Major Online Advertiser Agrees To Privacy Standards For Online Tracking

Attorney General Spitzer announced today a settlement with the nation's leading Internet advertising service that sets a new standard for consumers' online privacy. Under its agreement with New York and the other states, Manhattan-based DoubleClick Inc. will use its clients' privacy policies to make its tracking activities more visible and will give consumers access to their online profiles. Terms of the settlement include provisions requiring DoubleClick to provide independent verification of its compliance with the agreement and to pay the states $450,000 for investigative costs and consumer education.

"It's hard for consumers to trust e-commerce when they can't see the practices behind the promises," Spitzer said. "Consumers need reliable privacy verification-either first-hand, or through an independent and publicized review. DoubleClick is to be commended for its cooperation in setting an industry standard for promoting consumer privacy in the data collection and tracking taking place across networked websites."

New York led the 10-state, 30-month inquiry into DoubleClick's privacy practices. The investigation focused on how DoubleClick discloses its practice of assigning anonymous but unique cookie identifiers to the computers of websurfing consumers.

DoubleClick collects consumer data while it displays web-page banner ads and provides other e-commerce technology services as a contractor to websites. Through its widespread network of website clients, DoubleClick is able to use its cookies to track the surfing activity of any given computer.

"When an online contractor can invisibly track nearly every online consumer, consumers deserve to know the privacy cost of surfing the Web," Spitzer said.

DoubleClick ignited controversy in early 2000 by announcing that it would use personally identified profiles to bolster the appeal of online banner ads. State attorneys general, private litigants, and the Federal Trade Commission focused on the company. DoubleClick soon scuttled the plan to use personally identified information and the Federal Trade Commission closed its investigation. This May, DoubleClick concluded a related consolidated class action by agreeing to adopt privacy disclosure standards and make a payment of $1.8 million in attorneys' fees.

Disclosure terms address non-transparency
Because consumers cannot see DoubleClick collect their data, the agreement calls for the company to boost the visibility of its tracking activities. For example:

  • When a website allows DoubleClick to profile its visitors, the site must disclose DoubleClick's activities in the site's privacy policy. DoubleClick will automatically monitor these required disclosures by using special web-based software known as a "spider" or "robot."

  • When DoubleClick does not profile consumers but acquires consumer data solely as a contractor to a single site, DoubleClick will not use the data for profiling purposes. DoubleClick will "silo" the consumer data as the property and disclosure responsibility of the website. These safeguards also apply to DoubleClick's use of "web beacon" or "web bug" technology it uses to collect consumer data for client-specific services such as website traffic monitoring.

  • When DoubleClick changes its own privacy policy regarding future data collection, consumers will be able to receive an email alert by subscribing to a notification service.

Consumers to see more than a privacy policy
DoubleClick will also increase the visibility of its compliance efforts and make the profiles it creates accessible to consumers:

  • An outside party will conduct three reviews over the next four years to assess how DoubleClick measures up to its own privacy policy and to its agreement with the states. Consumers will be able to see the results posted in DoubleClick's privacy policy.

  • DoubleClick is working on a cookie viewer, a first in the e-commerce world. This tool will allow a consumer to see the profiled interest categories DoubleClick uses in selecting ads for that consumer.

A two-tiered time frame built into the agreement helps ensure that its terms will still be workable as technology and business models change. The majority of obligations have no expiration; the more technology-specific terms remain in effect for four years. In the recent class action settlement, all of DoubleClick's obligations were negotiated to expire in two years.

Also joining New York in today's announcement are Arizona, California, Connecticut, Massachusetts, Michigan, New Jersey, New Mexico, Vermont, and Washington.

This case was handled by Assistant Attorney General David Stampley of the Attorney General's Internet Bureau.


For Adobe PDF files you can download Adobe Reader from Adobe Systems.