Internet-based advertising, also known as ad targeting or online behavioral advertising (“OBA”), involves the tracking of consumers’ online activities to deliver tailored or targeted advertising. The practice, typically invisible to consumers, allows businesses to align their ads to certain inferred interests of their audience.

Most Internet users conducting a search for a product or service have been targeted by behavioral advertising. For example, imagine you visit a travel Web site and search for airline flights to the Caribbean but don’t purchase tickets at the time. Later, while visiting a local newspaper Web site, you notice an advertisement from an airline promoting flights to Jamaica. That, most certainly, was not a coincidence.

In a classic case of OBA, your web-browsing activities were tracked by the use of “cookies” – a small text file that a Web site’s server places on your computer’s browser. The cookie transmits information back to the Web site’s server about your browsing activities. Cookies also can be used to maintain data related to a particular individual, such as passwords and items placed in a virtual shopping cart. In some contexts, such as where a number of separate Web sites participate in a network, cookies can be used to track a computer user across different sites, as in the above example of being “followed” from a travel site to a news site  Although it is possible to opt out of tracking and to circumvent future tracking by deleting cookies, there are also HTTP cookies (also known as “zombie cookies”) that are automatically recreated after users attempt to delete them.

The use of unique identifiers

While some OBA practices are fairly benign, others, including the use of zombie cookies, are unacceptably intrusive and can be privacy violations. For example, one of the most powerful ways to target online ads is to assign unique identifiers to individuals and track their online behavior across multiple sites, platforms and apps. Although Apple is eliminating the use of unique device identifiers after much public outcry, app developers and mobile marketing companies are so enamored of the practice and the valuable information it mines that they are pushing hard to find alternative ways to link behavioral data with unique identifiers.

Other objectionable OBA practices include the collection and use of sensitive data (including personal information from children, health and  financial data, and precise geolocation data), and the use of tracking tools that impact computer or device operability (such as spyware, adware and malware). Advertisers also use passive information collection such as “device fingerprinting” (allowing advertisers to identify connected devices) that is conducted with no consumer notice.

Several years ago, the Federal Trade Commission issued “Self-Regulatory Principles for Online Behavioral Advertising,” which have been implemented in an “Accountability Program” by the Council of Better Business Bureaus and the major advertising trade associations. The program monitors behavioral advertising practices and attempts to facilitate compliance.

The program also strives to reform OBA by providing consumers with real-time notice and choice about the collection and use of their data through the use of the “AdChoices” icon shown below, a blue forward-pointing triangle, which appears in the corner of an interest-based ad. When consumers click the icon in the ad, they are taken to a site with information on OBA and are given the option to opt out of receiving the targeted ads. This is a decided improvement, but the icon is far from a “robust, clear and conspicuous” opt-out mechanism; to many, it is far from obvious that it is even clickable.

Such efforts will require refinement as well as educating consumers about their rights and privacy options. In the coming year and beyond, there will be continuing developments in this critical area of personal privacy as it pertains to both compliance and enforcement of online and mobile data collection and behavioral advertising regulations.