Offering consumers notice and choice before you collect behavioral advertising data.
Before collecting behavioral data, a web site must give consumers notice of what information is being collected and a choice of whether the consumer wants that information to be collected.
Limiting the time you retain data and providing reasonable security for protection of the data.
There is no specific amount of time or level of security. How long you can retain data and how secure that data must be depends on several factors including the sensitivity of the data and the type of business the company is engaged in.
If you change your company's privacy practices, you must notify each user.
If any portion of your behavioral advertising practices change, notify each user that you have collected data on and give them a choice on whether they will allow the change.
Provide an "affirmative notice" before sensitive data on a user's online acitivity is collected.
Provide a specific "opt-in" choice for users if "sensitive information" such as financial data, data about children, health information, sexual orientation, social security numbers, etc. are requested by your company.