Risk
4/18/2011
01:36 PM
50%
50%

Online Advertisers Pitch Self-Regulation Framework

Microsoft, Google, and other companies are backing a European proposal governing how advertisers can track people's behavior online.

Trade association IAB Europe released a framework for online behavioral tracking last week that would allow European advertisers to self-regulate. The framework would also require a single, standard icon to be used on any website that uses advertising or tracking, as well as enable consumers to review a site's data collection practices and allow them to opt out of online behavioral tracking.

The Online Behavioral Advertising--as the industry prefers to call it--Framework is a pitch by IAB Europe to the European Commission, which has called on the industry to self-regulate. IAB Europe operates in 29 countries and has 5,000 individual members. So far, 39 IAB Europe corporate members--including Adconion, Google, Microsoft, United Internet Media, and ValueClick--have said they will comply with the framework. IAB Europe has also pledged that at least 70% of its members would be in compliance by June 2012.

Interesting, the United States appears to be taking a different tack to controlling advertisers and online behavior tracking. While there's no legislation yet on the books, in December, a Federal Trade Commission official declared that self-regulation for advertisers had failed, at the cost of consumers' privacy, and called for regulation. Meanwhile, a privacy bill recently introduced by Senators John Kerry (D-Mass.) and John McCain (R-Ariz.) would enable consumers to opt out of online tracking, and also to correct incorrect details stored about then.

One explanation for the apparent dissonance in approaches--privacy-friendly Europe allowing advertisers to self-regulate, versus pro-business America regulating advertisers--is that when it comes to privacy law, Europe is already far ahead, and able to proceed accordingly.

"In Europe, we already had a legal framework for privacy in general, and that does not exclude online," Kimon Zorbas, VP of IAB Europe, said in an interview. For example, Europeans have the right to correct--if there's been a mistake--or delete any information that advertisers store about them. "We understand that in the U.S., all of that is not regulated yet," he said.

Furthermore, IAB Europe's self-regulatory proposal is a direct response to the European Union telling the industry to take its best shot. In a September 2010 speech, European Commission VP Neelie Kroes, who's responsible for Europe's "digital agenda," told attendees at an IAB Europe-sponsored roundtable that "many of the 'free' services now used by billions on the Internet would not be possible without the income derived from the various forms of online advertising."

But she warned that not everyone wants to buy in to that paradigm. "The catch is that personal preferences vary. What is efficient to one consumer can be irritating to another. What is helpful to one citizen is an invasion of privacy to another. And there must be an effective means for personal preferences to be respected," she said.

Accordingly, Kroes called for a self-regulatory framework that builds on existing data regulations, includes greater transparency for users--so they know how they're being targeted--and requires users' consent to being tracked. A user-friendly and possibly browser-based approach would also be necessary, as would an approach that didn't "bury the necessary information deep in a website's privacy policies," she said.

Finally, Kroes said that self-regulation would have to include simple, clear, and effective enforcement, backed by third-party auditing. "If there is no way to detect breaches and enforce sanctions against those who break the rules, then self-regulation will not only be a fiction, it will be a failure," she said.

According to IAB Europe's Zorbas, the OBA Framework meets all of those requirements. In terms of sanctions, he said that OBA Framework compliance would be coordinated by the non-profit European Advertising Standards Alliance, which already coordinates the national bodies across Europe that enforce advertising standards both online and offline. Those bodies are typically independent, and have the wherewithal and power to punish any advertiser who steps out of line. In addition, the framework would require any advertisers that use behavior tracking to comply with a more stringent program involving third-party auditing, and avoid tracking the behavior of anyone under the age of 13.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7241
Published: 2014-12-19
The TSUTAYA application 5.3 and earlier for Android allows remote attackers to execute arbitrary Java methods via a crafted HTML document.

CVE-2014-7249
Published: 2014-12-19
Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT-8848, AT-9816GB, AT-9924T, AT-9924Ts, CentreCOM AR415S, CentreCOM AR450S, CentreCOM AR550S, CentreCOM AR570S, CentreCOM 8700SL, CentreCOM 8948XL, CentreCOM 992...

CVE-2014-7267
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the output-page generator in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-7268.

CVE-2014-7268
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the data-export feature in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-7267.

CVE-2014-8272
Published: 2014-12-19
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.