This article examines key recent developments in the UK online advertising industry, including: the impact of European regulation in the area of unfair advertising practices; the Office of Fair Trading's involvement in online advertising practices; concerns regarding behavioural and targeted advertising; and the controversy surrounding keyword sponsorship, as used by search engines such as Google. It also considers how similar issues are being dealt with in the US.
The world of online marketing and advertising has seen significant growth in the past few years. Recent media and industry reports indicate that, in the UK alone, spending on online advertising grew by almost 5% in the first six months of 2009, while television spending fell by 16% (see IAB UK News, Internet ad spend grows by 4.6%). It was also reported that UK online advertising spend overtook TV advertising spend for the first time (see The Times, Web ad spend outstrips TV for first time, 30 September 2009).
This article focuses on recent key developments in the UK online advertising industry, and the legal and regulatory issues that have arisen as a result, in particular:
The impact of European regulation in the area of unfair advertising practices, notably the Consumer Protection from Unfair Trading Regulations 2008 (SI 2008/1277) (CPRs) and the Business Protection from Misleading Marketing Regulations 2008 (SI 2008/1276) (BPRs) (together referred to as the Regulations).
The involvement of the Office of Fair Trading (OFT) in online advertising practices.
Concerns regarding behavioural and targeted advertising (where browsing habits of consumers are stored and then used to provide them with targeted adverts).
The controversy surrounding keyword sponsorship, as used by search engines such as Google.
(This is not intended to be a comprehensive review of the legal landscape relating to online advertising in the UK. Areas such as advertising to children, the Advertising Standards Authority (ASA) voluntary codes and the impact of trade mark laws on comparative advertising are not covered.)
The article also considers how similar issues are being dealt with in the US, which has typically been at the forefront of online advertising developments (see box, The US position).
EU Regulations aimed at unfair and misleading advertising and marketing practices came into force in May 2008 (for more details see box, EU regulation of unfair and misleading commercial practices). Notably:
The CPRs prohibit unfair commercial practices aimed at consumers (see Consumer Protection from Unfair Trading Regulations 2008 (SI 2008/1277) and PLC Commercial, Practice note, Consumer Protection from Unfair Trading Regulations 2008 (www.practicallaw.com/2-381-1492)).
The BPRs prohibit misleading commercial practices that occur between businesses (see Business Protection from Misleading Marketing Regulations 2008 (SI 2008/1276), and PLC Commercial, Practice note, Business Protection from Misleading Marketing Regulations 2008 (www.practicallaw.com/9-383-8073)).
Both Regulations apply to online, as well as print and television, advertising. Despite this, their practical effect on online advertisements remains unclear, and is proving to be an area of concern for UK lawyers.
Iain Stansfield, a media partner from Olswang, comments that, although he and his team have been advising clients on the importance of following the Regulations in online adverts, "We have noticed that a number of other online advertisers continue to ignore them". Despite this, there have not yet been any high-profile prosecutions. In the meantime, he predicts that "buzz marketing" practices (where advertisers pose as customers, or pay people to recommend or "tweet" about their products online) will continue to be seen on websites with user-generated content (UGC) despite the fact that they are illegal.
In addition, Stansfield still sees a lot of blurring of the boundaries between editorial and adverts in internet blogs. Editorials which are actually adverts, but do not say that they are, can be misleading for consumers and certainly fall foul of the Regulations. Paul Garland, a partner at Kemp Little, adds that false blogging, where companies pretend to be consumers, is also illegal. The types of prohibited advertisements are clearly set out in the Regulations, and under Schedule 1 there is also a list of 31 practices that are prohibited activities (see Schedule 1, CPRs).
Calum Murray, a partner from Kemp Little, agrees that there has been little visible impact of the Regulations on the market, or on the behaviour of some online advertisers, so far. In his view, "Their potential effect on advertisers is huge, but it remains to be seen how this effect materialises". The OFT's study into behavioural advertising practices (although focusing primarily on behavioural advertising and online pricing issues), and the EU's action against the UK regarding Phorm and behavioural advertising (see below), are both likely to create more pressure to comply. Murray considers that the OFT study, and the outcomes of potential prosecutions by the OFT and trading standards officers under the Regulations, will be helpful if they resulted in "a clearer mechanism for regulating the technological advances of online advertisers".
Legal director, Marina Palomba, from the Institute of Practitioners in Advertising (IPA), puts the minimal impact of the Regulations online down to a lack of funding to enforce them properly through trading standards. However, she expects that "the recent announcement that the ASA will be extending its remit to the internet, and the proposed amendment of the Committee of Advertising Practice codes of practice (the CAP Codes) to reflect the CPRs, will have a major impact " (see IPA news, IPA welcomes extension of ASA remit to website content). Under the present system, consumers are unable to complain about misleading adverts online; but when the ASA becomes involved in internet advertising in 2010, consumers will have a body to complain to. Also, it will not only be "buzz marketing" or undisclosed "advertorials" that will be covered, but any general breach of content issues (as come up in standard media). Palomba acknowledges that there will, inevitably, be "lots of uncertainty" in the application of the principles-based advertising codes, but that IPA members already seek to comply with them, and are encouraged to take responsibility for their online adverts.
In 2009, the OFT announced that it would be carrying out an investigation into advertising and pricing practices on the internet, as well as two separate six-month studies into behavioural advertising and online pricing practices. The OFT will consider how the CPRs and the Unfair Terms in Consumer Contracts Regulations 1999 apply to internet advertising and transactions (see OFT, Advertising and Pricing market Q&As and OFT's Statement of Scope document). It will also investigate the concerns surrounding behavioural advertising, particularly:
How often targeted behavioural advertising is used.
How data is collected.
How this data is used.
It invited written comments on the issues to be raised by 18 December 2009.
Calum Murray believes that the study could potentially have a significant impact, if it leads to policy diktats for trading standards officers to enforce the Regulations more fully. An appropriate first step for the study would be to result in an industry code of practice clearly setting out advertisers' responsibilities and duties, as well as consumer rights. Most advertisers are likely to welcome a self-regulatory code rather than more direct regulation.
Murray also points out that behavioural advertising has continued to grow as a hot topic in recent years, and this is likely to be why the OFT moved the issue to the top of its agenda. The study and its results will be published in the summer of 2010, and could well lead to developments in this area too.
Across the Atlantic, this has been mirrored in the US, with the Federal Trade Commission also carrying out a study into behavioural advertising and issuing a set of guidelines (see box, The US position).
Linked to the OFT's concerns about behavioural advertising, the UK's internet advertising trade body, the Internet Advertising Bureau (IAB), recently developed a set of good practice principles for behavioural advertising (see IAB press release, IAB boosts behavioural advertising education with "your online choices" campaign, 7 October 2009 and IAB Good Practice Principles for Online Behavioural Advertising). It has also produced a fact sheet for consumers, with information and guidance on how to opt out of receiving behavioural advertisements.
In November 2009, the European Commission established a new industry body, called the Stakeholder Forum on Fair Data Collection, to address consumer concerns regarding privacy on internet sites using behavioural adverts. The forum will allow a range of online businesses, such as publishers, advertisers and others involved in online activities, to put forward their ideas for protecting consumers' privacy and to address problems raised by consumer organisations and the Commission itself. The forum will meet three times a year from February 2010, and will discuss a number of issues including: the use of confusing privacy policies; aggressive data collection methods; the best way to get informed consent for data collection; and how to ensure users can see what information is held about them (see EUROPA Press release 12 November 2009).
Consumer concerns. Olswang collaborated with the IAB in its recent research. According to Iain Stansfield, it found that behavioural advertising had "moderate appeal" for consumers, although that grew when they were aware that it could be stopped. Also, internet users were found to be comfortable in nearly 50% of cases to provide their information online; however, that figure dropped where information such as bank details and telephone numbers were concerned.
However, some raise the question of whether there is a difference between the comfort levels of younger and older internet users. Paul Garland considers familiarity rather than age to be the main differentiating factor, "There is probably a greater understanding of behavioural advertising from people who use the internet a lot, as they are likely to know about, or be more aware, of the technical side of the internet". Calum Murray adds that these frequent users may well be within a young demographic, but agrees that age is not the determining factor when it comes to understanding or accepting behavioural advertisements.
Murray detects a certain "fear of the unknown" in the media reaction and government activity in relation to behavioural advertising. However he explains that it need not involve personal information (such as names, dates of birth or e-mail addresses) being used, only internet browsing habits, which cannot be linked to any one individual.
Privacy and consent. Ultimately, the key points for advertisers wishing to take advantage of targeted advertising are to make sure that:
The information that is gathered is not linked to any individual data.
Consent is obtained from users.
Calum Murray believes that consent is the key issue, although regulators and industry differ on how that consent should be obtained. The European Commission view, as voiced by Commissioner Viviane Reding in a recent speech, is that users should be given the option to explicitly opt in to behavioural advertising (see EUROPA Press release, The Future of the Internet and Europe's Digital Agenda, 6 October 2009). By contrast, the IAB's position is that an option to opt out should be presented to users as soon as possible (see IAB News, IAB leads behavioural advertising good practice, 4 March 2009). Murray comments that the IAB's interpretation of English law here "is slightly diluted" and that, ultimately, the requirements of EU derived legislation will prompt the UK and IAB to adopt formal opt-in procedures by 2011. There would be an interim period before this date during which an agreement on how best to implement the new opt-in procedures would need to be reached.
Murray suggests that browser companies may have to bear the burden of this process. Allowing users to adjust their browser settings to opt in to behavioural advertising may well be the best solution, as it would prepare users for the advertising mechanisms they encounter online before they have even gone online. Murray suggests that "this would involve a longer and more involved process at the initial browser set-up stage, but that the operation would only need to be done once". Garland adds that using the browser to adjust consent settings would also enable users to actively develop their awareness and education of how to control various aspects of their online experience.
The Phorm case. In the UK, the issue of behavioural advertising and privacy recently arose in relation to Phorm, a technology company that uses a form of deep-packet inspection (DPI) to monitor users' browsing habits anonymously and help clients create targeted adverts based on these habits. The main issue was whether Phorm's activities breached the Data Protection Act 1998 (see Data Protection Act 1998) and the Privacy and Electronic Communications Regulations 2003 (see Privacy and Electronic Communications Regulations 2003 (SI 2003/2426)); notably, whether the company actually processed "personal data" and whether consent from users had been obtained (see PLC IPIT, Practice note, Data protection and the internet: UK issues (www.practicallaw.com/9-107-4774) and PLC Cross-border, Article, Data Protection: UK (England and Wales) (www.practicallaw.com/0-381-0380)).
The UK Department for Business, Enterprise and Regulatory Reform (now the Department for Business, Innovation and Skills) concluded in 2008 that Phorm did not breach UK and EU data protection laws. Despite this, the European Commission brought infringement proceedings against the UK (mainly triggered in relation to when certain websites, such as UK telecoms company BT, were trialling Phorm without users' consent).
Tony Ballard from Harbottle and Lewis thinks that the UK government is right but that the EU action "reflects a concern about a lack of structure in how the UK has implemented various data protection and privacy laws, such as the Regulation of Investigatory Powers Act 2000 (RIPA, see Regulation of Investigatory Powers Act 2000) and the Privacy and Electronic Communications Regulations", and that a more systematic approach to implementation would have been helpful.
The European Commission moved to the second stage of its enforcement action at the end of October 2009. It reiterated the three issues that the UK had failed to address:
First, implementation of the provision from the Privacy and Electronic Communications Directive to have an independent authority to supervise the interception of communications, and to deal with complaints.
Second, under RIPA, the assumption that consent can be given if "there are reasonable grounds for believing" it has been given, is much wider than the EU rules stating that consent must be "freely given" and "informed".
Third, sanctions only apply to the "intentional" unlawful interception of data under RIPA, but EU law states that sanctions should apply whether the unlawful interception was intentional or not.
The Commission has given the UK two months to reply before it refers the case to the European Court of Justice (ECJ) (see Europa press release, Commission steps up UK legal action over privacy and personal data protection).
Commenting on the case, Calum Murray says, "Clearly DPI has been demonised into unpopularity, but the policy underlying the case regarding the way DPI works, coupled with the European Commission's policy regarding opt-in consent, means that we are likely to end up with opt-in consent and full disclosure about how the technology is being used". Paul Garland notes that, in the meantime, the UK's development of opt-in consent provisions may eventually provide more satisfactory answers to the Commission's concerns.
Social-networking and UGC sites. After the Phorm controversy, a number of its initial website partners (including BT) stopped using the service. In spite of this, media lawyers such as Murray and Stansfield anticipate that many of the most sophisticated internet users are likely to continue to accept targeted adverts. This is particularly the case among users of social-networking sites. Murray explains, "People want to create qualified audiences and social-networking sites create immediately focused audiences. Such site providers can then pass on focused audience information to relevant networks and advertisers". For example, if someone sets up a "fan page" devoted to a specific brand or product, this is of potential commercial importance for the brand owner.
Another development is that a number of brands have started to create their own Facebook profiles, fan pages and applications, which users can link to, to obtain information on new products and offers. This has already been particularly effective for music and film promoters, as well as for the fashion industry.
Other lucrative advertising opportunities are developing from UGC websites, such as consumer-review websites, which consumers are increasingly relying on. These have proved to be fertile ground for targeted adverts.
The above developments have given rise to a number of legal issues. First, lawyers note that they are still seeing buzz marketing on social-networking sites, which is illegal. According to Iain Stansfield, to date this ploy has tended to be obvious and derided by social-networking users, who are more technologically and brand aware than the advertisers might realise. In addition, he believes that most advertising and advertisers are generally out of step with social-networking site users, many of whom understand that sites need advertising, but do not want to be bombarded in an obvious way.
Second, the issue of demographics arises again. It could be assumed that the majority of people using social-networking sites are young, internet-savvy users, who are comfortable with the idea of leaving large amounts of personal data and information online. Despite this, there remains a question as to how truly informed these users are when it comes to matters relating to their online privacy on social-networking sites. Paul Garland notes that "many of the larger social-networking sites are starting to respond to privacy issues, and realise the benefits of dealing with users' concerns". However, other than social networks such as Facebook sending out open letters with information about the use of personal data, Murray explains that it can be a tricky situation, where sites cannot otherwise be entirely sure that the users have absorbed the information; they can only assume they have from their continued use of the websites.
Meanwhile, Tony Ballard from Harbottle and Lewis has been examining the role of internet service providers (ISPs) in social-networking sites, and has concluded that they face a number of issues. For example, it is the ISPs who manage the traffic and offer services to the customers, and therefore need to deal with the Regulations and data protection laws. However, since there is not yet any specific legislation covering responsive and behavioural adverts, ISPs of social-networking sites are finding it difficult to apply the existing legislation to these situations. He hopes that case law and legislation will be forthcoming soon to clarify the main problem areas, noting that "legislation is always behind the technology and innovation".
Another controversial area in online advertising has centred on keyword sponsorship used by search engines such as Google. Google's AdWords advertisement service allows advertisers to buy keywords (including third party names) so that a search by an internet user against that keyword results in the display of the keyword owner's advertisement. A recent example in the UK was retailer Marks & Spencer (M&S) buying keywords related to the florist, Interflora, so that its own online flower service would come up in search results alongside Interflora. These sponsored keyword advertisements are displayed alongside natural search results. Keyword advertisers pay Google each time a user accesses the advertiser's website via the relevant hyperlink on the search results page.
A number of cases have been referred to the ECJ concerning Google's alleged trade mark infringement as a result of the use of keywords that corresponded to trade marks. Paul Garland points out that companies are, of course, concerned about protecting their brands against dilution and trade mark infringement. However, he also believes that they have a very practical concern that they have to pay more for their own brand advertising in search engines, as they try and secure the spaces that competitors are now also occupying.
In France, trade mark owners (including the owners of Louis Vuitton trade marks) brought three sets of proceedings against Google. In one case, the claimants submitted evidence that searching against certain trade marks resulted in advertisements for counterfeit goods covered by those marks. In another of the cases, a trade mark owner complained that keyword searches resulted in advertisements for identical or similar products of competitors. The trade mark owners succeeded in all three cases before the French courts, which held that Google was liable for trade mark infringement. Following Google's appeal to the Cour de cassation, a number of questions were referred to the ECJ.
The ECJ ruling is currently awaited. However, in a non-binding opinion (Opinion), Advocate General Poiares Maduro stated that "Google has not infringed trade mark rights by allowing advertisers to buy keywords corresponding to registered trade marks" (see PLC IPIT Legal update, Advocate General's Opinion on Google France AdWords cases (www.practicallaw.com/7-500-2694)). The Opinion also stated that "the mere display of relevant sites in response to keywords is not enough to establish a risk of confusion on the part of consumers on the origin of goods or services". It is notable that the Opinion relates to the selection of keywords and the display of relevant advertisements but not, for example, the use of trade marks in the products sold via the sites advertised. Although the Opinion is not binding, and the full judgment of the ECJ will be published at a later date, it is likely to be influential. Garland predicts that this is likely to be the start of a wider legal debate as the legitimacy of keywords, linking and access to online content becomes a very hot topic.
Looking at the Opinion a little more closely, Alex Batteson from Linklaters LLP comments that the Advocate General was trying to take too broad an approach to the way in which Google operates its keywords service, and that each case should be assessed on an individual basis. He considers that the Advocate General's analysis was flawed, as he had conflated consumer confusion with the fourth step in the earlier four-part test the ECJ had set out for trade mark infringement under Article 5(1)(a) of the EU Trade Marks Directive (89/104/EEC) (from Céline SARL v Céline SA, Case C-17/06). This stated that a trade mark would be infringed if:
It was used in the course of business.
It was used without the owner's consent.
It was used in relation to identical goods or services.
Its use affected the functions of the trade mark, such as guaranteeing the origin of the goods or services.
Batteson explains that the ECJ's point in the fourth step was that "a purely descriptive use of a trade mark was not liable to violate the function of the trade mark", but that if the trade mark was used to give the impression that there was a connection between the identical goods or services and the trade mark, then it would be an infringement. The Advocate General in the Louis Vuitton case "conflates this test with the need to establish the risk of consumer confusion", and there is no need to do this when establishing trade mark infringement in relation to identical goods and services. As it is, the Advocate General has set a more difficult test for trade mark owners to pass. Batteson points out that the final ECJ judgment could also potentially agree that this second element of consumer confusion is superfluous, so "it is by no means over for brand owners yet".
The Advocate General also stated that a balancing exercise was needed between the protection of trade marks with reputation and the need for freedom of expression on the internet. He considered that the need for freedom of expression should outweigh the trade mark owners' need for protection, as allowing protection could lead to them having too much control over the use of their trade marks on the internet. Alex Batteson argues that this is developing new ground for trade mark law, "The conclusions the Advocate General reaches, are too broad to apply to keyword services on a global scale". As was stated by the ECJ in Anheuser-Busch (Anheuser-Busch Inc v Budejovický Budvar, Case C-245/02 at para. 61) whether a sign is being used as a trade mark is a question of fact which can only be decided in light of the specific circumstances of each case. It remains to be seen whether the ECJ will come to a global decision, or whether it will endorse an approach of national courts deciding on a case-by-case basis.
Ultimately, many commentators believe that Google and other sellers of keywords will probably be allowed to continue to operate sponsored keyword services, but perhaps with some restrictions and some self-regulatory principles in place. As a result, Paul Garland predicts that disgruntled companies will probably try taking a different tack in the future and, rather than looking to the search engines, will instead more commonly attempt to sue the competitor who is buying the keyword.
An example of this is the Interflora case in the UK, where Interflora is claiming that M&S has infringed its trade marks in a number of ways, including its selection and nomination of "Interflora" words as keywords. M&S argues, among other things, that consumers are unlikely to confuse the two companies and services. The case has now been referred to the ECJ, and the eventual outcome could be decisive in its implications for advertisers (see PLC IPIT Legal update, High Court to refer questions to ECJ in Interflora Google Adwords dispute (www.practicallaw.com/8-385-9669)). (The ECJ published the detailed questions referred to it by the High Court in this case in November 2009.)
At the time of writing, there were around six cases pending against Google before the ECJ.
The European Regulations aimed at unfair and misleading advertising and marketing practices came into force in May 2008. Notably:
The Consumer Protection from Unfair Trading Regulations 2008 (CPRs) prohibit unfair commercial practices aimed at consumers (see Consumer Protection from Unfair Trading Regulations 2008 (SI 2008/1277) and PLC Commercial, Practice note, Consumer Protection from Unfair Trading Regulations 2008 (www.practicallaw.com/2-381-1492)).).
The Business Protection from Misleading Marketing Regulations 2008 (BPRs) prohibit misleading commercial practices that occur between businesses (see Business Protection from Misleading Marketing Regulations 2008 (SI 2008/1276), and PLC Commercial, Practice note, Business Protection from Misleading Marketing Regulations 2008 (www.practicallaw.com/9-383-8073)).
Both Regulations set out the definitions of "unfair" and "misleading" commercial practices. In the CPRs, for example:
A commercial practice is "unfair" (Regulation 3) if:
the practice contravenes the professional standards expected of diligence;
the practice materially affects or distorts the behaviour of an average consumer towards a particular product.
A commercial practice is "misleading" (Regulation 5) if:
the information given in an advert is not truthful, or in its presentation deceives or is likely to deceive a consumer. This can also apply even if the information given is factually correct, but is still considered deceptive. This includes comparative adverts, where the marketing could confuse, or be likely to confuse, a consumer through the use of trade names, trade marks, or any other distinguishing features of a competitor's product;
the misleading action materially distorts the behaviour of the consumer.
Misleading omissions are also prohibited in certain circumstances (Regulation 6).
The BPRs set out parallel definitions of misleading practices in adverts and marketing aimed at traders (Regulation 3). They also deal with the limits of comparative advertising and set out what conditions must be met for comparative adverts to be legitimate. These include that:
The adverts must not be misleading under Regulation 3.
The adverts must not contain misleading information, or contain misleading omissions, under Regulations 5 and 6 of the CPRs.
The products compared must meet the same needs or be intended for the same purpose.
The adverts must objectively compare one or more "material, relevant, verifiable and representative features" of the products, which can include price.
The adverts must not create confusion in terms of identifying who is the advertiser and the competitor, and between the trade marks, trade names or other distinguishing marks of the advertiser and competitor.
The adverts must not discredit or denigrate the trade marks or trade names, products or distinguishing marks of a competitor.
The adverts must not take unfair advantage of the reputation of a trade mark, trade name or other distinguishing marks of a competitor.
The adverts must not present replicas or imitations of products bearing protected trade marks or trade names.
The Regulations can only be enforced by the OFT and trading standards officers. Offending advertisers can be subject to a £5000 maximum fine, as well as a two-year maximum prison sentence in the most serious cases.
Advertisers have various defences available to them, such as those set out in Regulation 17 of the CPRs (with a parallel provision in Regulation 11 of the BPRs).
For more analysis of the Regulations and their effect on online advertising, see PLC IPIT, Article, The impact of the new consumer and business protection regulations on online advertising and marketing practices (www.practicallaw.com/7-382-5397)).
The US has been at the forefront of the development of online advertising and, as a result, has had to deal with a number of legal issues and concerns similar to those that have arisen in Europe.
As in Europe, some of the main issues stem from privacy and data protection concerns relating to behavioural and targeted advertising.
The US has both federal and state privacy legislation. At federal level, the legislation tends to focus on protecting certain types of data, most notably, that relating to children, financial data or health insurance. For example:
The Children's Online Privacy Protection Act 1998 (COPPA) requires online advertisers to obtain consent in order to collect and use personal information to target adverts at children under 13.
The Health Insurance Privacy and Portability Act 1996 (HIPPA) is designed to make sure that people's health insurance details are kept private; very strict permissions are needed to trade these on the internet or elsewhere in the US.
Some state-level legislation has gone even further. For example, in Maine, controversial legislation was passed prohibiting the collection of any information from children under 18 without prior parental consent (see Maine Legislature, An Act to Prevent Predatory Marketing Practices Against Minors). Ben Mulcahy from Sheppard Mullin in New York explains that many advertisers and companies considered this law a step too far, and possibly even as "unconstitutional and violating the First Amendment, as well as restricting inter-state commerce". It also overlapped with existing provisions in COPPA.
In September 2009, the law was successfully challenged, with the court ruling that it needed to be re-written and would not be enforced in its current state. However, despite this, private individuals can still use it to bring lawsuits until it is amended in early 2010, which is obviously a concern for both lawyers and advertisers.
Reed Freeman from Morrison and Foerster's Washingon DC office is predicting that more states will consider, and that some may pass, legislation covering online privacy in the future and that this remains an area to watch.
There has been significant debate in the US over the various merits and disadvantages of behavioural advertising practices. However, the Federal Trade Commission (FTC), whose remit includes the regulation of commercial activities that are unfair or deceptive, has continued to allow self-regulation in this area, although it has been discussing and investigating public and consumer privacy issues relating to online advertising for a number of years.
Recent FTC initiatives. In February 2009, the FTC released a new report and updated guidelines on the self-regulation of behavioural advertising. In these guidelines, it reiterated that notice regarding the tracking of online browsing should be displayed obviously outside the privacy policy and should be "clear and prominent". The definition of personal data was also defined as "any data that reasonably can be associated with a particular consumer, computer or other device" (see FTC Press release, FTC Staff Revises Online Behavioural Advertising Principles, 12 February 2009).
However, Commissioner Jon Leibowitz warned the industry that "This could be the last clear chance to show that self-regulation can and will effectively protect consumers' privacy in a dynamic online marketplace", indicating that there is a real risk that legislation could be introduced in the future. Another FTC Commissioner, Pamela Harbour, also recommended that FTC staff complete another report on self-regulation and its effectiveness for publication in the summer of 2010.
Also indicative of the possible change in mood at the FTC is the enforcement action it brought against US shopping chain, Sears, in August 2009 (see FTC Decision and Order, In the Matter of Sears Holdings Management Corporation, Docket No. C-4264, 31 August 2009). Sears had invited customers to download software that enabled their browsing habits to be tracked, in return for a small payment. However, the software also tracked customers' bank and health insurance details. The FTC:
Ruled that the latter practice had not been adequately explained to customers in Sears' user licence agreement, and was therefore deceptive.
Ordered, among other things, that all the information Sears had collected be destroyed.
Although the tracking of consumer browsing habits in this case did not relate to behavioural advertising in particular, the case and decision are still significant for the practice.
The industry response. While the FTC was compiling its updated principles in early 2009, a group of advertising organisations (including the American Association of Advertising Agencies, the Association of National Advertisers, the Council of Better Business Bureau, the Direct Marketing Association and the Interactive Advertising Bureau) decided to compile a new set of self-regulatory principles. (This was partly in response to criticism that the existing self-regulatory guidelines, developed by the Network Advertising Initiative (NAI), a trade association of online advertising companies, were too narrow and only applied to NAI members.)
The new self-regulatory principles were published in July 2009 and:
Include a definition of behavioural advertising, which is more precisely worded than the FTC's definition (see Self-Regulatory Principles for Online Behavioural Advertising, July 2009).
Consist of seven principles relating to the education of consumers and businesses about online behavioural advertising, transparency, consumer control, data security, material changes, sensitive data and accountability.
Separate the responsibilities of the main parties involved in the behavioural advertising industry - service providers, publishers or websites, advertisers and advertising agencies.
Reed Freeman points out that there are some differences between the new self-regulating principles and the FTC's guidance, particularly on the issue of notice. While the FTC states simply that notice must be clearly given outside the privacy policy of the website, the self-regulatory principles are more specific and provide that the notice should appear either on the website, or near or around the tailored advert. A question arises as to who will be responsible for the giving of notice, and which of the two methods should prevail.
Freeman considers that, of the four main players in the online advertising arena, it is likely to be the advertising service providers, such as the online advertising networks, that "are going to end up providing the notice, most likely with an icon in or around the advert".
However, the release of the new industry self-regulatory programme, with its various compliance and registration materials will clarify the issue for advertisers in terms of how to give notice.
The FTC held the first of a three-part round-table conference on consumer privacy in the online arena on 7 December 2009 (see FTC Press release, FTC to Host Public Roundtables to Address Evolving Consumer Privacy Issues, 15 September 2009). The second event will be held on 28 January 2010, and the final event will be held on 17 March 2010. Many commentators consider that this (along with the other recent FTC initiatives in the area (see above, Recent FTC initiatives) may indicate that the agency is now in favour of a more rules-based approach. According to Freeman, "It might not be out of the question for the FTC to ask Congress for authority to actively regulate in the online privacy arena, including through the promulgation of new trade regulation rules. But whatever happens, 2010 will be a watershed year for privacy".
With more regulation on the cards, it is likely that the online industry will increase its efforts to demonstrate to the FTC that self-regulation is properly protecting consumer privacy, and that over-regulation in this area would be harmful to the industry and the internet as a whole.
Ben Mulcahy predicts that advertisers will continue improving self-regulation because of the "fear of government over-regulation and a corresponding risk of liability". Reed Freeman adds, "Online behavioural advertising, as a business practice, is not inherently deceptive or unfair. It is an emerging and successful practice, not just for developed websites, but also for emerging websites, which drive the growth of the internet, but which also have difficulty selling their advertising inventory".
As in Europe (see main text, Keyword advertising), Google's AdWords service has resulted in a number of lawsuits in the US, based on trade mark infringement and other claims.
To date, the US courts have been very inconsistent in how they are approaching the issues raised. As a result, commentators have noticed a number of companies "forum shopping", or suing in states where the courts have decided against Google in the past. In addition, Ben Mulcahy explains that there has not yet been been a decision by the Supreme Court (or a court of significant national standing) on the issues to "lay out the rules that everyone else needs to follow". He does think, however, that if the courts were to decide against Google in a broad ruling, Congress would most likely enact legislation to allow the company to continue with its service, "The harm that would come from preventing all advertisers from using AdWords would likely be greater than the alleged harm that is occurring to the few companies whose trade marks are allegedly being infringed". He also adds that since Google "is not geographically constrained", the courts would also have to take different jurisdictions' sensitivities into account when making any decisions.
One of the arguments that companies are relying on, along with trade mark infringement, is "initial interest confusion". This was first used in the US in the late 1990s and is also being used in the European Google cases. The argument is that a consumer who types a product or name into a search engine could become confused when another product or company comes up in the search results. However, Mulcahy believes that "consumers are becoming more sophisticated in their understanding that there is a difference between 'sponsored' search results and organic search results" and that early concepts like "initial interest confusion" are evolving and losing some relevance in today's online market.