01:36 PM
Connect Directly

Online Advertisers Pitch Self-Regulation Framework

Microsoft, Google, and other companies are backing a European proposal governing how advertisers can track people's behavior online.

Trade association IAB Europe released a framework for online behavioral tracking last week that would allow European advertisers to self-regulate. The framework would also require a single, standard icon to be used on any website that uses advertising or tracking, as well as enable consumers to review a site's data collection practices and allow them to opt out of online behavioral tracking.

The Online Behavioral Advertising--as the industry prefers to call it--Framework is a pitch by IAB Europe to the European Commission, which has called on the industry to self-regulate. IAB Europe operates in 29 countries and has 5,000 individual members. So far, 39 IAB Europe corporate members--including Adconion, Google, Microsoft, United Internet Media, and ValueClick--have said they will comply with the framework. IAB Europe has also pledged that at least 70% of its members would be in compliance by June 2012.

Interesting, the United States appears to be taking a different tack to controlling advertisers and online behavior tracking. While there's no legislation yet on the books, in December, a Federal Trade Commission official declared that self-regulation for advertisers had failed, at the cost of consumers' privacy, and called for regulation. Meanwhile, a privacy bill recently introduced by Senators John Kerry (D-Mass.) and John McCain (R-Ariz.) would enable consumers to opt out of online tracking, and also to correct incorrect details stored about then.

One explanation for the apparent dissonance in approaches--privacy-friendly Europe allowing advertisers to self-regulate, versus pro-business America regulating advertisers--is that when it comes to privacy law, Europe is already far ahead, and able to proceed accordingly.

"In Europe, we already had a legal framework for privacy in general, and that does not exclude online," Kimon Zorbas, VP of IAB Europe, said in an interview. For example, Europeans have the right to correct--if there's been a mistake--or delete any information that advertisers store about them. "We understand that in the U.S., all of that is not regulated yet," he said.

Furthermore, IAB Europe's self-regulatory proposal is a direct response to the European Union telling the industry to take its best shot. In a September 2010 speech, European Commission VP Neelie Kroes, who's responsible for Europe's "digital agenda," told attendees at an IAB Europe-sponsored roundtable that "many of the 'free' services now used by billions on the Internet would not be possible without the income derived from the various forms of online advertising."

But she warned that not everyone wants to buy in to that paradigm. "The catch is that personal preferences vary. What is efficient to one consumer can be irritating to another. What is helpful to one citizen is an invasion of privacy to another. And there must be an effective means for personal preferences to be respected," she said.

Accordingly, Kroes called for a self-regulatory framework that builds on existing data regulations, includes greater transparency for users--so they know how they're being targeted--and requires users' consent to being tracked. A user-friendly and possibly browser-based approach would also be necessary, as would an approach that didn't "bury the necessary information deep in a website's privacy policies," she said.

Finally, Kroes said that self-regulation would have to include simple, clear, and effective enforcement, backed by third-party auditing. "If there is no way to detect breaches and enforce sanctions against those who break the rules, then self-regulation will not only be a fiction, it will be a failure," she said.

According to IAB Europe's Zorbas, the OBA Framework meets all of those requirements. In terms of sanctions, he said that OBA Framework compliance would be coordinated by the non-profit European Advertising Standards Alliance, which already coordinates the national bodies across Europe that enforce advertising standards both online and offline. Those bodies are typically independent, and have the wherewithal and power to punish any advertiser who steps out of line. In addition, the framework would require any advertisers that use behavior tracking to comply with a more stringent program involving third-party auditing, and avoid tracking the behavior of anyone under the age of 13.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.