In May 2001, the NAI released an accompanying web site [2] allowing users to more quickly download opt-out cookies for all participating ad networks.^[3] In response to a 2007 FTC staff report (Self-Regulatory Principles for Online Behavioral Advertising^[4]), the NAI published an updated set of Principles in December 2008^[5] after providing a draft in April for public comments.^[6][7]

In 2002, the NAI released guidelines for use of Web beacons — small images or pieces of code used to track visiting and traffic patterns and install cookies on visitors' machines.^[8] These guidelines use a similar model of notice and choice as the NAI Principles; opt-in consent is only required when sensitive information is associated with personally-identifiable information and transferred to a third-party.^[9]

In 2003, the NAI formed the Email Service Provider Coalition (since renamed the Email Sender and Provider Coalition).^[10] The ESPC engages in lobbying, press relations and technical standards development to support "email deliverability" — ensuring that mass email delivery continues despite anti-spam legislation and technologies.^[11]

Ad network membership in the NAI fluctuated between 12 members in 2000, two members in 2002-2003 and five members in 2007, prompting criticism that it did not consistently represent or regulate the industry.^[12] As of March 2010, the NAI lists 42 members, including Google, Microsoft and Yahoo!.^[13]

NAI Principles

The NAI's self-regulatory principles for online behavioral advertising depend on a model of notice and choice.

Notice: The NAI principles require "clear and conspicuous" notice on the member ad network's website of what behavioral or multi-site advertising the ad network engages in, what types of data they collect for what purposes and for what length of time. Since ads are commonly shown on web sites not controlled by the ad network, members must also require that partnering web sites that display their ads also provide "clear and conspicuous" notice that behavioral advertising is taking place as well as what data is being collected, for what purposes and with whom it will be shared. Typically, these notices are presented in each web site's privacy policy. "Robust" notice — where the notice is presented before personal information is collected — is required when personally-identifiable information ("name, address, telephone number, email address, financial account number, government-issued identifier and any other data used to identify, contact or precisely locate a person") will be merged with other non-identifiable information (like demographics or interests).

Choice: Ad networks which satisfy the NAI principles must provide consumers a choice about whether information collected about them is tracked and used to provide targeted advertising. Whether this choice is "opt-out" or "opt-in" depends on the type and usage of data. For sensitive information (including Social Security Numbers, financial account numbers, real-time location information and precise information about medical conditions), tracking is always "opt-in". Also, when previously collected personally-identifiable information is merged with non-identifiable information (and the consumer wasn't provided "robust notice" of this practice originally), then ad networks must obtain affirmative consent. In all other cases of tracking personally-identifiable and non-identifiable information, choice is provided through an "opt-out" mechanism: the opt-out cookie.

Although HTTP cookies are commonly used by advertising networks to track consumers as they access information across different web sites, the opt-out cookie is used to signal that the consumer has chosen not to have their data collected for providing targeted ads. The NAI provides a tool to download opt-out cookies for each of their member networks: member networks who detect the opt-out cookie must not collect data on that user for targeted advertising.

Additional principles prohibit collecting information of children under age 13 or using collected data for non-marketing purposes. Ad networks are required to provide subjects of data collection "reasonable" access to the personally-identifiable information they collect, make "reasonable" efforts to use reliable data, provide "reasonable" security and use "reasonable" efforts (through the NAI) to educate consumers about targeted advertising. Retention of data is limited to "legitimate business needs".

Criticism

The NAI and its set of self-regulatory principles have been widely criticized by consumer advocacy organizations.

The World Privacy Forum has argued that the NAI opt-out cookie has been ineffective because consumers don't understand how cookies work, don't realize that cookies can simultaneously track them and be used to signal that they should not be tracked, don't recognize that changing membership in the NAI requires regularly updating their opt-out cookies, and regularly encounter errors on the NAI web site while trying to opt out.^[12] Before 2008, the NAI principles covered tracking only via HTTP cookies despite additional technologies for uniquely identifying and tracking browsers,^[12] the updated principles explicitly cover Flash cookies and similar technologies. Controversy continues over the NAI's model of "clear and conspicuous" notice within a privacy policy, rather than the FTC's recommendation for a higher standard of "prominent" notice that consumers are more likely to see and understand.^[14]

Concerns have also been raised about the process for developing and enforcing the NAI principles. The Electronic Privacy Information Center criticized the negotiation of the original set of principles for not substantively including privacy advocates or consumer protection organizations,^[15] a concern echoed by seven senators in a letter to then FTC Chairman Pitofsky.^[16]

The NAI used TRUSTe for third-party enforcement of its principles starting in 2002, but over time TRUSTe provided less and less detail in their reports on consumer complaints about the NAI and stopped reporting these complaints altogether in 2006.^[12] When the NAI published updated principles in 2008, it chose to review member compliance itself, which the Center for Democracy and Technology argued would reduce consumer trust in the organization.^[14]

Because membership has fluctuated so widely, privacy advocates have also questioned whether the NAI system of self-regulation actually covers most of the networks engaging in online behavioral advertising. In 2005 and 2006, the majority of NAI members were "associate members" not required to comply with the organization's principles.^[12]

References

1. ^ "Comments of the Network Advertising Initiative: Testimony at the Public Workshop on Online Profiling". 1999-11-08. http://www.ftc.gov/bcp/workshops/profiling/comments/nai.htm. 
2. ^ Federal Trade Commission. "Online Profiling: A Report to Congress, Part 2 Recommendations". http://www.ftc.gov/os/2000/07/onlineprofiling.htm. 
3. ^ Brian Krebs (2001-05-21). "Web Site Lets Consumers Opt Out Of Online Tracking". Newsbytes. 
4. ^ "Self-Regulatory Principles for Online Behavioral Advertising". 2009-02. http://www.ftc.gov/os/2009/02/P085400behavadreport.pdf. 
5. ^ "Network Advertising Initiative Announces 2008 NAI Self-Regulatory Code of Conduct for Online Behavioral Advertising". 2008-12-16. http://www.networkadvertising.org/networks/2008_NAI_Principles_PR_FINAL.pdf. 
6. ^ J. Trevor Hughes (2008-04-10). "Re: Network Advertising Initiative Written Comments in Response to the Federal Trade Commission Staff's Proposed Behavioral Advertising Principles". http://www.ftc.gov/os/comments/behavioraladprinciples/080410nai.pdf. 
7. ^ "Network Advertising Initiative Proposes Updated Principles". 2008-04-10. http://www.networkadvertising.org/networks/principles041008.asp. 
8. ^ Brian Morrissey (2002-11-26). "NAI Releases 'Web Bug' Guidelines". ClickZ. http://www.clickz.com/1548501. 
9. ^ Network Advertising Initiative (2004-11-01). "Web Beacons – Guidelines for Notice and Choice". http://www.networkadvertising.org/networks/Web_Beacons_rev_11-1-04.pdf. 
10. ^ "NAI Email Service Provider Coalition Formed". 2003-01-21. http://www.espcoalition.org/NAI_Email_Service_Provider_Release_1-21-03.pdf. 
11. ^ "Email Sender and Provider Coalition - About Us". http://www.espcoalition.org/about_espc.php. 
12. ^ ^{a b c d e} Pam Dixon (2007-11-02). "The Network Advertising Initiative: Failing at Consumer Protection and at Self-Regulation". http://www.worldprivacyforum.org/pdf/WPF_NAI_report_Nov2_2007fs.pdf. 
13. ^ "Network Advertising Initiative - Participating Networks". http://www.networkadvertising.org/participating/. Retrieved 2010-03-11. 
14. ^ ^{a b} Center for Democracy and Technology (2008-12-16). "Response to the 2008 NAI Principles: The Network Advertising Initiative’s Self-Regulatory Code of Conduct for Online Behavioral Advertising". http://www.cdt.org/privacy/20081216_NAIresponse.pdf. 
15. ^ Electronic Privacy Information Center, Junkbusters (2000-07). "Network Advertising Initiative: Principles not Privacy". http://epic.org/privacy/internet/NAI_analysis.html. 
16. ^ "Letter to Chairman Pitofsky from Senators Burns, Rockefeller, Wyden, Bryan, Hollin, Inouye and Cleland". 2000-06-21. http://epic.org/privacy/internet/pitofsky_letter_0600.jpeg. 

External links

• Network Advertising Initiative website