Online Behavioral Advertising: The European Union Controversy

On June 24, 2010, the European Union's body that addresses data protection issues, the so-called Article 29 Working Party, adopted Opinion 2/2010 (the “Opinion”) providing further clarification on the amended e-Privacy Directive (below) as applied to online behavioral advertising. The Working Party also issued a press release on this topic.

Although the scope of the Opinion is limited to online profiling, its interpretation of Article 5(3) of the amended e-Privacy Directive provides some useful clarifications regarding the legal framework applicable to online behavioral advertising and the use of cookies. There has been much heat generated by the Directive and the Opinion, and little light. Our friends at Osborne Clarke have published an excellent overview.

Read Regulating Online Behavioural Advertising for some insight into the discussion. U.S.-based online businesses will need to start paying close attention to this - the global nature of the Internet means that the actions of the Article 29 Working Party will have significant ripple effects here.

Tracking the cookie crumbs

Disabling cookies may not be the answer to controlling your online identity. Regardless of whether you have cookies enabled or not, Web sites collect certain amounts of operational information about your browser. The Electronic Frontier Foundation has detailed how companies can use browser-configuration information to identify users, and also launched a new project, Panopticlick, aimed at testing just how useful this type of data is for tracking people.

Once the sites collect these browser "fingerprints," then according to the EFF, those sites can theoretically recognize some visitors upon their return regardless of whether they still have their cookies. Additionally, a technology expert with EFF says that sites that identify a returning browser based on the configuration data -- or, perhaps, a combination of configuration data and IP address -- can then restore any cookies previously associated with that browser.

Utilization of technologies that effectively overrides the end user's choice of what, and how much, information to make available is inviting future regulation and may be violating some existing privacy regulations.

Related Article

MediaPost - Flash Cookies Could Become Hot-Button Privacy Issue

Privacy and Security Bits and Bytes

Coming back from vacation and catching up on what’s been going on ….

In case you are looking for something security-related to do in the month of August -- check out the Internet Security Alliance Calendar of Events

According to an InternetNews.com article, cookies may be back on the menu for U.S. Government web sites. Back in 2000, all U.S. government web sites stopped using cookies for visitor web tracking and it looks as though the policy is about to change.

Mike Spinney at Information Security Resources does a great commentary piece about the importance of top-down example when establishing internal privacy and security programs. Personal ethics, and the emphasis by management that personal ethics is the key to compliance at your company, can be a very cost-effective addition to an overall information security program.

And, while I was gone, the Breach of the Month - a hack into the Network Solutions web server compromised more than 573,000 debit and credit cards, according to Security Fix in the Washington Post. Brian Krebs is one of the best on the beat.