Planned new online privacy legislation will go beyond simply requiring an opt-in/opt-out choice by consumers.
That was the message from House Communications, Technology & Internet Subcommittee Chairman Rick Boucher (D-VA) Thursday at a hearing on "Communications Networks and Consumer Privacy: Recent Developments."
"Opt in, taken by itself, is meaningless." said Boucher.
Boucher, who said there would be at least one more hearing--focusing on behavioral advertising--before he comes up with the bill, was responding to the counsel by a number of witnesses that simply offering those choices was insufficient to address the consent issue.
"I personally concur completely that what is needed is not just a decision between opt in and opt out, but also a framework for privacy protection."
He said an online privacy bill he co-authored with Rep. Cliff Stearns (R-FL) he introduced, and which will be the foundation of the the new bill, "contains exactly the kinds of formulas that many on the panel have suggested, which includes that any service that collects information about a customer must disclose what information and how that information is used, and then provide the appropriate opportunity for that customer to act on that information, whether that be by opt in or opt out."
Thursday's hearing focused mostly on the issue of deep packet inspection (DPI), which networks use to manage traffic, but can also be used for tracking Web surfing, data that can be packaged and sold to marketers. Boucher acknowledged the positive uses of DPI to better control traffic or identify viruses, or helping law enforcement. But he said the implications for intrusions on privacy were "nothing short of frightening," citing the ability to track every search or read every e-mail and attached document.
National Cable & Telecommunications Association President Kyle McSlarrow said none of his members were using the technology for behavioral advertising. Dorothy Attwood, chief privacy officer of AT&T Services, said AT&T does not use DPI in connection with behavioral advertising today, and if it does in the future will not do so "without the customer's express meaningful consent."
Boucher tried to pin her down on whether that meant opt-in. She initially said it "absolutely can include opt in," saying opt in and opt out were old terminologies. When Boucher said that what he meant by opt in was that her customer would have to "take an affirmative step of some kind in order to expressly authorize you to engage in the identification and tracking process," in other words "clicking a box would be an example."
Attwood said that would also be an example of customer engagement. When pressed by Rep. Anna Eshoo (D-CA), Attwood did ultimately say the company supported opt in. McSlarrow associated himself with Attwood's support for "engagement and complete transparency and customer control," while saying the industry has not made any announcement about policy.
Saying that at least as far as the ISP's in his association, he said he could report that "when you talk about user data providing the bedrock for behavioral targeted advertising, they recognize that the burden has to be a lot heavier. An affirmative step taken by the consumer after engagement in education we have recognized as the necessary precondition to moving forward."
McSlarrow said NCTA does not support privacy legislation, saying it would be better to allow industry to work together with the committee on self-regulatory principles that included transparency and robust consumer notification, rather than try to capture a young, moving broadband industry in the equivalent of regulatory amber.
He said that behavioral advertising has the potential to be "the most pro-consumer thing we do" in terms of allowing new services to survive and thrive by allowing them to be monetized.
Boucher praised McSlarrow and Attwood for their "announced intention to protect consumer privacy." For the cable industry, McSlarrow told the committee, that means transparency, customer control, personal information protection and value.
McSlarrow also pointed out to the committee that the cable industry already operates under a privacy framework established by the Cable Act, a framework that got a shout-out from other witnesses.
As expected, the cable industry's Canoe Ventures was raised during the hearing, cited by Boucher as one of the things he was interested in learning more about.
Stearns, who is ranking member of the committee, teed up the Canoe issue, giving McSlarrow a chance to explain the status of the initiative and "what it is really about." (Stearns seemed to know a lot already, volunteering the name of Cox to the list of consortium members when McSlarrow was ticking them off, and endeavoring to explain what Canoe did even before McSlarrow.
For his part, McSlarrow said it was a consortium of six cable operators who were building a platform to work with program networks and advertisers to "allow them to deliver more relevant advertising to the consumer." He said the classic example would be to make sure that you were delivering a dog food commercial. McSlarrow said Canoe currently has two products they plan on launching. "One uses just third-party demographic data. It doesn't have any set-top box user data at all. The second one would be that a commercial would come up and you have an opportunity to push a button and say 'yes, I would like to order a pizza," so it has a built-in, opt-in system."
McSlarrow said he had asked Canoe, in preparation for the hearing, whether they had any plans to use set-top box generated data for purposes of advertising, and they said "it was not even on the product road map."
But he did say that, "they do recognize if and when down the road they have to take a look at that they would have to comply fully with the Cable Act," which contains a number of restrictions on the use of personally identifiable information, though that regime does not apply to the online side of the business.
