“Do Not Track”: What You Need to Know

The Federal Trade Commission published “Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Business and Policymakers” to address consumer online privacy issues including a suggestion web browsers should include a Do Not Track mechanism.  If this were to become law, it would have a dramatic effect on behavioral advertising.  Congress needs to act before it becomes law, so it is not time to panic, yet.

Privacy concerns are not new.  “Recent inventions and business methods call attention to the next step which must be taken for the protection of the person, and for securing to the individual what Judge Cooley calls the right “to be let alone.”  Louis Brandeis wrote this in 1890 before he became a Supreme Court justice.  The subject of his ire—new-fangled cameras and photographs.  130 years later, it is tracking web consumers’ web use that has the FTC concerned.  

Notwithstanding the criticisms, the FTC did extol some benefits.  ”Companies are using this information in innovative ways to provide consumers with new and better products and services.”  Unfortunately, the FTC immediately follows with the warning it has been given for more than a year that industry’s self regulation is severely lacking. 

The FTC’s framework focuses on three main components: privacy by design; clear and meaningful choice; and transparency. “The proposed framework applies broadly to commercial entities that collect, maintain, share, or otherwise use consumer data that can be reasonably linked to a specific consumer, computer or other device.”  The focus in the past has been on what has been described as Personally Identifiable Information or PII that would identify a specific user.  Now, the FTC wants to broaden the type of information it wants to protect to include anything that can not only identify the user, but the actual computer or device such as a smart phone that may simply reveal a location.

Privacy By Design
Privacy by Design means companies should promote privacy by everyone at every stage by: (1) collecting only what you need; (2) for that limited purposes; (3) retaining it only as long as you need it; and (4) implementing reasonable procedures to promote accuracy. With regard to limiting the types of information, the FTC wrote:

• If an advertising network is tracking consumers’ online activities to serve targeted ads, there is no need for the network to use key loggers or other applications to capture all data a consumer inputs.
• If a company collects information about unsecured wireless networks for the purpose of providing location-based services, the company should implement reasonable procedures to prevent additional, unintended collection of consumer data, such as the contents of individuals’ wireless communications.
• If a mobile application is providing traffic and weather information to a consumer based on his or her location information, it does not need to collect contact lists or call logs from the consumer’s device.

Clear and Meaningful Choice
The FTC criticizes lawyers just as much as marketers. The FTC says privacy policies have become confusing, conflated and used to mislead rather than to help or provide real choice.  Some argue people do have choice—consumers don’t have to play Farmville.  The FTC counters that some choice is apparent, but most consumers have no idea they are being tracked just because they visited a certain site. 

Do Not Track
While many browsers allow users to install cookies or other things to prevent tracking, the FTC says industry has not gone far enough.  “Given these limitations, Commission staff supports a more uniform and comprehensive consumer choice mechanism for online behavioral advertising, sometimes referred to as “Do Not Track.”  Do Not Track can come through legislation or “robust” self-regulation.

The FTC admits Do Not Track sounds easy in theory, but raises practical issues.  While a browser plug-in may be the easiest way to implement Do Not Track, websites would have to respect the consumer’s choice.  The FTC also thinks more sophisticated users may want more granular options limiting only certain types of tracking or tracking by certain people.  At the same time, the FTC is concerned about infringing on the benefits of targeted ads.  

Transparency
Discussing transparency, the FTC again takes aims at privacy policies even suggesting there should be a standardized form.  With the rise in smart phone use, the number of people who read privacy policies or End User License Agreements is dwindling even further.  Transparency would also include a consumer’s right to their tracked information in the same vein as credit reports.

The Legislation
The FTC currently has the power to fine companies for false and misleading acts, but does not have the power to require Do Not Track.  Instead, Congress would have to act.  There have been several proposals and we will look at one proposed by Illinois Democratic Congressman Bobby Rush.  Under Congressman Rush’s proposal, companies can collect and use consumer information, but must obtain consent before it is shared with third parties.  Some of the “best practices” would include notice regarding:

-    the type of information collected
-    the purpose of its collection
-    the length of time it is stored
-    when it may be disclosed
-    how consumers can access the information
-    how to exercise choices about the use of the data
-    how to challenge the accuracy of the data
-    how the data could be linked with other data
-    the link to the FTC’s consumer complaint form

The FTC would promulgate a standard notice form.  If notice is not provided, it would be illegal to collect and use data.  The law would only require consent to collect data if the data is disclosed to third parties, web usage is tracked, or “sensitive” data such as health or net worth is collected.  The bill expressly allows companies to make consent a condition to providing service or upgraded services.  Congressmen Rush’s bill also has a Fair Credit Reporting Act type disclosure and dispute process.  The bill would also require companies to implement reasonable safeguards to protect the data. 

The bill also calls for a self regulatory program as a Safe Harbor.  Industry groups can submit for FTC approval a voluntary program that would comply with the law.  It would have to:

-    provide clear and conspicuous opt-out procedures before information is shared with third-parties
-    allow consumers to easily set preferences for communications and behavioral tracking.
-    Include an application and verification process before companies would qualify
-    Include random reviews
-    Include penalties for non-compliance

The bill also allows for consumer lawsuits to recover statutory penalties, actual and punitive damages and attorneys’ fees for “willful violations.”  If a company is part of the approved program, people could not sue.  To the extent the FTC wanted to spur Congressional action, it has succeeded and without significant self-regulation, you can expect there to be some type of action out of Washington D.C.