The National Advertising Initiative: What the NAI Does

Report home | Read the report (PDF) | Previous section | Next section

The essential activity of the NAI is to define terms, discuss a handful of abbreviated consumer rights, which the NAI calls its “principles,” and to set up a structure of “opt-out cookies.”

The principles of the NAI are as follows:

I. Network Advertising Initiative (“NAI”) Overview

A. Network advertisers will adhere to the Online Privacy Alliance (“OPA”) Privacy Policies Guidelines for personally identifiable information.

B. Network advertisers will not use sensitive personally identifiable data for online preference marketing.

C. Network advertisers will not, without prior affirmative consent (“opt-in”), merge personally identifiable information with information previously collected as non-personally identifiable information.

D. Network advertisers will provide consumers with robust notice and choice regarding the merger of personally identifiable information with non- personally identifiable information collected on a going forward basis for online preference marketing.

E. Network advertisers will not use personally identifiable information (“PII”) consisting of PII collected offline merged with PII collected online for online preference marketing unless the consumer has been afforded robust notice and choice about such merger before it occurs.

F. Network advertisers will require Web publishers with which they have contractual relationships to provide notice and choice regarding the collection of non-personally identifiable information for online preference marketing.

The principles are discussed in more detail in the body of NAI’s 21-page agreement. [19]

The Underlying Concept of Online in the NAI Agreement and its Impact

NAI’s basic approach to what online means is foundational to the functioning of the agreement.

First, the NAI generally conceives of online as a computer connected to the web.
Second, protections for consumers are built on this definition. As a result the NAI opt-out cookie (the core of the consumer protections) is conceived of as being delivered via the web to a computer accessing the web.

For example, in the FTC’s report to Congress, the Commission defined online advertising largely as “banner ads displayed on Web pages – small graphic advertisements that appear in boxes above or to the side of the primary site content. Currently, tens of billions of banner ads are delivered to consumers each month as they surf the World Wide Web.”[20]

The FTC’s description of how online behavioral marketing worked was tied closely to the NAI’s conception of online. The FTC wrote:

An Illustration of How Network Profiling Works
Online consumer Joe Smith goes to a Web site that sells sporting goods. He clicks on the page for golf bags. While there, he sees a banner ad, which he ignores as it does not interest him. The ad was placed by USAad Network. He then goes to a travel site and enters a search on “Hawaii.” USAad Network also serves ads on this site, and Joe sees an ad for rental cars there. Joe then visits an online bookstore and browses through books about the world’s best golf courses. USAad Network serves ads there, as well. A week later, Joe visits his favorite online news site, and notices an ad for golf vacation packages in Hawaii. Delighted, he clicks on the ad, which was served by the USAad Network. Later, Joe begins to wonder whether it was a coincidence that this particular ad appeared and, if not, how it happened. [21]

The profile describes more activities, and discusses cookies:

If an USAad cookie is not already present on Joe’s computer, USAad will place a cookie with a unique identifier on Joe’s hard drive. [22]

Note the emphasis on the use of computers and cookies.

From Kindergarten to Grad School: Maturation of the Behavioral Advertising Sector

The original description of profiling was fine for 2000, but it is out-of-date for 2007. The older profiling scenario still occurs, but profiling has matured significantly beyond this scenario. Even members of the advertising industry recognize this. TruEffect, an ad serving company, wrote in October, 2007, comments filed with the FTC that:

The NAI “opt out” provisions were an essential step to ensure that ad servers offer consumers the option to participate or decline participation in online advertising tracking. Yet it’s been eight years since the NAI principles were developed, and as the ad serving industry continues to evolve and change, they likely need to be revisited. [23]

The NAI opt-out cookie is squarely based on this kind of conceptualization of online. The NAI essentially limits itself to protecting consumers who are surfing the web from a computer and who download web-based NAI opt-out cookies – that was the model at the time. So under the 2000 NAI model, consumers who did not want their online computer activities tracked or their offline data merged with online data could download the NAI opt-out cookie. The opt-out cookie functioned to stop cookie-based profiling. [24]

So, for example, if a consumer with an NAI opt-out cookie browsed a shopping web site and bought something, a third-party network advertiser that tracked activities on the web site would not use the information to profile that consumer over time. When the consumer visited other web sites where the network advertiser employed tracking technologies, such as web beacons or pixel gifs or more cookies, the network advertiser would still not track that consumer because of the NAI opt-out cookie.

The New Scenario

In 2007, the online opt-out may still function, but an opt-out limited to classic web activity on a personal computer is myopic. Online today can mean a mobile phone or a Blackberry retrieving video, music, books, streams of text messages, or other forms of information. Video formats of ads allow for different kinds of tracking that go beyond what the NAI contemplated. Simply put, online today is much broader than an individual sitting at a computer connected to the Internet. Internet advertiser TruEffect acknowledges this in their comments to the FTC:

The Internet is no longer defined by servers and browsers exchanging information across copper and fiber. Going forward, data about consumer behavior will not be mediated by the cookie facility embedded in browser software, the management of which we have addressed to a degree through the NAI principles. With the explosive growth of digitally addressable media including digital cable, satellite TV, and mobile, our customers are looking to us to provide technology solutions that will extend census-based measurement and dynamic targeting technology to these other channels. [25] [Emphasis added.]

The NAI agreement essentially limits itself to protecting consumers who are surfing the web from a computer and who download web-based opt-out cookies. [26] These foundational ideas undermine the effectiveness of the NAI in today’s sophisticated ad sector. The NAI agreement, even if it functioned as designed, is simply not as useful today as a consumer protection instrument because the NAI has not been updated while the world has changed around it.

If the NAI self-regulation no longer adequately protects consumers, then that self- regulation has failed in its purpose. It is unlikely that any self-regulation scheme can successfully do the job it was intended to do when its foundation was built on rapidly aging models and when the self-regulatory organization has not updated that foundation.

_______________________________

Endnotes

[19] Network Advertising Initiative Self-Regulatory Principles for Online Preference Marketing by Network Advertisers, July 2000. See p. 1, Overview.

[20] FTC Online Profiling Pt. 1 at 2.

[21] Id at 6.

[22] Id at 7.

[23] Public comments of TruEffect, FTC Town Hall eHavioral Advertising Tracking, Targeting & Technolgy November 1-2, 2007, comments submitted October 19, 2007.

[24] See, for example, the FTC’s Online Profiling: A Report to Congress (June 2000) for a description of how online profiling worked at the time on pages 6-7.

[25] TruEffect public comments at 5.

[26] Id.

Roadmap: The National Advertising Initiative – Failing at Consumer Protection and at Self-Regulation: Part II: Discussion – What the NAI Does

Report home | Read the report (PDF) | Previous section | Next section

Posted November 2, 2007 in Consumer Privacy, Cookies, Network Advertising Initiative (NAI), Report: The National Advertising Initiative - Failing at Consumer Protection and at Self-Regulation, Uncategorized

New Report: Risky Analysis: Assessing and Improving AI Governance Tools

We are pleased to announce the publication of a new WPF report, “Risky Analysis: Assessing and Improving AI Governance Tools.” This report sets out a definition of AI governance tools, documents why and how these tools are critically important for trustworthy AI, and where these tools are around the world. The report also documents problems in some AI governance tools themselves, and suggests pathways to improve AI governance tools and create an evaluative environment to measure their effectiveness. AI systems should not be deployed without simultaneously evaluating the potential adverse impacts of such systems and mitigating their risks, and most of the world agrees about the need to take precautions against the threats posed. The specific tools and techniques that exist to evaluate and measure AI systems for their inclusiveness, fairness, explainability, privacy, safety and other trustworthiness issues — called in the report collectively AI governance tools – can improve such issues. While some AI governance tools provide reassurance to the public and to regulators, the tools too often lack meaningful oversight and quality assessments. Incomplete or ineffective AI governance tools can create a false sense of confidence, cause unintended problems, and generally undermine the promise of AI systems. The report contains rich background details, use cases, potential solutions to the problems discussed in the report, and a global index of AI Governance Tools.
National IDs Around the World — Interactive map

About this Data Visualization: This interactive map displays the presence...
Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974

This comprehensive report and proposed bill text is focused on the Privacy Act of 1974, an important and early Federal privacy law that applies to the government sector and some contractors. The Privacy Act was written for the 1970s information era -- an era that was characterized by the use of mainframe computers and filing cabinets. Today's digital information era looks much different than the '70s: smart phones are smarter than the old mainframes, and documents are now routinely digitized and stored and perhaps even analyzed in the cloud, among many other changes. The report focuses on why the Privacy Act needs an update that will bring it into this century, and how that could look and work. This work was written by Robert Gellman, and informed by a two-year multi-stakeholder process.