The Federal Trade Commission is recommending Congress pass general baseline privacy legislation, and more specific legislation dealing with data brokers, or what FTC Chairman Jon Leibowitz calls "cyberazzi."
He said the FTC was not backing any particular bill, but more the general sense that there needs to be legislative teeth in ensuring an even playing field and rules of the road to provide more certainty for businesses.
But Leibowitz said Monday in releasing the FTC's final privacy report that he thought a "do not track" online regime could be achieved without legislation. But he also said that if a "real do-not-track option" that was persistent, easy to use and effective had not materialized by the end of the year, there would be a lot of support for "do not track" in the next Congress.
Leibowitz said that the companies in the Digital Advertising Alliance support "do not track" because it is the right thing to do, and praised their "extraordinary strides" in self-regulatory efforts to date, including serving hundreds of billions of ads monthly with the ad choices icon that allows browsers to opt out, as well as a more recent commitment to honoring browser-based solutions. But he also said it was "pretty clear more work needs to be done."
He said the FTC's recommended approach to do not track was pretty conservative. He said consumers should have the "modest" ability to opt out, and only for third party tracking, though he said that opt out meant opting out of data collection, not just of using that to target advertising. He said that conservative approach was based on "the notion that a computer was your property and people shouldn't put things in without your consent."
"I like to think that if you have 90% of the advertisers who are willing to give consumers a do not track option, the others will come along. And it is also worth noting that if you are doing truly unfair things [even] if you don't make a commitment, like extracting information that you have no difference extracting from consumers mobile devices or computer, that might be actionable under the FTC Act."
He said that baseline privacy rules of the road legislation that go "well beyond do not track," could be good for consumers and businesses alike.
He said he thought that industry had a self interest in privacy that went beyond avoiding regulation. He has long argued that clearer privacy policies benefit business because it increases consumer trust in using the system. "I think people just get that it is the right thing to do."
Leibowitz said that the FTC will not initiate any rulemakings beyond its upcoming proposed changes to the Children's Online Privacy Protection Act.
The report boils down to three key principles: 1) Industry should make privacy protections part of their DNA (privacy by design); 2) Consumers have to have choice and control about how their data is collected and used; and 3) Consumers must have transparency about how that data is handled.
