Friday, March 2, 2012

Federal Trade Commission, Congress look into 'Do Not Track' system

The agency that brought us the "Do Not Call" list to preventtelemarketers from interrupting our dinners has now proposed a "DoNot Track" system to prevent Internet sites from sharing purchasinginformation about their online visitors with advertisers.

The Federal Trade Commission's proposal comes amid concern fromconsumer groups that the dissemination of such personal informationin cyberspace constitutes an invasion of privacy that the onlineindustry has not done enough to prevent.

Online advertisers, and the lawyers who represent them, counterthat the exchange of information benefits consumers by limiting theads they receive to products they might be interested in, based onthe websites they visited -- a practice known as "targeted" or"behavioral" marketing.

The advertisers say the revenue the sites generate by selling theinformation enables them to offer free access to their sites.

"It allows consumers not to be bombarded with irrelevantadvertising," said Andrew B. Lustigman, a New York lawyer whorepresents advertisers before the FTC. "That's why all this contentis available for a very low price or free."

But attorney Eric Menhart, who specializes in legal issues incyberspace, said a Do Not Track system potentially serves theinterests of both Internet surfers who want their privacy protectedand advertisers who want the biggest return on their onlinepostings.

It enables advertisers -- at no cost to themselves -- to discoverthose consumers who want to be solicited and those who definitely donot, said Menhart, who made a name for himself while still in lawschool by forming MaryCLE LLC to sue over unsolicited ads, or spam e-mails, the company received. His actions helped establish thevalidity of Maryland's anti-spam laws. He later opened his law firm,CyberLaw PC, in Washington, D.C.

"If people feel that they're being 'spied on' and they see adsthat are very targeted to them ... they are going to feel thiscompany has too much information about me," Menhart said. "Theadvertiser doesn't have to worry about [targeting] that segment ofthe population."

The FTC proposed its Do Not Track system in a preliminary staffreport released in December. In that report, FTC staff membersexpressed concern that privacy policies of online companiesinsufficiently warn consumers how their information will be used,particularly with regard to the sale of online information toadvertisers.

"Privacy policies have become longer, more complex, and, in toomany instances, incomprehensible to consumers," according to thereport, "Protecting Consumer Privacy in an Era of Rapid Change: AProposed Framework for Businesses and Policymakers."

"Too often, privacy policies appear designed more to limitcompanies' liability than to inform consumers about how theirinformation will be used," the report said. "Consumers may feelharmed when their personal information -- particularly sensitivehealth or financial information -- is collected, used, or sharedwithout their knowledge or consent or in a manner that is contraryto their expectations."

The Do Not Track system the FTC contemplates would most likelyinvolve placing a "persistent cookie" on a consumer's browser andconveying that setting to sites the browser visits to indicate ifthe consumer wants to be tracked or receive targeted advertisements,the report stated.

Potomac cyberspace lawyer Peter Toren called the FTC's proposal"a small baby step" in protecting privacy on the Internet because itwould require users to opt out of permitting online companies tosell information to advertisers for the protection to take effect. Amore aggressive approach would prohibit the personal informationfrom being sold unless the consumer expressly opts in and informscompanies they can share the data, said Toren, of Shulman RogersGandal Pordy & Ecker PA in Potomac.

However, he termed the proposal "a good first step in the sensethat it opens a needed dialogue about perhaps increasing privacystandards."

Self-regulation

Baltimore advertising attorney James B. Astrachan said the FTC'sproposal is a warning to the online industry that if it fails toaddress the privacy concerns raised in the report, the agency orCongress might take action to force the companies to act.

The agency is attempting to get industry leaders who rely onadvertising as a revenue base -- such as Google, Facebook andLinkedIn -- to create an effective method to enable Internet surfersto bar companies from collecting or sharing information withadvertisers, added Astrachan, a partner at Astrachan Gunst ThomasRubin PC and chairman of The Daily Record's Editorial AdvisoryBoard.

Selling advertising is "part of the revenue model" for thesewebsites, Astrachan said. The FTC is essentially telling thesecompanies, "You guys need to sit at the table and come up with aself-policing model," he added.

Jessica Rich, deputy director of the FTC's Bureau of ConsumerProtection, confirmed Astrachan's view.

"We definitely are asking the industry to step up to the plate,"Rich said. Online companies must give consumers "meaningful choices"regarding whether and how information about their Web visits iscollected and disseminated, she added.

The commission is accepting public comments on its proposal untilFeb. 18 and seeks input on ways to balance the privacy interest ofconsumers and the desire to keep the Internet free.

The FTC had originally set a Jan. 31 deadline for comments butextended it amid requests from the American Bar Association'sSection of Intellectual Property Law, the American Association ofAdvertising Agencies, and the Computer and Communications IndustryAssociation.

Astrachan said the issue of webtracking for advertising purposesis essentially a 21st-century application of the age-old businesspractice of market research.

For years companies have tracked the buying habits of peoplethrough telephone surveys, questionnaires and by enclosing postcardsin consumer goods.

The postcards often asked questions regarding one's householdincome and the type of car they drove.

"This is an old question of, 'We've gathered data on you. Can weuse it? Can we sell it to advertisers?'" said Astrachan, author ofThe Law of Advertising, published by Matthew Bender. "This is not anew question. It's just more technologically sophisticated in howthey're doing it."

For example, Astrachan said, he would welcome receivingadvertisements about tennis rackets and Wimbledon tickets if he wereto visit a tennis camp's website. However, he would object onprivacy grounds if he were to receive an advertisement from ahospital after an online search about a disease.

"There's definitely some benefits to have people perhaps trackyou...," Astrachan said, but added, "I should be able to opt out ofsome areas. If I'm looking for a DWI lawyer, I don't want the worldto know."

The focus of any industry, regulatory or statutory Do Not Tracksystem should allow users to "opt out of the gathering of all dataor certain data in an easy-to-use, conspicuous manner," Astrachansaid. "If you visit a site, there ought to be some way to click onthat site and say 'Do not track me' and the company would have tocomply."

Google and LinkedIn said they are doing exactly that, withoutbeing compelled to by federal law. The two companies, in response toinquiries regarding FTC's Do Not Track proposal, issued statementssaying they have taken and continue to take steps to address privacyconcerns related to the dissemination of information to advertisers.

Google, an online search engine, said it has begun using adownloadable directive that enables users to tell Internet sites notto share information with advertisers.

"The idea of 'Do Not Track' is interesting, but there doesn'tseem to be wide consensus on what 'tracking' really means, nor hownew proposals could be implemented in a way that respects people'scurrent privacy controls," Google's statement said. "As our firststep in addressing these concerns, we have created Keep My Opt-outs, which allows users to opt-out of the vast majority of interest-based and behavioral advertising today. This is a new tool -- onethat is effective today -- to give people more control over theironline privacy, and we hope it contributes to continuing dialogueabout what 'Do Not Track' could look like."

Honor system

Web browsers like Mozilla and Firefox have also started offeringopt-out options. While Google's system may differ from those offeredby the browsers, The Wall Street Journal has reported they share atleast one feature: they all rely on their advertisers to honor theuser's request.

An aide to U.S. Rep. Jackie Speier, D-Calif., says Speier willintroduce legislation this week that will support the FTC's opt-outrule and require covered entities to respect the consumer's choice.

Not all five of the FTC's commissioners favor the Do Not Trackproposal, however.

Commissioner William E. Kovacic called the proposal "premature,"saying not enough attention has been paid to the argument thatrevenue generated from online advertising keeps the Internet free.Online use by consumers who opt not to be tracked would besubsidized by those who allow their information to be sold toadvertisers, he said.

"Assuming a content provider continues to provide free content,consumers who opt out of tracking contribute less to the provisionof content than do consumers who do not opt out, but enjoy the samecontent as those who agree to be tracked," Kovacic wrote in aconcurring statement to the preliminary report.

Rich, of the FTC's consumer protection division, said the agencywelcomes the industry's internal efforts to control the flow ofpersonal information.

"We think it's great that industry is working to come up with asolution," Rich said. "They are working on it and we want them tokeep working on it."

So far, though, those efforts have fallen short of enablingconsumers to prevent not only the dissemination of personalinformation, but the collection of the data in the first place, shesaid.

And, in testimony to a House Energy and Commerce subcommittee theday after the FTC's report came out, the Consumer Federation ofAmerica said the potential invasions of privacy that can occuronline are too great to entrust a Do Not Track system to self-regulation by industry.

"This behavioral tracking is primarily used for marketingpurposes at this point, but it can also be used to make assumptionsabout people in connection with employment, housing, insurance andfinancial services; for purposes of lawsuits against individuals;and for government surveillance," Susan Grant, the federation'sdirector of consumer protection, told the subcommittee in writtentestimony. "If someone were following you around in the physicalworld -- tailing you and making note of everywhere you go, what youread, what you eat, who you see, what music you listen to, what youbuy, what you watch -- you might find that disturbing."

No comments:

Post a Comment