The Network Advertising Initiative recently completed a comprehensive review of the practices of its members, culminating in its 2009 Annual Report. Given the recent criticism of how Flash cookies may be used to track user behavior (see prior posts), I was pleased to see the NAI cover that practice in its review, and to reiterate the rule against the practice. While this is a big step forward, the NAI should go further to fully resolve Flash cookie question as it pertains to its members.
Based on staff interviews, the report concluded that none of the evaluated companies uses Flash cookies for online behavioral advertising (see footnote 46). Since our own panel found Flash cookies being written by several NAI members (including Specific Media and DoubleClick), the NAI must have been assured that these firms have implemented internal controls about how they use Flash cookies. But without an explanation of those assurances (or even why Flash cookies need to be used in the first place), the report is incomplete. The NAI should ask those firms to update their privacy policies to explain the use of Flash cookies and disavow their use for targeting. (See an earlier post on this as it relates to DoubleClick.)
The Flash cookie issue has rightly become a focus for privacy advocates, even though (at least as to the NAI membership), it looks like it shouldn’t be. A more unequivocal statement from the NAI members who use Flash cookies for other purposes will mean that networks abusing Flash cookies have nowhere to hide.