FTC: 10-Day 'Opt-Out' Doesn't Do It

The Federal Trade Commission (FTC) has reached a settlement with Chitika, an online advertising company that allegedly continued tracking consumers’ online activities even after they have chosen to opt out of online tracking on Chitika’s website.

It's the first major enforcement action by the FTC since it announced its intention to crack down on what it says as practices that violate consumers' privacy, even though none of the information collected is matched to consumers by name.

According to the FTC complaint, Chitika uses a technique known as behavioral advertising – by placing “cookies” on consumers’ computer browsers, the company tracks consumers’ activities on the web, including searches the consumer has conducted and sites the consumer has visited. Based on consumers’ online activities, the company then displays ads that correlate to their interests.

The FTC alleged that in its privacy policy the company says that it collects data about consumers’ preferences, but allows consumers to opt out of having cookies placed on their browsers and receiving targeted ads. The privacy policy includes an “Opt-Out” button. Consumers who click on it activate a message that states, “You are currently opted out.”

According to the FTC complaint, from at least May 2008 through February 2010, Chitika’s opt-out lasted only 10 days. After that time, Chitika placed tracking cookies on browsers of consumers who had opted out and targeted ads to them again. The FTC charged Chitika’s claims about its opt-out mechanism were deceptive and violated federal law.

Chitika said it intended for the opt-out to last 10 years rather than 10 days and blamed the slip-up on a programming error. Chitika also said that it, like other major advertising companies, did not collect personally identifiable information about web users.

The settlement bars Chitika from making misleading statements about the extent of data collection about consumers and the extent to which consumers can control the collection, use or sharing of their data. It requires that every targeted ad include a hyperlink that takes consumers to a clear opt-out mechanism that allows a consumer to opt out for at least five years.

It also requires that Chitika destroy all identifiable user information collected when the defective opt out was in place. In addition, the settlement requires that Chitika alert consumers who previously tried to opt out that their attempt was not effective, and they should opt out again to avoid targeted ads.