Issues Brief/Flashpoint

Transcription

1 COMMUNICATIONS & MEDIA Issues Brief/Flashpoint Data Protection and Privacy Issues in Online Advertising July 2010 KPMG LLP Contents 1 Introduction 2 A Brief History of Privacy, Advertising, and Consumer Protection 2 Existing Privacy Laws 3 FTC Online Behavioral Advertising Principles 4 The Industry Self-Regulatory Program 5 Draft Internet Privacy Legislation Proposed by Congressmen Boucher and Stearns 7 Reaction to the Boucher-Stearns Draft and Further Developments 8 Market Innovation 11 Conclusion Introduction The internet has evolved into a premier marketing and advertising tool for many companies. Online advertising provides organizations with the capabilities to collect, measure, and analyze consumer online buying patterns (both individually and in aggregate). By tracking visitor activities on (and across) Web sites, and collecting reactions to ads placed on the company s own website, as well as ads on other websites, companies can obtain an enormous amount of valuable consumer information, including: the number of people who viewed a specific ad percentage of people who clicked on the ad (and even those who hovered over the ad but didn t click) percentage of people purchased a product after seeing the ad pages on a specific Web site visited most often and time spent on those pages other Web sites customers have visited customers addresses and other personal information location information for users accessing the internet via mobile devices This type of data can aid an organization in gaining significant insight into consumer preferences, and ultimately improve its products and services. Better understanding of consumers preferences enables organizations to target advertising to specific people most likely to be interested in a given product, providing additional value to consumers. The proliferation of web advertising also provides organizations with the financial resource needed to provide free content and services. On the other hand, the increased collection of consumer data has raised concerns about the protection of consumer privacy. High profile data breaches in the last decade resulted in the loss of large volumes of personally identifiable information that potentially resulted in identity theft. As a consequence, consumers are increasingly cautious of providing their personal information. They are also concerned

2 2 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July 2010 Advertising and Privacy: Select Recent Public Policy Developments December 2007: The FTC held a two-day town hall meeting in November 2007 to discuss privacy considerations related to online behavioral advertising. As a result of this meeting, the following month the FTC released proposed guidance concerning industry self-regulation. February 2009: The FTC gathered comments on the proposed guidance from various companies, business groups, academics, consumer and privacy advocates, and individual consumers. The FTC incorporated this guidance into a new report titled Self-Regulatory Principles for Online Behavioral Advertising, which was released in February The updated document explains the comments received and incorporates them into the guidance as a new set of Principles. 3 September 2009: As a follow-up to the FTC report, five leading industry organizations assembled and developed the cross-industry Self-Regulatory Program for Online Behavioral Advertising. The purpose of this program was to apply consumer-friendly standards to online behavioral advertising across the internet, while avoiding the need for government oversight. May 2010: Congressman Rick Boucher, Chairman of the House Subcommittee on Communications, Technology and the Internet, together with Congressman Cliff Stearns, the subcommittee s ranking Republican member, released a much-anticipated discussion draft of legislation to assure the privacy of information about individuals both on the internet and offline. This draft was made available for public comments through June 4, 2010, to be followed by a revised draft for formal bill introduction. Many organizations have since provided extensive comments on the discussion draft. about how personal information provided by them in the past is being used. In KPMG s 4th annual survey of consumers online and mobile activities, 79% percent of the global respondents indicated concern over unauthorized access to personally identifiable information. 1 Many companies post privacy notices, especially where state laws require it, such as the California Online Privacy Protection Act (OPPA) of As of June 2010, there is no federal law directly governing how online companies notify consumers about their data collection and usage practices. 2 However, this could change over time. Legislation recently introduced in the U.S. Congress has sparked renewed debate about privacy in many areas of commerce, including online advertising. This KPMG Issues Brief was prepared to provide a summary of the major events in Data Protection and Privacy, pertaining to the online advertising industry. A Brief History of Privacy, Advertising, and Consumer Protection The U.S. government has long been the primary force of consumer protection nationally. The Federal Trade Commission (FTC) was created in 1914 with the purpose of preventing unfair methods of competition in commerce and administering consumer protection laws. These laws also apply to the internet and are aimed at protecting consumers from misleading, fraudulent, and deceptive practices (including advertising). The FTC Bureau of Consumer Protection publishes guidelines and provides resources to help organizations apply the existing and new consumer protection laws and regulations to their activities such as internet advertising. Public policies regarding consumer privacy protection in advertising in general and behavioral advertising specifically continue to evolve within the broader context of existing Federal privacy laws and regulations. Existing Privacy Laws Prior to mainstream interactive communications channel development such as the internet, the U.S. government enacted privacy laws protecting various aspects of consumers personal information and protecting consumers from misleading, fraudulent, and deceptive advertising practices. 4 These laws also now apply to the internet. The FTC provides consumer protection guidance referencing the laws and regulations that apply to advertising and the internet. In the Guide for Small Business 5, the FTC Bureau of Consumer Protection provides Truth-in- Advertising-Laws. These laws include the following key legal requirements: 6 Advertising must be truthful and not misleading. Advertisers must have evidence to back up their claims. Advertisements cannot be unfair. 1 KPMG, Consumers and Convergence IV, July Though there are sector/segment specific rules that do provide such guidance. 3 Federal Trade Commission (FTC) Staff Report, Self-Regulatory Principles for Online Behavioral Advertising, Feb. 2009, June 2010, Accessible at 4 However, there is no omnibus federal privacy law currently in effect. 5 FTC, Frequently Asked Questions: A Guide for Small Business, May 10, 2010, June 2010, Accessible at 6 ibid KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

3 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July The FTC prohibits unfair, deceptive and misleading commerce practices, including in advertising. The FTC guidelines for creating clear and conspicuous advertising include: 7 Placing advertising disclosures on the same web page where the applicable claim is located. Prompting consumers to scroll down a web page to read advertising disclosures in entirety. Making links to disclosures obvious and communicating the importance and relevance of the information in the disclosure; linking directly to the disclosure; using consistent link styles so that links to disclosures are easily recognized. Providing disclosures prior to purchase. Using clear and concise language for disclosures and providing disclosures for sufficient duration of time so that consumers can understand the disclosures. While educating businesses about their responsibilities, the Bureau of Consumer Protection also educates consumers about their rights and responsibilities to establish a safe e-commerce environment. FTC Online Behavioral Advertising Principles Original Dec 2007; Revised Feb 2009 The FTC Online Behavioral Advertising Principles updated in February 2009 were intended to provide clear guidelines on how online advertisers can best protect consumers privacy while collecting information about their online activities. The Self-Regulatory Principles for Online Behavioral Advertising report contains four principles. The FTC report states that For purposes of the Principles, online behavioral advertising means the tracking of a consumer s online activities over time including the searches the consumer has conducted, the web pages visited, and the content viewed in order to deliver advertising targeted to the individual consumer s interests. This definition is not intended to include first party advertising, where no data is shared with third parties, or contextual advertising, where an ad is based on a single visit to a web page or single search query. 8 The specific principles in report are: Transparency and Consumer Control: Every website where data is collected for behavioral advertising should provide a clear, concise, consumer-friendly, and prominent statement that includes the following information: (1) data about consumers activities online is being collected at the site for use in providing advertising about products and services tailored to individual consumers interests, and (2) consumers can choose whether or not to have their information collected for such purpose. The website should also provide consumers with a clear, easy-to-use, and accessible method for exercising this option. Where the data collection occurs outside the traditional website context, companies should develop alternative methods of disclosure and consumer choice that meet the standards described above (i.e., clear, prominent, easy-to-use, etc). 7 FTC, Dot Com Disclosures, June 2010, Accessible at 8 FTC Staff Report, Self-Regulatory Principles for Online Behavioral Advertising, Feb. 2009, June 2010, Accessible at KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

4 4 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July 2010 Advertising Industry Self Regulatory seven (7) principles: 1 Education: Calls for advertisers and internet networks to participate in efforts to educate consumers and businesses about online behavioral advertising. 2 Transparency: Requires that companies deploy multiple mechanisms for clearly disclosing and informing consumers about the collection and use of internet data. 3 Consumer Control: Assures internet users of methods to choose whether data is collected, used or transferred for behavioral advertising. 4 Data Security: Requires companies to provide reasonable security and limited retention of the collected data. 5 Material Changes: Requires companies to obtain approval before making substantial changes in their data collection and use policies. 6 Sensitive Data: Requires heightened protection for children s data and user consent for the collection of financial account numbers, social security numbers, prescriptions and medical records about specific individuals. 7 Accountability: Calls for programs to ensure compliance and report uncorrected violations to appropriate government agencies. Reasonable Security, and Limited Data Retention, for Consumer Data: Any company that collects and/or stores consumer data for behavioral advertising should provide reasonable security for that data. Consistent with data security laws and the FTC s data security enforcement actions, such protections should be based on the sensitivity of the data, the nature of a company s business operations, the types of risks a company faces, and the reasonable protections available to a company. Companies should also retain data only as long as is necessary to fulfill a legitimate business or law enforcement need. Affirmative Express Consent for Material Changes to Existing Privacy Promises: As the FTC has made clear in its enforcement and outreach efforts, a company must keep any promises that it makes with respect to how it will handle or protect consumer data, even if it decides to change its policies at a later date. Therefore, before a company can use previously collected data in a manner materially different from promises the company made when it collected the data, it should obtain affirmative express consent from affected consumers. This principle would apply in a corporate merger situation to the extent that the merger creates material changes in the way the companies collect, use, and share data. Affirmative Express Consent to (or Prohibition Against) Using Sensitive Data for Behavioral Advertising: Companies should collect sensitive data for behavioral advertising only after they obtain affirmative express consent from the consumer to receive such advertising. The principles are similar to the seven principles that were later adopted as Industry Self-Regulations. The FTC report does not explicitly address education on the principles or accountability for them. The report does mention that both of these items must be addressed, but does not incorporate specific guidance into their principles. The Industry Self-Regulatory Program September 2009 The Self-Regulatory Principles for Online Behavioral Advertising 9 was created by leading advertising and marketing industry associations to implement standards for consumer-friendly behavioral advertising on the internet. The five industry organizations that developed the program are the: American Association of Advertising Agencies (AAAA) Association of National Advertisers (ANA) Council of Better Business Bureaus (BBB) Direct Marketing Association (DMA) Interactive Advertising Bureau (IAB) This program defines behavioral advertising as: The collection of data online from a particular computer or device regarding Web viewing behaviors over time and across non-affiliate Web sites for the purpose of using such data to predict user preferences or interests to deliver advertising to that computer or device based on the preferences or interests inferred from such Web viewing behaviors. 9 FTC, Self-Regulatory Principles for Online Behavioral Advertising, July 2009, June 2010, Accessible at KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

5 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July This industry Self-Regulatory Program consists of seven principles. The principles align closely with the Self-Regulatory Principles for Online Behavioral Advertising proposed by the FTC in February Draft Internet Privacy Legislation Proposed by Congressmen Boucher and Stearns May 2010 Draft legislation to protect online consumers is circulating in the U.S. House of Representatives and beyond; the first wave of reactions to the draft has been wide-ranging. The discussion draft released by Congressmen Rick Boucher and Cliff Stearns proposes to address privacy protections for individuals both on the internet and offline. Boucher has noted that online advertising supports much of the commercial content available on the internet today free of charge, and says the legislation would not disrupt this well established business model; it would simply extend to consumers important baseline privacy protections. Various industry groups expressed concerns that the proposed legislation will impact the abovementioned business model. As stated by Chairman Boucher on June 24, 2010: Our overall goal in doing these things is to inspire confidence (among the general public) that privacy is secure so people will trust the internet more and be more willing to engage in internet commerce. We are internet advocates, and we believe these protections will strengthen the internet and create more confidence in the internet experience. 10 The bill draft would require the following practices from organizations that collect personal information 11 : Disclosure of Privacy Practices: Organizations that collect personally identifiable information (PII) about consumers must conspicuously provide a clear and understandable privacy policy that explains what information is collected, how it is collected, used, and disclosed, as well as how the information is stored, and how long the information is retained. The privacy policy should specify the means consumers have to limit the disclosure of their information and the means to access their information. The privacy policy must be provided to consumers before any Personally Identifiable Information (PII) information is collected. This requirement mandates companies to publish a privacy policy. If the information is collected through the internet, the policy should be clearly and conspicuously posted on the Web site and accessible through a direct link. If the information is manually collected, the privacy policy must be provided to consumers in writing. 10 Steve Igo, Boucher Bill Would Protect Privacy of the internet Users, Timesnews.net, June 26,2010, June 2010, Accessible at 11 Rick Boucher, Privacy Discussion Draft Executive Summary, May 4, 2010, June 2010, Accessible at KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

6 6 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July 2010 Collection and Use of Information: Organizations are considered to have the consent of consumers for collection of personal information if individuals either affirmatively provided consent (opt-in) for collection of information or did not decline consent (opt-out) after receiving the privacy policy. This consent requirement applies to collection of information for marketing and advertising purposes. This requirement does not apply to collection of PII for transactional or operational purposes or when organizations rely on third party services to perform first party transactions. Disclosure of Information to Unaffiliated Parties: Numerous online companies engage with third-party advertising networks, which collect information about individuals and/or IP addresses and create profiles to target ads based on those profiles. Organizations must obtain express affirmative consent (opt-in) from a consumer prior to disclosing PII with unaffiliated parties for purposes other than operational or transactional. As an exception to requiring opt-in consent for third-party information sharing, opt-out consent would apply to sharing of an individual s information with a third-party advertising network if the advertising network provides individuals with an opportunity to edit their profile or opt-out of having a profile via a clear and easily accessible link on the advertising network s Web page. Implementation and Enforcement: The draft bill would take effect one year after enactment. The draft would not impact other federal privacy laws; however it would supersede any state regulation on collecting, using, or disclosing PII. Specifically, Section 10 of the draft states: This Act supersedes any provision of a statute, regulation, or rule of a State or political subdivision of a State, that includes requirements for the collection, use, or disclosure of covered information. The FTC would be charged with implementing the rules to enforce the legislation. The FTC would not require deployment or use of any specific products or technologies. The draft bill would not give individuals a private right of action. KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

7 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July Reaction to the Boucher-Stearns Draft and Further Developments May 2010 The draft bill, which many privacy experts assumed would only cover online data collection, is broader than expected by some of the industry analysts. It would apply to any non-governmental entity that collects personal information (including names, numbers and addresses) from more than 5,000 people a year, whether online or off. It appears that one of the discussion areas in Congress will likely be monitoring and enforcement of the principles. Other discussion areas may focus on the holistic nature of some proposed policies, which stands in contrast to the existing pattern of sectored Federal laws. Some have likened the proposal to privacy regimes in the European Union. 12 Some high-profile publishers and ad agencies have stated their belief that the proposal as written could damage the very companies subsidizing the free internet. Google warned, Partially-informed opt-ins that ask for excessive data, for example, could actually be more harmful for users privacy than better-designed, more intuitive and granular opt outs. 13 Russell Glass, CEO of B2B audience-targeting ad network, Bizo, noted that lawmakers should support online targeting with laws that codify self-regulatory principles around disclosure and anonymity of the user, but don t harm the return on investment or efficiency of online campaigns. In addition, they need to educate consumers on what online targeting exactly means, how to opt out, and explain why online targeting is not that scary. 14 Some consumer groups conveyed their disappointment that the draft did not require additional regulations on internet businesses. The Electronic Frontier Foundation and the Center for Digital Democracy said the draft bill would do little to shield consumers from potential abuse. We don t think it effectively protects consumer information online, and we think it needs substantial revision, Michelle DeMooy, senior associate for National Priorities at Consumer Action, said on a conference call with reporters, along with other dissatisfied public-interest group leaders. 15 While the discussion has started on this privacy issue because of this bill, I can t really say very much good about it, John Simpson from Consumer Watchdog later said on the call. This bill really adopts and endorses an archaic, bankrupt noticeand-consent regime that we all know does not work. 16 The bill would require websites to discard PII after 18 months, which many privacy groups suggest is too long. 12 Stephanie Clifford, Consumer Groups Say Proposed Privacy Bill is Flowed, nytimes.com, May 4, 2010, June 2010, Accessible at 13 Christine Y. Chen, Opt-ins, opt-outs, and everything in between, Google Public Policy Blog, April 26, 2010, June 2010, Accessible at 14 Laurie Sullivan, Will Ad Industry Self-Regulate Behaviorally Targeted Ads?, Mediapost.com, May 12, 2010, June 2010, Accessible at 15 Tony Romm, Privacy groups, business firms firing warning shots on new online ad privacy bill, thehill.com, May 4,2010, June 2010, Accessible at 16 ibid KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

8 8 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July 2010 Industry groups such as the IAB said the proposed law was too broad as currently drafted and left too much room for interpretation. According to Mike Zaneis, vice president of public policy at the IAB, a system in which every targeted-ad campaign first required a user s permission would amount to the worst anti-stimulus bill Congress could pass. It would kill hundreds of thousands of jobs in America, and it would disproportionately put small publications out of business, because consumers won t opt in, said Zaneis. Zaneis also noted that many of the legislation s rules about disclosure could prove overly granular and especially burdensome to many publishers who may not have the resources to comply. He said lawmakers decision to prevent advertisers from incorporating a computer s unique IP address into their advertising campaigns could have unintended consequences. 17 One of the only strong points of consensus to emerge among stakeholders thus far was a recognition that all sides would have to work closely with lawmakers over the coming months to shape the legislation. Prior to the draft, Google had released a position paper warning of opt-in dystopias 18 environments in which cumbersome opt-in requirements could discourage users from engaging socially on useful sites, push service providers to over-collect user data at the point of consent, and turn the internet into landscapes of walled gardens in which consumers are reluctant and even afraid to explore new services. The majority of organizations that responded to the draft promised to be vocal during the debate and commenting process. Both Google and Facebook separately assured they would work closely with congressional lawmakers on the bill, as did a host of industry interest groups. FTC Chairman Jon Leibowitz conveyed his views around online data privacy to cable operators at the Cable Show in Los Angeles on May 12, He stated that the commission is not interested in regulating behavioral advertising so long as the industry is making progress toward self-regulation. He also said the commission has great hopes for self-regulatory guidelines proposed by direct and online marketers in conjunction with the Better Business Bureau ibid 18 Mathew Lazar, Google Warns that Privacy Opt-In Rules Could Create dystopia, Ars Technica, April 2010, June 2010, Accessible at 19 John Eggerton, Leibowitz: FTC Not Interested in Regulating Behavioral Ads If Industry Can Do Job, Broadcasting & Cable, May 12, 2010, June 2010, Accessible at Regulating_Behavioral_Ads_If_Industry_Can_Do_Job.php KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

9 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July Leibowitz commented on behavioral adds, noting that so long as consumer choice and control were preserved, such ads were usually good for consumers, who don t have to waste their time slogging through pitches for products they would never buy; good for advertisers, who efficiently reach their customers; and good for the internet, where online advertising helps support the free content everyone enjoys and expects. 20 Leibowitz also spoke about the online marketing industry s self-regulatory proposal to explain consumer information-collection practices using plain common language, understandable to consumers. Today, few of us can comprehend the amount of personal data we ve left open for capture on the internet, and disclosure forms are most often written by lawyers, paid, it seems, by the syllable. The consent half of notice and consent rarely reflects a consumer s conscious informed choice. 21 Market Innovation While the public policy debates continue about privacy, companies are continuing to pursue business activities related to ad-targeting: Venture capitalists have continued to fund companies like Demdex, which captures behavioral data on behalf of Web sites and advertisers, storing it in behavioral data bank. 23 Bizo introduced an enhanced Analyze tool to include a new feature, Site Indexing. This feature lets advertisers and marketers find out, for free, if their Web sites attract a targeted audience, and determine how the Web site s traffic, by demographic, measures up to others. 24 Unsubcentral has recently launched a tool called PreferenceCentral, which gives people control over the ads they see online. 25 As a method for validating the self-regulation principles and simplifying the process for consumers, a start-up company, Better Advertising, has developed technology that provides an icon, called the power eye that would appear on ads that specifically target consumers. Consumers will be able to mouse-over the icon to see what information was used in targeting them and also to opt-out of further targeting. Several major marketers including AT&T, American Express and Microsoft have started to trial this technology. 26 Europe Opinion 2/2010 on Online Behavioral Advertising On June 22, 2010 the European Union Article 29 Data Protection working party adopted WP171 that clarifies how EU rules apply to online behavioral advertising. 22 WP 171 states that: In particular, the Opinion notes that advertising network providers are bound by Article 5(3) of the eprivacy Directive pursuant to which placing cookies or similar devices on users terminal equipment or obtaining information through such devices is only allowed with the informed consent of the users. The Opinion notes that settings of currently available browsers and opt-out mechanisms only deliver consent in very limited circumstances. The Opinion asks advertising network providers to create prior opt-in mechanisms requiring an affirmative action by the data subjects indicating their willingness to receive cookies or similar devices and the subsequent monitoring of their surfing behavior for the purposes of serving tailored advertising. WP 171 also states that: The Opinion sets out the information obligations of advertising network providers/publishers vis-à-vis data subjects, referring in particular to the eprivacy Directive, which requires that users be provided with clear and comprehensive information. 20 ibid 21 ibid 22 Article 29 Data Protection Working Party, WP 171, June 22, 2010, June 2010, Accessible at fsj/privacy/docs/wpdocs/2010/wp171_en.pdf 23 Anthony Ha, Demdex raises $6M to build publishers audience data, Deals & More, May 10, 2010, June 2010, Accessible at 24 Christopher Hosford, Bizo enhances Analyze with site indexing, B to B, May 28, 2010, June 2010, Accessible at 25 Meghan Kean, PreferenceCentral lets consumers manage the advertising they see online. Will they use it? April 29, 2010, June 2010, Accessible at blog/5837-preferencecentral-wants-to-let-consumers-manage-the-advertising-they-see-online 26 Michael Learmonth, Power Eye Lets Consumers Know That Web Ad Was Sent to Them, Advertising Age, June 21, 2010, June 2010, Accessible at KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

10 10 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July 2010 In addition, a coalition of industry groups including the IAB, BBB and the DMA, have announced another self-regulation effort where a monitoring system will be employed to determine whether websites and ad companies are complying with self-regulation guidelines, released in July of 2009, related to targeted advertising. This monitoring system is also being operated by Better Advertising as part of the Better Advertising Project. 27 At the same time venture capitalist make significant investments in emerging companies that focus on privacy related products and services. The Wall Street Journal reports that in June 2010 about a dozen online companies offering privacy services were substantially funded by top-tier venture-capital firms: 28 ReputationDefender Inc. disclosed that it has raised $15 million in new venture funding, though the company was not actively looking for new funding. 29 SafetyWeb Inc., which monitors children online activities, raised $8 million in funding. 30 Truste, which grants seals of approval to websites that meet privacy standards, raised $12 million. 31 Investors understand that the privacy market is new and will evolve as regulations are introduced. However, the surge for privacy investments indicates the significance of the current privacy issues and support required to protect privacy. 27 Emily steel, To Stem Privacy Abuses, Industry Groups will Track Web Trackers, Wall Street Journal, June 24, 2010, June 2010, Accessible at 28 Pui - Wing Tam, Ben Worthern, Funds Invest in Privacy Start Ups, Wall Street Journal, June 20, 2010, June 2010, Accessible at 29 ibid 30 ibid 31 ibid KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

11 Issues Brief/Flashpoint: Data Protection and Privacy Issues in Online Advertising July Conclusion Data and specifically personal information is a key asset in the information age. Currently consumers express significant concern over the privacy and security of their information. These concerns limit consumer adoption of online and mobile services. For example, consumers may be less willing to engage in online or mobile banking and financial transactions. They may also be less willing to engage in retail transactions with online retailers. Addressing consumer concerns may provide opportunities to generate new business, or to attract or retain customers. An evolutionary data-centric economy is pressuring organizations and public policies to keep pace. This adaptation will enhance stakeholder trust and enable the development of new business models to create significant business opportunities. Proposed legislation is part of a larger debate about what comprises PII and how to best achieve consistent effective, efficient and fair privacy requirements across large segments of the domestic, and by extension, international marketplace. Consistent privacy requirements will reduce the complexity organizations are facing. Technology innovation will continue to push the envelope in regards to using and protecting personal information, creating new privacy challenges. Technology will also provide new capabilities and solutions to address some of these challenges. All stakeholders are well advised to be aware of and, as appropriate, participate in the continuing debate. At stake is the continued operations of current web based services, enabling the development of new business models, and providing an appropriate level of security and privacy. As the corporate value chain evolves to an environment where personal information is shared across multiple organizations, and data moves from monolithic corporate data centers into the cloud, there is an increased need for independent information assurance across the value chain new and evolving auditing models are critical to support this activity. Effective data management is critical for organizations to realize the value of information they collect and to demonstrate appropriate controls over privacy and security. This helps organizations protect their brand and gain their consumers trust. KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS

12 us.kpmg.com For more information, please contact: Tony Castellanos Partner U.S. Communications & Media Sector Leader KPMG LLP Sanjaya Krishna Principal Digital Media Services Leader KPMG LLP Doron Rotman Managing Director KPMG LLP KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. Printed in the U.S.A. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative ( KPMG International ), a Swiss entity NSS