Behavioral advertising—the use of information concerning a user's online behavior to deliver ads targeted at the user's interests—has been the focus of increased regulatory and Congressional scrutiny. Up to this point, however, policymakers have not imposed mandatory regulations on this practice. Instead, in December 2007, the Federal Trade Commission (FTC) staff released a set of proposed principles to guide self-regulation in this area. Acting at least partly in response to the FTC's action, and after wide consultation with industry and regulators, on December 16, 2008, the Network Advertising Initiative (NAI)—a prominent self-regulatory organization composed of businesses in the online advertising marketplace—released a set of binding principles governing the collection, use and sharing of information by companies engaged in behavioral advertising.

The principles govern Online Behavioral Advertising (OBA), which is defined to include any process whereby data are collected across multiple web domains owned or operated by multiple entities to categorize likely consumer interest segments for use in advertising online. They also apply to "ad delivery and reporting," defined as "the logging of page views or the collection of other information about a browser for the purpose of delivering ads or providing advertising-related services," including the provision of specific advertisements based on the type of browser or time of day, statistical reporting and tracking the number of ads served to a particular website.

At their core, the principles are based on requirements to provide notice and choice. All NAI members engaged in OBA or ad delivery and reporting are required to clearly and conspicuously post a notice on their websites that describes their data collection, transfer and use practices. Such notice is to include a description of the member's OBA and ad delivery and reporting practices, the types of data collected, the use and transfer of data, the types of non-personally-identifiable information that may be merged with personally-identifiable information, an easy mechanism for exercising choice with regard to such data and the approximate length of time data is retained. Further, each member must ensure that websites with which they contract for OBA or multi-site ad delivery and reporting services also clearly and conspicuously post notice of their OBA practices and make reasonable efforts to ensure that all companies participating in their OBA or ad delivery and reporting services furnish the required notice.

Members also are required to provide consumers with choices concerning the use of information for OBA. The level of choice members must provide depends on the type of data at issue and the manner in which it is intended to be used. Use of "sensitive" information for OBA, such as social security and account numbers, real-time geographic location and medical information, requires opt-in consent. Use of personally-identifiable information to be merged with previously-collected, non-personally identifiable information also requires opt-in consent. Merging personally-identifiable information with non-personally-identifiable information on a going-forward basis requires a method by which customers may opt out. And the use of non-personally-identifiable information also requires an opt-out mechanism.

In addition to these notice and consent requirements, the NAI principles impose a number of other duties on members in connection with OBA. Members are to collectively maintain an NAI website to provide centralized explanations of OBA and their compliance with the NAI principles and to use reasonable efforts to educate consumers about behavioral advertising and the choices available to consumers with respect to such advertising. Further, the information collected may be used for marketing purposes only, and no use of information about children under 13 is permitted without verifiable parental consent. Members also must provide consumers with reasonable access to their personally-identifiable information and other information that is associated with it, make reasonable efforts to ensure that they obtain data from reliable sources, and provide reasonable security for the data.

The NAI principles will not only govern the members (which include prominent companies such as Google and Yahoo! and other leading advertising networks), but are likely to be a model for others who are involved in OBA. Whether Congress and regulators will be content to rely on industry self-regulation of behavioral advertising, especially in the wake of the election, remains to be seen. Congressional hearings during 2008, for example, suggested significant concern about the privacy implications of particular Internet Service Provider-based behavioral advertising on the part of privacy advocates, consumer organizations and others. It seems highly likely that Congress, the FTC and other policymakers will continue to monitor industry practices and developments closely to determine whether they should impose mandatory regulations.