Risk
4/18/2011
01:36 PM
Connect Directly
RSS
E-Mail
50%
50%

Online Advertisers Pitch Self-Regulation Framework

Microsoft, Google, and other companies are backing a European proposal governing how advertisers can track people's behavior online.

Trade association IAB Europe released a framework for online behavioral tracking last week that would allow European advertisers to self-regulate. The framework would also require a single, standard icon to be used on any website that uses advertising or tracking, as well as enable consumers to review a site's data collection practices and allow them to opt out of online behavioral tracking.

The Online Behavioral Advertising--as the industry prefers to call it--Framework is a pitch by IAB Europe to the European Commission, which has called on the industry to self-regulate. IAB Europe operates in 29 countries and has 5,000 individual members. So far, 39 IAB Europe corporate members--including Adconion, Google, Microsoft, United Internet Media, and ValueClick--have said they will comply with the framework. IAB Europe has also pledged that at least 70% of its members would be in compliance by June 2012.

Interesting, the United States appears to be taking a different tack to controlling advertisers and online behavior tracking. While there's no legislation yet on the books, in December, a Federal Trade Commission official declared that self-regulation for advertisers had failed, at the cost of consumers' privacy, and called for regulation. Meanwhile, a privacy bill recently introduced by Senators John Kerry (D-Mass.) and John McCain (R-Ariz.) would enable consumers to opt out of online tracking, and also to correct incorrect details stored about then.

One explanation for the apparent dissonance in approaches--privacy-friendly Europe allowing advertisers to self-regulate, versus pro-business America regulating advertisers--is that when it comes to privacy law, Europe is already far ahead, and able to proceed accordingly.

"In Europe, we already had a legal framework for privacy in general, and that does not exclude online," Kimon Zorbas, VP of IAB Europe, said in an interview. For example, Europeans have the right to correct--if there's been a mistake--or delete any information that advertisers store about them. "We understand that in the U.S., all of that is not regulated yet," he said.

Furthermore, IAB Europe's self-regulatory proposal is a direct response to the European Union telling the industry to take its best shot. In a September 2010 speech, European Commission VP Neelie Kroes, who's responsible for Europe's "digital agenda," told attendees at an IAB Europe-sponsored roundtable that "many of the 'free' services now used by billions on the Internet would not be possible without the income derived from the various forms of online advertising."

But she warned that not everyone wants to buy in to that paradigm. "The catch is that personal preferences vary. What is efficient to one consumer can be irritating to another. What is helpful to one citizen is an invasion of privacy to another. And there must be an effective means for personal preferences to be respected," she said.

Accordingly, Kroes called for a self-regulatory framework that builds on existing data regulations, includes greater transparency for users--so they know how they're being targeted--and requires users' consent to being tracked. A user-friendly and possibly browser-based approach would also be necessary, as would an approach that didn't "bury the necessary information deep in a website's privacy policies," she said.

Finally, Kroes said that self-regulation would have to include simple, clear, and effective enforcement, backed by third-party auditing. "If there is no way to detect breaches and enforce sanctions against those who break the rules, then self-regulation will not only be a fiction, it will be a failure," she said.

According to IAB Europe's Zorbas, the OBA Framework meets all of those requirements. In terms of sanctions, he said that OBA Framework compliance would be coordinated by the non-profit European Advertising Standards Alliance, which already coordinates the national bodies across Europe that enforce advertising standards both online and offline. Those bodies are typically independent, and have the wherewithal and power to punish any advertiser who steps out of line. In addition, the framework would require any advertisers that use behavior tracking to comply with a more stringent program involving third-party auditing, and avoid tracking the behavior of anyone under the age of 13.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.