Are you “Chitika compliant”?

Wilson Sonsini posted a helpful summary of the Chitika consent decree, noting that the novel remedies help illuminate the Federal Trade Commission’s current views as to what constitutes a sufficient notice-and choice process. While some of the requirements may be specific to Chitika’s situation, tracking companies committed to best practices still would be well served by comparing their practices to those in the Chikita decree:

1. Disclose on homepage. The tracking company homepage must include a statement about tracking and link to the opt-out process.
2. No more than two clicks total to opt-out. After clicking the homepage link, the opt-out process must be presented and the user must be able to complete it with no more than one additional click.
3. Show opt-out status. The user’s current status must be shown to the user in close proximity to the choice.
4. Stop collection, not just ad targeting. If the user opts out, the company must refrain from collecting data associated with the computer or device; which is to say, it is not sufficient to refrain from delivering ads targeted on behavior, the data must not be collected in the first place.
5. Five year cookie life. The opt-out cookie must remain in effect for at least five years.
6. Disclose in ads. Ads that are targeted based on behavioral information must include a link saying “Opt out” with a hover that says “Opt out of Chitika’s targeted ads.”