The National Advertising Initiative TRUSTe s Systematic March From NAI Transparency World Privacy Forum Skip to Content Javascript must be enabled for the correct page display Home Connect With Us: twitter Vimeo email Main Navigation Hot Topics

The National Advertising Initiative TRUSTe s Systematic March From NAI Transparency

Report home Read the report PDF Previous section Next section

TRUSTe began reporting on NAI complaints in March 2002. It used its Watchdog Reports to do this. In the intervening years, TRUSTe public reports regarding the NAI reveal a troubling, systematic reduction of transparency regarding the NAI. (See Appendix B for a complete listing of all TRUSTe NAI complaints.) In its first stage of reporting, for 10 months from March 2002 to December 2002, TRUSTe reported the total number of incoming NAI complaints, and it segmented those incoming complaints by grouping complaints about opt-out cookies and complaints about online preference marketing, among some other categories. (See Figure 5.) The resolution of NAI complaints was also included in the Watchdog Reports. So for example, in March 2002 anyone could see that 30 NAI complaints came in, and 30 of the complaints were about opt-out cookies. While this is not highly granular reporting, this reporting at least gave the public an ability to monitor what complaints were coming in, and in what areas. Figure 5:
A screenshot of the March 2002 report of 30 NAI opt-out cookie complaints. Note that incoming complaints are monitored. (Highlighting added for emphasis) In the second stage of TRUSTe’s NAI reporting, beginning January 2003, TRUSTe stopped reporting on any incoming NAI complaints. For a period of 24 months, from January 2003 – December 2004, TRUSTe only reported on the total number of NAI complaints that were resolved, thus reducing the transparency of the reporting. (See Figure 6). TRUSTe still reported on how many opt-out cookie and OPM complaints were resolved. But there was no more information on incoming complaints. This was an inappropriate step away from transparency. Figure 6:
A screenshot of the December 2004 TRUSTe reporting format. Note that complaints are of privacy issues resolved. (Highlighting added for emphasis) TRUSTe’s reporting continued to devolve toward less transparency. In its third NAI reporting stage, beginning in January 2005 (TRUSTe became a member of the NAI organization in 2005 for a period of one year) and continuing until August of 2006, TRUSTe stopped reporting on anything other than the total number of NAI disputes that were resolved. (See Figure 7). For a period of 20 months, TRUSTe did no more reporting on incoming disputes, no more reporting on opt-out cookie complaints, and no more reporting on NAI OPM complaints. Figure 7:
TRUSTe begins reporting only the total NAI privacy issues resolved (2005- August 2006). (Highlighting added for emphasis) Then finally, in September 2006 until the current time, TRUSTe no longer reports publicly on the NAI complaints whatsoever in its Watchdog Reports. There is no longer any category available in the TRUSTe Watchdog Reports for NAI-related complaints. It is unknown why TRUSTe moved systematically stepwise away from transparency, but the Watchdog Reports speak for themselves. Figure 8:
Screenshot of TRUSTe’s current report format. There is no specific reporting about the NAI in the WatchDog reports. It is implausible to think that NAI complaints ceased, and there was nothing to report. From March 2002 to August 2006, the last month that TRUSTe reported NAI complaints, each and every month’s Watchdog Reports listed NAI complaints that had been received, save for one month. In December 2005 there were 66 NAI disputes. Are we to believe that in December of 2006, one year later, there were zero disputes and that is why the category was omitted entirely? After nearly 5 years of monthly NAI complaints, it seems unlikely that the NAI complaints evaporated without a trace. Even if that were the case, TRUSTe could have reported zero complaints. Appendix B lists the complete public history of the NAI complaints as handled by TRUSTe.

Is TRUSTe Really Independent

It is difficult to reconcile the statement of the NAI that TRUSTe is an independent enforcement program, when TRUSTe was a member of the organization it was the enforcement mechanism for in 2005. It is wholly inappropriate for an independent overseer to be a member of an organization that it is overseeing.

Where Are the Audits

The NAI agreement states that either the member organizations must submit to an independent seal program that conducts random audits, or they must undergo independent audits. There is no information showing whether TRUSTe actually conducted random audits. If TRUSTe conducts independent audits of NAI members, an auditing methodology should be published for transparency. Nothing is known about auditing by TRUSTe, and the lack of information undermines the credibility of both TRUSTe and NAI. Nothing on the public record suggests that TRUSTe actually conducted any of the required audits.

Enforcement of NAI Sensitive Data Safeguards

The NAI agreement contains language that restrict NAI members from using certain types of information: Sensitive Data: Network advertisers shall neither use personally identifiable information about sensitive medical or financial data, sexual behavior or sexual orientation, nor social security numbers for [Online Preference Marketing]. [73] It is not clear how NAI members implement this limitation. First, what constitutes sensitive medical information? Some may believe that any information about health care constitutes sensitive medical information. Others may believe that the only sensitive medical information relates to HIV/AIDS, drug treatment, or issues related to mental health. Because the NAI agreement did not specify what constituted sensitive medical information, each company can decide for itself. For example, Tacoda, in a press release announcing its Consumer Choice Initiative, noted, “Tacoda will avoid targeting advertisements using sensitive data, such as sexual preference, certain medical conditions, or identifying children. Current industry practices permit targeting on this type of data.” [74] What are “certain medical conditions”? Why do current industry practices allow targeting using types of data that appear to be expressly prohibited in the NAI agreement? If current industry practices permit targeting on this data, then the current industry practices have apparently not been touched by the NAI. When NAI standards are unclear, it is impossible to hold members or the NAI accountable for compliance. This may account, in part, for the lack of audit information from TRUSTe. _______________________________ Endnotes [73] See Network Advertising Initiative, Self-regulatory Principles for Online Preference Marketing by Network Advertisers, July 10, 2000. < http://www.ftc.gov/os/2000/07/NAI%207-10%20Final.pdf>. [74] Market Wire, Press Release. Tacoda Launches Consumer Choice Initiative; Plans Consumer Opt-Out Preservation with New Patent-Pending Technology, November 6, 2006. Roadmap: The National Advertising Initiative – Failing at Consumer Protection and at Self-Regulation: Part II: Discussion – TRUSTE’s Systematic March From NAI Transparency

Report home Read the report PDF Previous section Next section

Posted November 2, 2007 in Report: The National Advertising Initiative - Failing at Consumer Protection and at Self-Regulation, Uncategorized Next »The National Advertising Initiative: Oversight of NAI is a Failure « PreviousThe National Advertising Initiative: Notice – Still Not Clear or Conspicuous WPF updates and news CALENDAR EVENTS

WHO Constituency Meeting WPF co-chair

6 October 2022, Virtual

OECD Roundtable WPF expert member and participant Cross-Border Cooperation in the Enforcement of Laws Protecting Privacy

4 October 2022, Paris, France and virtual

OECD Committee on Digital and Economic Policy fall meeting WPF participant

27-28 September 2022, Paris, France and virtual more Recent TweetsWorld Privacy Forum@privacyforum·7 OctExecutive Order On Enhancing Safeguards For United States Signals Intelligence Activities The White House https://www.whitehouse.gov/briefing-room/presidential-actions/2022/10/07/executive-order-on-enhancing-safeguards-for-united-states-signals-intelligence-activities/Reply on Twitter 1578431679592427526Retweet on Twitter 1578431679592427526Like on Twitter 1578431679592427526TOP REPORTS National IDs Around the World — Interactive map About this Data Visualization: This interactive map displays the presence... Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974 This comprehensive report and proposed bill text is focused on the Privacy Act of 1974, an important and early Federal privacy law that applies to the government sector and some contractors. The Privacy Act was written for the 1970s information era -- an era that was characterized by the use of mainframe computers and filing cabinets. Today's digital information era looks much different than the '70s: smart phones are smarter than the old mainframes, and documents are now routinely digitized and stored and perhaps even analyzed in the cloud, among many other changes. The report focuses on why the Privacy Act needs an update that will bring it into this century, and how that could look and work. This work was written by Robert Gellman, and informed by a two-year multi-stakeholder process. COVID-19 and HIPAA: HHS’s Troubled Approach to Waiving Privacy and Security Rules for the Pandemic The COVID-19 pandemic strained the U.S. health ecosystem in numerous ways, including putting pressure on the HIPAA privacy and security rules. The Department of Health and Human Services adjusted the privacy and security rules for the pandemic through the use of statutory and administrative HIPAA waivers. While some of the adjustments are appropriate for the emergency circumstances, there are also some meaningful and potentially unwelcome privacy and security consequences. At an appropriate time, the use of HIPAA waivers as a response to health care emergencies needs a thorough review. This report sets out the facts, identifies the issues, and proposes a roadmap for change.