Posting a Privacy Policy May Not Be Enough - NARC to Enforce Industry Principles

If your company has a posted privacy policy, it may be a good time to confirm that the cookies, tracking technologies, and other activities currently being used on your web site or sites are still consistent with your existing policy and industry standards. The National Advertising Review Counsel ("NARC") of the Better Business Bureau has recently stated that it will begin enforcing advertising industry privacy principles and publicly naming those companies who either aren't complying with the principles or following their own privacy policies.  For the more serious cases, NARC may even refer the matter to the FTC.

Industry principles do not prohibit collecting information about and tracking users, but require those engaged in behavioral targeting to notify consumers about data collection via an icon and allow them to opt out of receiving targeted ads.  Although failing to comply with industry privacy and tracking principles may result in a mere notification from NARC, if your company is failing to comply with its own privacy policy, this could be an unfair or deceptive act, falling under the purview of the FTC.  NARC's latest move, as well as pending class-action lawsuits regarding cookies that persist after a consumer has tried to opt-out, make it important for companies to take time to know what technologies their web sites employ and keep their online disclosures and privacy policies up to date with that often-changing reality.