Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Online Advertisers Pitch Self-Regulation Framework

Microsoft, Google, and other companies are backing a European proposal governing how advertisers can track people's behavior online.

Trade association IAB Europe released a framework for online behavioral tracking last week that would allow European advertisers to self-regulate. The framework would also require a single, standard icon to be used on any website that uses advertising or tracking, as well as enable consumers to review a site's data collection practices and allow them to opt out of online behavioral tracking.

The Online Behavioral Advertising--as the industry prefers to call it--Framework is a pitch by IAB Europe to the European Commission, which has called on the industry to self-regulate. IAB Europe operates in 29 countries and has 5,000 individual members. So far, 39 IAB Europe corporate members--including Adconion, Google, Microsoft, United Internet Media, and ValueClick--have said they will comply with the framework. IAB Europe has also pledged that at least 70% of its members would be in compliance by June 2012.

Interesting, the United States appears to be taking a different tack to controlling advertisers and online behavior tracking. While there's no legislation yet on the books, in December, a Federal Trade Commission official declared that self-regulation for advertisers had failed, at the cost of consumers' privacy, and called for regulation. Meanwhile, a privacy bill recently introduced by Senators John Kerry (D-Mass.) and John McCain (R-Ariz.) would enable consumers to opt out of online tracking, and also to correct incorrect details stored about then.

One explanation for the apparent dissonance in approaches--privacy-friendly Europe allowing advertisers to self-regulate, versus pro-business America regulating advertisers--is that when it comes to privacy law, Europe is already far ahead, and able to proceed accordingly.

"In Europe, we already had a legal framework for privacy in general, and that does not exclude online," Kimon Zorbas, VP of IAB Europe, said in an interview. For example, Europeans have the right to correct--if there's been a mistake--or delete any information that advertisers store about them. "We understand that in the U.S., all of that is not regulated yet," he said.

Furthermore, IAB Europe's self-regulatory proposal is a direct response to the European Union telling the industry to take its best shot. In a September 2010 speech, European Commission VP Neelie Kroes, who's responsible for Europe's "digital agenda," told attendees at an IAB Europe-sponsored roundtable that "many of the 'free' services now used by billions on the Internet would not be possible without the income derived from the various forms of online advertising."

But she warned that not everyone wants to buy in to that paradigm. "The catch is that personal preferences vary. What is efficient to one consumer can be irritating to another. What is helpful to one citizen is an invasion of privacy to another. And there must be an effective means for personal preferences to be respected," she said.

Accordingly, Kroes called for a self-regulatory framework that builds on existing data regulations, includes greater transparency for users--so they know how they're being targeted--and requires users' consent to being tracked. A user-friendly and possibly browser-based approach would also be necessary, as would an approach that didn't "bury the necessary information deep in a website's privacy policies," she said.

Finally, Kroes said that self-regulation would have to include simple, clear, and effective enforcement, backed by third-party auditing. "If there is no way to detect breaches and enforce sanctions against those who break the rules, then self-regulation will not only be a fiction, it will be a failure," she said.

According to IAB Europe's Zorbas, the OBA Framework meets all of those requirements. In terms of sanctions, he said that OBA Framework compliance would be coordinated by the non-profit European Advertising Standards Alliance, which already coordinates the national bodies across Europe that enforce advertising standards both online and offline. Those bodies are typically independent, and have the wherewithal and power to punish any advertiser who steps out of line. In addition, the framework would require any advertisers that use behavior tracking to comply with a more stringent program involving third-party auditing, and avoid tracking the behavior of anyone under the age of 13.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety r...