IAB said its members will follow five basic privacy principles henceforward:

1. CONSUMERS SHOULD BE PROVIDED MEANINGFUL NOTICE ABOUT THE INFORMATION COLLECTED AND USED FOR INTERACTIVE ADVERTISING

All companies that gather and store information for interactive advertising purposes should explain their practices in a consumer-friendly manner. Many leading companies have long embraced this goal via privacy policies, other forms of notice, and education, and should continue to enhance those efforts to keep pace with marketplace developments. In the online environment, consumers visiting a particular Web site should be provided meaningful notice of the types of individual information collected for interactive advertising purposes, the technologies employed to collect such information, and how such information is used, including that other companies operate on the site and may collect such information. In addition to providing notice through easily accessible links to privacy policies and similar disclosures, companies can use other strategies and techniques to further increase and enhance consumer education and awareness of information collection practices.

2. CONSUMERS SHOULD BE INFORMED OF THEIR CHOICES REGARDING INTERACTIVE ADVERTISING AND EMPOWERED TO EXERCISE THOSE CHOICES
Consumers should be given information about the choices they have concerning the collection and use of information for advertising purposes. Businesses collecting or using information about individual consumers for interactive advertising purposes should provide choice, where appropriate, to that individual. Consumers also should receive relevant education regarding cross-industry opportunities to opt out of the collection or use of individual information or other methods to exercise choice.

3. BUSINESSES SHOULD IMPLEMENT APPROPRIATE INFORMATION SECURITY PRACTICES AND PROCEDURES

Any company that maintains information for purposes of interactive advertising should provide reasonable security for that data. Such protections should be based on the sensitivity of the data, the nature of a company’s business operations, the types of risks a company faces, and the reasonable protections available to a company. Companies should require that business partners who collect or use such data on the company’s behalf also adopt appropriate information security procedures.

4. BUSINESSES SHOULD BE RESPONSIVE AND ACCOUNTABLE TO CONSUMERS

Consumers should have a readily accessible means to express concerns and complaints regarding adherence to these principles, and businesses should respond appropriately.

5. COMPANIES SHOULD EDUCATE CONSUMERS ABOUT THE BENEFITS OF INTERACTIVE ADVERTISING

Businesses that collect or use information about individual consumers for interactive advertising purposes should continue to enhance and communicate that value proposition to consumers.