The Federal Trade Commission has endorsed industry
adopting a "do not track" regime similar to the "do not call"
list, though rather than a database; it would be, preferably, functionality in
a browser that would allow for tracking control. That would give Web surfers a
blanket opt-out from the preference tracking that allows behavioral marketers
to target ads.
That came as one of the recommendations in a
just-released FTC staff report on a framework for balancing privacy with
"innovation that relies on consumer information to develop beneficial new
products and services." Browser-based "do not track"
functionality also got a shout out, at least in principle, by the
administration's top telecom policy advisory arm Wednesday.
FTC Chairman Jon Leibowitz has consistently
recognized the value of targeted online marketing, including the fact that
it helps underwrite the free Web content users have come to expect.
The report recommends a "privacy by
design" approach by industry, including "reasonable security for
consumer data, limited collection and retention of such data, and reasonable
procedures to promote data accuracy."
It also calls for clearer notice to consumers
about their privacy choices and for an opt-in regime for sensitive
information--health, finances--as well as for "material retroactive
changes," which means if a company changes policy, according to an FTC
spokesperson. For everything else, the report asks for public comment on
whether opt in or opt out is the way to go.
"Our report and law enforcement action send a
clear message to industry: despite some good actors, self-regulation of privacy
has not worked adequately and is not working adequately for American
consumers," said Leibowitz. "We deserve far better from the companies
we entrust our data to, and industry, as a whole, must do better."
The law enforcement action was an FTC settlement
announced Monday in which a company that sold online software to enable parents
to monitor their kids online was at the same time selling information about
those kids' online activities to third-party marketers, with the only
"hint" it was doing so in "a vague statement buried 30
paragraphs down."
Leibowitz said to look for more such online
complaints/settlements in the weeks and months to come as the FTC brings its
power to prevent unfair and deceptive practices to bear on online privacy,
particularly where kids and teens are involved, he said.
The FTC report was issued the day before a House
hearing on whether it is time for "do not track" legislation.
Obviously, the FTC thinks it is time for consumers to have easier opt-out mechanisms,
but Leibowitz said Wednesday that it has not taken a position on any specific
legislation, and wants to encourage industry to move faster on self-regulatory
efforts, which he said so far have not been sufficient.
The report also talks about deep packet inspection
techniques as a privacy concern.
"So far, we think the FTC took a major step
forward today," said Jeffrey Chester of the Center for Digital Democracy.
Chester has been a leading voice for more government attention to online
targeting and marketing as one of the next big media consolidation
battlegrounds. "Certainly the broadband entertainment industry was
put on notice because the report said that deep packet inspection was a serious
privacy problem. It is on the commission agenda to address, which I think
raises questions about plans by cable and other broadband providers to expand
their online advertising business," said Chester. "This report has
consequences for the TV industry because all the data-collection practices
it describes are being imported into the TV Everywhere business
model."
Separately, Sen. John Kerry (D-Mass.), chairman of
the Senate Communications Subcommittee, said he would propose legislation that
would allow for safe harbor programs--another FTC suggestion--for companies
that agree to the following: "First, all firms must put procedures in
place to secure personally identifiable information. Second, consumers
have a right to know in clear and concise terms what firms intend to
collect, why, and how it will be used. Third, consumers should be given a
simple mechanism for opting out of the process."
"The Federal Trade Commission's report should be a
wakeup call for every Internet user in this country. The report confirms that
many companies - both online and offline - don't do enough to protect consumer
privacy," said Kerry.
While he said all firms should comply, he suggested
the FTC could take a flexible approach to enforcing those basic principles.
"We can take a hybrid approach to enforcement where the most critical
rights are protected through rulemaking while others may be subject to a
complaint and adjudication process," he said. "Those actors
participating in safe harbor programs would be subject to FTC oversight and
penalties, but because of their voluntary participation and commitment to high
standards, they would be free from a private right of action and the complaint
and adjudication process."
Elsewhere on the "do not track" front, Daniel
J. Weitzner, associate administrator for policy at the National
Telecommunications and Information Administration, told an audience at a
consumer watchdog policy conference in Washington Wednesday that the
debate over "do not track"--which was competing Wednesday with
network neutrality for the attention of media reporters--"is an
illustration of a larger problem: the overarching need for a more dynamic framework
that can incentivize the creation of industry codes of conduct, while also
being flexible enough to keep pace with innovation."
Weitzner said the Commerce Department's
Internet Policy Task Force "will look for opportunities to convene
industry and consumer groups to reach voluntary agreements on issues such as
affording users better ways to control the flow of personal information and to
signal their choices to companies online."
NTIA, an arm of Commerce, is the administration's chief telecom policy
advisor.
