Microsoft not opposed to regulation of online privacy

Updated at 4 p.m. with Yahoo comment

Microsoft on Thursday issued its response to proposed Federal Trade Commission guidelines for online ad industry self-regulation, but the company wouldn't necessarily oppose regulation, a Microsoft representative said.

"Two years ago we were one of a handful of companies calling for a comprehensive federal privacy bill," Frank Torres, director of consumer affairs for Microsoft, said in an interview.

Microsoft also has been talking to the sponsors of bills in New York and Connecticut that deal with online advertising, he said. "We're definitely not opposed to them."

In the meantime, Microsoft's proposal recommends that consumers be able to opt out of behavioral targeting and that targeting based on sensitive data, such as health conditions, sexual orientation or religious beliefs, should be opt in.

The Network Advertising Initiative trade group for online ad networks also released guidelines this week that would exclude sensitive information and children under 13 from ad targeting. The Center for Digital Democracy and the U.S. Public Interest Research Group support a separate FTC rulemaking for each of the following sensitive data issue areas: children, teens, health and medical, and financial. And the Institute for Public Representation at Georgetown University Law Center says data from anyone aged 17 and under should be considered sensitive data.

Microsoft also says the companies that keep records of page views or collect other information about consumers for the purpose of delivering ads--including Web search data--should post a privacy policy on the home page, keep the data secure, and retain the data for only as long as needed or as required by law.

That would apply to search engines like Google, Yahoo, and Microsoft, and not just companies that do behavioral targeting. In the FTC proposals, search data is not covered.

"Our view is that the FTC should broaden the scope of the principles to include" contextual advertising, Torres said.

Later on Friday, Yahoo weighed in on the FTC proposals, saying that industry self-regulation is preferable to regulation and legislation because they would reduce the flexibility advertisers and others now enjoy. Yahoo also pledged to not target children under 13 or target based on sensitive information and allows consumers to opt out of targeted ads. The company also said it would soon begin a public education campaign on its network about targeted advertising.

Meanwhile, the Online Publishers Association (OPA) said on Thursday that the FTC should exclude anonymous behavioral information in its guidelines on targeted advertising and focus on personally identifiable information only.

"Behavioral information derived from the use of anonymous tracking technology is necessary to facilitate many services unrelated to advertising, to create desirable (and, in many cases, free) content, and to design and refine products and services that provide consumers with the best possible online experience," OPA said in a statement. "None of these beneficial uses of anonymous behavioral data raises privacy concerns."

The FTC principles, unveiled in December, say sites should give consumers the ability to choose whether to have their information collected for behaviorally targeted advertising, and if ads are based on sensitive information, consumers should be asked for permission to be targeted.

The Interactive Advertising Bureau weighed in with its proposed guidelines earlier this year which support an opt-out system for consumers who don't want their information collected for advertising purposes.

The Electronic Privacy Information Center (EPIC) says self-regulation won't protect consumers the way that legislation would.

"It's time to move beyond the self-regulatory approach, particularly in light of the growing problems of identity theft and security breaches in the United States," says Marc Rotenberg, executive director of EPIC. "The FTC should push for laws and techniques that minimize or eliminate the collection of personally identifiable information."