Last month, the outgoing House Committee on Energy and Commerce Subcommittee on Commerce, Trade, and Consumer Protection held a hearing entitled “Do-Not-Track Legislation: Is Now the Right Time?” According to a briefing memo released by the Subcommittee, the purpose of the hearing was to examine the feasibility of establishing a mechanism that provides Internet users a simple and universal method to opt-out from having their online activity tracked by data-gathering firms (a.k.a. a “Do Not Track List”).
Background
When individuals use the internet, details about their lives including age, gender, race zip code, income, marital status, health concerns, recent purchases, and other details that can be collected and packaged into profiles. As a result, a data-gathering industry with an increasing hunger for this information has grown, and over the past several years has sold this information so that companies can target consumers based on their tastes, needs, and even perceived desirability. What policymakers and some consumers are concerned about is that “many Americans don’t know that the details of their online lives are being gobbled up and used in this way, much less how to stop it in the event that such collection offends their expectations of privacy.”
Information about Internet users’ activity is instantaneously sold each day for the purpose of targeting ads to particular consumers (so-called “behaviorally targeted ads”). Spending on behaviorally targeted ads reached $925 million in 2009, and that figure is expected to reach $1.125 billion by the end of 2010. By 2014, spending on behaviorally targeted ads is projected to more than double to $2.6 billion.
In addition, those in the business of selling behaviorally targeted ads can generally command more for those ads than non-targeted ads. In 2009, advertising networks on average charged $1.98 per thousand displays of an untargeted ad, while they charged on average $4.12 per thousand displays of a behaviorally targeted ad.
However, the revenue that is generated by this type of advertising helps finance the free content that many Internet users have come to expect. In fact, “more than half of ad network revenue goes to publishers who host the [targeted] ads.” As a result, industry proponents have argued that regulation of this industry to protect consumers’ privacy could reduce the availability of free content on the Internet and the proliferation of more unwanted and irrelevant ads.
Current Laws and Regulations
No federal law specifically governs the online advertising industry or the practice of tracking internet consumers to deliver behaviorally target ads. Nor are there any federal laws that comprehensively govern the collection, use, and dissemination of consumer information across the board.
Specific federal laws, however, do address certain categories of personal information or specific entities. For example, the Fair Credit Reporting Act (FCRA) governs consumer report information. Title V of the Gramm-Leach-Bliley Act addresses the sharing of certain nonpublic personally identifiable information by financial institutions, and rules promulgated pursuant to the Health Insurance Portability and Accountability Act apply to the privacy of medical records.
In addition, the FTC may bring actions for unfair or deceptive acts or practices under the FTC Act, which includes the authority to bring actions related to a company’s information collection and use.
Industry Regulations
While no specific law governs online advertising or internet consumer tracking, last October a coalition of media and marketing trade associations launched a self-regulatory program for the behavioral advertising industry. The voluntary initiative began by encouraging companies that track Internet users to display on or near behaviorally targeted ads a clickable “Advertising Option Icon.” Once fully implemented, the icon will signal to Internet users that an ad was served based online tracking and provide an avenue for consumers to get more information about the company’s data practices and to opt-out from receiving behaviorally targeted ads served by some or all participating companies.
The program is based on the seven Self-Regulatory Principles for Online Behavioral Advertising that correspond with tenets proposed by the FTC in February 2009, and also address public education and industry accountability issues raised by the Commission.
Do Not Track
Despite the advertising industry’s attempt to regulate online advertising and tracking noted above, the FTC last month published a preliminary draft for protecting consumer privacy. According to their press release, the report proposes a framework to balance the privacy interests of consumers with innovation that relies on consumer information to develop beneficial new products and services. The proposed report also suggests implementation of a “Do Not Track” mechanism – likely a persistent setting on consumers’ browsers – so consumers can choose whether to allow the collection of data regarding their online searching and browsing activities. Among specific suggestions, the FTC staff recommended that:
Companies adopt a “privacy by design” approach by building privacy protections into their everyday business practice, including reasonable security for consumer data, limited collection and retention of such data, and reasonable procedures to promote data accuracy.
Consumers should be presented with simplified choice about collection and sharing of their data at the time and in the context in which they are making decisions. These would include a “Do Not Track” option.
Marketers should adopt measures to improve transparency of information practices, including consideration of standardized notices that allow the public to compare information practices of competing companies.
Consumers should have “reasonable access” to the data that companies maintain about them, particularly for non-consumer entities such as data brokers.
Stakeholders should undertake a broad effort to educate consumers about commercial data practices and the choices available to them.
FTC Chairman John Leibowitz noted in his prepared comments that the report “lays a foundation for industry innovation – while protecting consumers and their privacy.” In his statement, Mr. Leibowtiz asserted that “despite some good actors, self-regulation of privacy has not worked adequately and is not working adequately for Americans consumers.” As a result, he acknowledged that the FTC “will take action against companies that cross the line with consumer data and violate consumers’ privacy.” Additionally, his comments echoed the recommendations noted above. Specifically, Mr. Leibowitz asserted that companies should collect and retain data only if they have a legitimate business need.
He also specifically acknowledged the need for a Do Not Track mechanism with respect to third-party ads. For the FTC Chairman, the most “practical method would likely involve the placement of a persistent setting on the consumer’s browser, signaling the consumer’s choices about whether or not to be tracked.” He acknowledged that “Microsoft, Google, Mozilla, Apple and a coalition of other companies have already experimented with this method, and such an option would “serve as an easy, one-stop shop for consumers to express their choices, rather than on a company-by-company or industry-by-industry basis.”
In response to FTC’s preliminary report, Nancy Hill, President-CEO of the American Association of Advertising Agencies (4A’s) noted in a press release that there is “little understanding in the report of how complex a task it is to point such a vast, diverse and rapidly changing ecosystem in the same self-regulatory direction.” Ms. Hill pointed to the Self-Regulatory Program for Online Behavioral Advertising, devised by industry, through two years of hard work, and noted that it is just now becoming operational. She asserted that the “new system will provide a very strong case for self-regulation and consumer protection as the roll-out becomes 100% functional.”
Ms. Hill’s concerns were echoed by Dick O’Brien, head of the 4A’s Washington office, who noted that “At its worst, the FTC report could be read as an effort by regulators to push Congress into enacting stringent new laws that would restrict marketers’ interaction with consumers.” The press release acknowledged that the will provide reaction to the report to the FTC during the “comment period” which ends on January 31.
4A’s and other marketing groups are preparing responses to the FTC report, which can be submitted here and are due January 31, 2011. While O’Brien agreed that “online marketing must provide transparent, simple and consumer-friendly options,” he noted that groups “will be meeting with Members of Congress to let them know what the industry is doing already and what the new industry efforts will mean to consumers.”
Subcommittee Hearing
The growing awareness about the pervasiveness and invasiveness of online tracking noted above has sparked renewed interest in creating a Do Not Track mechanism by privacy advocates. In light of all the recent developments and changes, outgoing Subcommittee Chairman Bobby Rush (D-IL) discussed at last month’s hearing HR 5777, the Best Practices Act, which he introduced back in July of 2010. The purpose of the bill is to foster transparency about the commercial use of personal information and provide consumers with choice about the collection, use, and disclosure of such information. The bill applies to both the online and offline contexts.
Although the bill outlines specific protections for consumers and gives the FTC certain responsibilities for reporting and enforcement, HR 5777 does not include a provision to establish a mechanism that provides consumers a simple and universal method to opt-out from having their online activity collected and used by the tracking industry. Privacy advocates first proposed a version of such a “Do Not Track List” in 2007.
Congressman Rush noted in his opening statement that through such a mechanism, consumers could advise would-be trackers unambiguously and persistently that they do not wish to be followed by digital snoopers and spies across web sites and their various fixed and mobile computing devices. Mr. Rush made comparisons of the Do-Not-Track Legislation to the Do-Not-Call Registry that the FTC had successfully implemented several years ago. Accordingly, Mr. Rush then went on to hear testimony from:
Daniel J. Weitzner, Associate Administrator for the Office of Policy Analysis and Development, Department of Commerce, National Telecommunications and Information Administration, Department of Commerce
David Vladeck, Director, Bureau of Consumer Protection, Federal Trade Commission
Susan Grant, Director of Consumer Protection, Consumer Federation of America
Joe Pasqua, Vice President of Research, Symantec Corporation
Joan Gillman, Executive Vice President and President, Media Sales, Time Warner Cable
Eben Moglen, Ph.D., Legal Advisor, Diaspora*, Professor of Law, Columbia University, Founding Director, Software Freedom Law Center
Daniel Castro, Senior Analyst, Information Technology and Innovation Foundation
Conclusion
With the comment period closing at the end of this month and with several consumer groups having already filing a complaint with the FTC over online marketing and behavioral advertising, Congress will likely have to address this issue during its new session. However, with Republicans in control of the House, it remains uncertain whether any legislation will move forward to create the Do Not Track mechanism necessary to carry out the recommendations in the FTC report.
The use of the internet is growing exponentially each day, and consumers are finding valuable information about healthcare, mental health, financial help, education, nutrition, and numerous other resources. Accordingly, as policymakers consider comments from consumer groups on both sides of the argument, Congress and the FTC should ensure that the proposed regulations do not create obstacles for consumers to learn about products and get valuable information because online advertising and marketing is an extremely important tool for both consumers and companies.
To submit comments:
https://ftcpublic.commentworks.com/ftc/consumerprivacyreport/