Network Advertising Initiative
Encyclopedia
The Network Advertising Initiative is an industry trade group formed in 1999 that develops self-regulatory standards for online advertising. Advertising network
s created the organization in response to concerns from the Federal Trade Commission
and consumer groups that online advertising — particularly targeted or behavioral advertising
— harmed user privacy. The NAI seeks to provide self-regulatory guidelines for participating networks and opt-out technologies for consumers in order to maintain the value of online advertising while protecting consumer privacy. Membership in the NAI has fluctuated greatly over time and both the organization and its self-regulatory system have been criticized for being ineffective in promoting privacy.
, AdKnowledge, Adsmart, DoubleClick
, Engage, Flycast, MatchLogic, NetGravity (a division of DoubleClick) and Real Media.
In July 2000, the NAI published a set of Principles, negotiated with the FTC and endorsed by the FTC in their report to Congress on online profiling. In May 2001, the NAI released an accompanying web site http://www.networkadvertising.org/managing/opt_out.asp allowing users to more quickly download opt-out cookies for all participating ad networks. In response to a 2007 FTC staff report (Self-Regulatory Principles for Online Behavioral Advertising), the NAI published an updated set of Principles in December 2008 after providing a draft in April for public comments.
In 2002, the NAI released guidelines for use of Web beacons — small images or pieces of code used to track visiting and traffic patterns and install cookies on visitors' machines. These guidelines use a similar model of notice and choice as the NAI Principles; opt-in consent is only required when sensitive information is associated with personally-identifiable information and transferred to a third-party.
In 2003, the NAI formed the Email Service Provider Coalition (since renamed the Email Sender and Provider Coalition). The ESPC engages in lobbying, press relations and technical standards development to support "email deliverability" — ensuring that mass email delivery continues despite anti-spam
legislation and technologies.
Ad network membership in the NAI fluctuated between 12 members in 2000, two members in 2002-2003 and five members in 2007, prompting criticism that it did not consistently represent or regulate the industry. As of March 2010, the NAI lists 42 members, including Google
, Microsoft
and Yahoo!
.
Notice: The NAI principles require "clear and conspicuous" notice on the member ad network's website of what behavioral or multi-site advertising the ad network engages in, what types of data they collect for what purposes and for what length of time. Since ads are commonly shown on web sites not controlled by the ad network, members must also require that partnering web sites that display their ads also provide "clear and conspicuous" notice that behavioral advertising is taking place as well as what data is being collected, for what purposes and with whom it will be shared. Typically, these notices are presented in each web site's privacy policy
. "Robust" notice — where the notice is presented before personal information is collected — is required when personally-identifiable information ("name, address, telephone number, email address, financial account number, government-issued identifier and any other data used to identify, contact or precisely locate a person") will be merged with other non-identifiable information (like demographics or interests).
Choice: Ad networks which satisfy the NAI principles must provide consumers a choice about whether information collected about them is tracked and used to provide targeted advertising. Whether this choice is "opt-out" or "opt-in" depends on the type and usage of data. For sensitive information (including Social Security Numbers, financial account numbers, real-time location information and precise information about medical conditions), tracking is always "opt-in". Also, when previously collected personally-identifiable information is merged with non-identifiable information (and the consumer wasn't provided "robust notice" of this practice originally), then ad networks must obtain affirmative consent. In all other cases of tracking personally-identifiable and non-identifiable information, choice is provided through an "opt-out" mechanism: the opt-out cookie.
Although HTTP cookie
s are commonly used by advertising networks to track consumers as they access information across different web sites, the opt-out cookie is used to signal that the consumer has chosen not to have their data collected for providing targeted ads. The NAI provides a tool to download opt-out cookies for each of their member networks: member networks who detect the opt-out cookie must not collect data on that user for targeted advertising.
Additional principles prohibit collecting information of children under age 13 or using collected data for non-marketing purposes. Ad networks are required to provide subjects of data collection "reasonable" access to the personally-identifiable information they collect, make "reasonable" efforts to use reliable data, provide "reasonable" security and use "reasonable" efforts (through the NAI) to educate consumers about targeted advertising. Retention of data is limited to "legitimate business needs".
The World Privacy Forum has argued that the NAI opt-out cookie has been ineffective because consumers don't understand how cookies work, don't realize that cookies can simultaneously track them and be used to signal that they should not be tracked, don't recognize that changing membership in the NAI requires regularly updating their opt-out cookies, and regularly encounter errors on the NAI web site while trying to opt out. Before 2008, the NAI principles covered tracking only via HTTP cookies despite additional technologies for uniquely identifying and tracking browsers, the updated principles explicitly cover Flash cookies and similar technologies. Controversy continues over the NAI's model of "clear and conspicuous" notice within a privacy policy, rather than the FTC's recommendation for a higher standard of "prominent" notice that consumers are more likely to see and understand.
Concerns have also been raised about the process for developing and enforcing the NAI principles. The Electronic Privacy Information Center
criticized the negotiation of the original set of principles for not substantively including privacy advocates or consumer protection organizations, a concern echoed by seven senators in a letter to then FTC Chairman Pitofsky.
The NAI used TRUSTe
for third-party enforcement of its principles starting in 2002, but over time TRUSTe provided less and less detail in their reports on consumer complaints about the NAI and stopped reporting these complaints altogether in 2006. When the NAI published updated principles in 2008, it chose to review member compliance itself, which the Center for Democracy and Technology
argued would reduce consumer trust in the organization.
Because membership has fluctuated so widely, privacy advocates have also questioned whether the NAI system of self-regulation actually covers most of the networks engaging in online behavioral advertising. In 2005 and 2006, the majority of NAI members were "associate members" not required to comply with the organization's principles.
Advertising network
An online advertising network or ad network is a company that connects advertisers to web sites that want to host advertisements. The key function of an ad network is aggregation of ad space supply from publishers and matching it with advertiser demand...
s created the organization in response to concerns from the Federal Trade Commission
Federal Trade Commission
The Federal Trade Commission is an independent agency of the United States government, established in 1914 by the Federal Trade Commission Act...
and consumer groups that online advertising — particularly targeted or behavioral advertising
Behavioral targeting
Behavioral targeting is a technique used by online publishers and advertisers to increase the effectiveness of their campaigns.Behavioral targeting uses information collected on an individual's web-browsing behavior, such as the pages they have visited or the searches they have made, to select...
— harmed user privacy. The NAI seeks to provide self-regulatory guidelines for participating networks and opt-out technologies for consumers in order to maintain the value of online advertising while protecting consumer privacy. Membership in the NAI has fluctuated greatly over time and both the organization and its self-regulatory system have been criticized for being ineffective in promoting privacy.
History
The NAI was formally announced at the Public Workshop on Online Profiling http://www.ftc.gov/bcp/workshops/profiling/index.shtm held by the FTC and the Department of Commerce on November 8, 1999. At that time, membership consisted of 24/7 Media, AdForceAdForce
AdForce , founded by Chad Steelberg & Ryan Steelberg in 1995 and grown into the world’s largest centralized independent ad serving and management solution, was acquired by CMGI after going public for more than $500 million US dollars in 1999. AdForce won the Smithsonian Award for the Best...
, AdKnowledge, Adsmart, DoubleClick
DoubleClick
DoubleClick is a subsidiary of Google that develops and provides Internet ad serving services. Its clients include agencies, marketers and publishers who serve customers like Microsoft, General Motors, Coca-Cola, Motorola, L'Oréal, Palm, Inc., Apple Inc., Visa USA, Nike, Carlsberg among others...
, Engage, Flycast, MatchLogic, NetGravity (a division of DoubleClick) and Real Media.
In July 2000, the NAI published a set of Principles, negotiated with the FTC and endorsed by the FTC in their report to Congress on online profiling. In May 2001, the NAI released an accompanying web site http://www.networkadvertising.org/managing/opt_out.asp allowing users to more quickly download opt-out cookies for all participating ad networks. In response to a 2007 FTC staff report (Self-Regulatory Principles for Online Behavioral Advertising), the NAI published an updated set of Principles in December 2008 after providing a draft in April for public comments.
In 2002, the NAI released guidelines for use of Web beacons — small images or pieces of code used to track visiting and traffic patterns and install cookies on visitors' machines. These guidelines use a similar model of notice and choice as the NAI Principles; opt-in consent is only required when sensitive information is associated with personally-identifiable information and transferred to a third-party.
In 2003, the NAI formed the Email Service Provider Coalition (since renamed the Email Sender and Provider Coalition). The ESPC engages in lobbying, press relations and technical standards development to support "email deliverability" — ensuring that mass email delivery continues despite anti-spam
E-mail spam
Email spam, also known as junk email or unsolicited bulk email , is a subset of spam that involves nearly identical messages sent to numerous recipients by email. Definitions of spam usually include the aspects that email is unsolicited and sent in bulk. One subset of UBE is UCE...
legislation and technologies.
Ad network membership in the NAI fluctuated between 12 members in 2000, two members in 2002-2003 and five members in 2007, prompting criticism that it did not consistently represent or regulate the industry. As of March 2010, the NAI lists 42 members, including Google
Google
Google Inc. is an American multinational public corporation invested in Internet search, cloud computing, and advertising technologies. Google hosts and develops a number of Internet-based services and products, and generates profit primarily from advertising through its AdWords program...
, Microsoft
Microsoft
Microsoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
and Yahoo!
Yahoo!
Yahoo! Inc. is an American multinational internet corporation headquartered in Sunnyvale, California, United States. The company is perhaps best known for its web portal, search engine , Yahoo! Directory, Yahoo! Mail, Yahoo! News, Yahoo! Groups, Yahoo! Answers, advertising, online mapping ,...
.
NAI Principles
The NAI's self-regulatory principles for online behavioral advertising depend on a model of notice and choice.Notice: The NAI principles require "clear and conspicuous" notice on the member ad network's website of what behavioral or multi-site advertising the ad network engages in, what types of data they collect for what purposes and for what length of time. Since ads are commonly shown on web sites not controlled by the ad network, members must also require that partnering web sites that display their ads also provide "clear and conspicuous" notice that behavioral advertising is taking place as well as what data is being collected, for what purposes and with whom it will be shared. Typically, these notices are presented in each web site's privacy policy
Privacy policy
Privacy policy is a statement or a legal document that discloses some or all of the ways a party gathers, uses, discloses and manages a customer or client's data...
. "Robust" notice — where the notice is presented before personal information is collected — is required when personally-identifiable information ("name, address, telephone number, email address, financial account number, government-issued identifier and any other data used to identify, contact or precisely locate a person") will be merged with other non-identifiable information (like demographics or interests).
Choice: Ad networks which satisfy the NAI principles must provide consumers a choice about whether information collected about them is tracked and used to provide targeted advertising. Whether this choice is "opt-out" or "opt-in" depends on the type and usage of data. For sensitive information (including Social Security Numbers, financial account numbers, real-time location information and precise information about medical conditions), tracking is always "opt-in". Also, when previously collected personally-identifiable information is merged with non-identifiable information (and the consumer wasn't provided "robust notice" of this practice originally), then ad networks must obtain affirmative consent. In all other cases of tracking personally-identifiable and non-identifiable information, choice is provided through an "opt-out" mechanism: the opt-out cookie.
Although HTTP cookie
HTTP cookie
A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site...
s are commonly used by advertising networks to track consumers as they access information across different web sites, the opt-out cookie is used to signal that the consumer has chosen not to have their data collected for providing targeted ads. The NAI provides a tool to download opt-out cookies for each of their member networks: member networks who detect the opt-out cookie must not collect data on that user for targeted advertising.
Additional principles prohibit collecting information of children under age 13 or using collected data for non-marketing purposes. Ad networks are required to provide subjects of data collection "reasonable" access to the personally-identifiable information they collect, make "reasonable" efforts to use reliable data, provide "reasonable" security and use "reasonable" efforts (through the NAI) to educate consumers about targeted advertising. Retention of data is limited to "legitimate business needs".
Criticism
The NAI and its set of self-regulatory principles have been widely criticized by consumer advocacy organizations.The World Privacy Forum has argued that the NAI opt-out cookie has been ineffective because consumers don't understand how cookies work, don't realize that cookies can simultaneously track them and be used to signal that they should not be tracked, don't recognize that changing membership in the NAI requires regularly updating their opt-out cookies, and regularly encounter errors on the NAI web site while trying to opt out. Before 2008, the NAI principles covered tracking only via HTTP cookies despite additional technologies for uniquely identifying and tracking browsers, the updated principles explicitly cover Flash cookies and similar technologies. Controversy continues over the NAI's model of "clear and conspicuous" notice within a privacy policy, rather than the FTC's recommendation for a higher standard of "prominent" notice that consumers are more likely to see and understand.
Concerns have also been raised about the process for developing and enforcing the NAI principles. The Electronic Privacy Information Center
Electronic Privacy Information Center
Electronic Privacy Information Center is a public interest research group in Washington, D.C. It was established in 1994 to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and constitutional values in the information age...
criticized the negotiation of the original set of principles for not substantively including privacy advocates or consumer protection organizations, a concern echoed by seven senators in a letter to then FTC Chairman Pitofsky.
The NAI used TRUSTe
TRUSTe
TRUSTe is a company based in San Francisco, California, best known for its online privacy seals. TRUSTe operates the world’s largest privacy seal program, certifying more than 3,500 websites, including leading online portals and brands like Yahoo, Facebook, Microsoft, Apple Inc., IBM, Oracle...
for third-party enforcement of its principles starting in 2002, but over time TRUSTe provided less and less detail in their reports on consumer complaints about the NAI and stopped reporting these complaints altogether in 2006. When the NAI published updated principles in 2008, it chose to review member compliance itself, which the Center for Democracy and Technology
Center for Democracy and Technology
The Center for Democracy & Technology is a Washington, D.C. based 501 non-profit public-interest group that works to promote an open, innovative and free Internet....
argued would reduce consumer trust in the organization.
Because membership has fluctuated so widely, privacy advocates have also questioned whether the NAI system of self-regulation actually covers most of the networks engaging in online behavioral advertising. In 2005 and 2006, the majority of NAI members were "associate members" not required to comply with the organization's principles.