Tanya Forsheit at Proskauer Rose's Privacy Law Blog flags the FTC's recently issued "Staff Report on Self-Regulatory Principles for Online Behavioral Advertising" [pdf] in a post that's well worth reading:  "FTC Provides Last Clear Chance for Industry to Self-Police in a Target-Rich Environment".  The Principles, being well . . . "principles" don't impose any new obligations on companies, and re-state "existing FTC rules in this area."  That said, it seems like they are intended to send a signal that absent the industry regulating itself, the FTC may step in.  (Question:  will we see any policy shift courtesy of the new administration?  It would be nice to get a clear signal on whether the new administration intends to follow in the footsteps of the old administration or do something different.  Maybe there's something about this in the report, but my *quick skim* didn't reveal anything.)

She makes two observations:

1. "the Report frequently goes out of its way to note the eroding distinction between traditional personal identifying information ('PII') . . . and non-PII." 
   
   
2. the FTC encourages "companies to design innovative ways - outside of the privacy policy - to provide behavioral advertising disclosures and choice options . . . ."
   

Those are good observations.  There are a growing number of ways a given piece of data can identify someone, and it's unclear whether the old distinction between PII and non-PII will survive.  As to the second point:  plain English/Q&A format.  Anything a company can do to explain its information collection practices to its users in easily understable *non-legalese* terms is a good thing.

The Report covers a range of topics, from a discussion of advertising "networks," cookies,* to the Network Advertising Initiative (it would have been nice to see numbers or some measure of effectiveness on the NAI opt-out).  The bulk of the Report pretty much re-states practices that most companies should engage in anyway:  clear notice, prospective changes, user consent, etc.  Most of this should be obvious.

My feeling is that the Report is slow to catch up with the reality of business practices.  Online advertising is rapidly evolving, and the viability of third party networks are uncertain.  By the time the FTC acts, there will be a new model in place. 

The next big area of concern is obviously social media.  Users voluntarily share intimate details about their lives to social networks (Twitter/Facebook, etc.).  Networks will inevitably want to use this information for advertising and market research purposes.  Sure, Facebook had a false start with its Beacon initiative ("Facebook's Zuckerberg: 'We Simply Did a Bad Job Handling Beacon'") and it's having even more of a false start with its recent TOS fiasco, but it will smooth things out and make a push to utilize the information submitted by users.  And that's where the discussion will shift.  The interplay between the rules of various countries (including the EU) is another area where we're likely to see some interesting issues crop up.
 
* Here's a great post ("Everything You Wanted to Know About Cookies but Were Afraid to Ask") containing an explanation of "cookies" and what they are/do.
 
Added:  three other links well worth checking out.  First, Saul Hansell at Bits posts here about how "Plain English" will probably be the big winner of the Facebook TOS fiasco.  Separately, Commissioners Leibowitz (here) and Harbour (here) both issued separate concurring statements regarding the Principles.  These concurring statements are probably more illuminating than the Principles themselves.