The Federal Trade Commission recognizes that many people benefit from companies’ online tracking by getting advertising that is more targeted to their preferences. However, as the technologies and techniques used by companies and advertisers to uniquely identify and track individuals’ online behavior advances, the FTC warns that companies’ privacy disclosures and practices must be updated. Failure to do so could be considered deceptive under the FTC Act.
Since most data collection and online tracking is invisible to consumers, the FTC says that companies must clearly and prominently disclose such practices and provide users with choices, such as easy-to-use tools to block all methods used to track their activity online and across devices. Organizations, such as the Network Advertising Initiative and the Digital Advertising Alliance, offer tools to help individuals limit the collection and use of their data for targeted advertising.
It is also important to keep in mind that the FTC considers persistent identifiers (such as device identifiers, MAC addresses, static IP addresses and cookies) as personally identifiable data if they can be reasonably linked to a particular individual, computer or device. Companies that use persistent identifiers to compile data about users should not automatically assume that the data collected is anonymous data and thus not subject to privacy laws and regulations. The FTC expects companies to provide appropriate protections for all data, and not just data associated with a person’s name or email address. As the sophistication of gathering consumer information increases, it is important if not imperative for companies that collect such information to be aware of the existing policies and the FTC’s position.
When it comes to privacy, the environment is constantly changing. This new guidance from the FTC is the latest of what will likely be many attempts to strike that balance between commoditizing information and protecting it, and companies should keep abreast of any changes.