FTC, Congress look into ‘Do Not Track’ system

Listen to this article

The agency that brought us the “Do Not Call” list to prevent telemarketers from interrupting our dinners has now proposed a “Do Not Track” system to prevent Internet sites from sharing purchasing information about their online visitors with advertisers.

The Federal Trade Commission’s proposal comes amid concern from consumer groups that the dissemination of such personal information in cyberspace constitutes an invasion of privacy that the online industry has not done enough to prevent.

Online advertisers, and the lawyers who represent them, counter that the exchange of information benefits consumers by limiting the ads they receive to products they might be interested in, based on the websites they visited — a practice known as “targeted” or “behavioral” marketing.

The advertisers say the revenue the sites generate by selling the information enables them to offer free access to their sites.

“It allows consumers not to be bombarded with irrelevant advertising,” said Andrew B. Lustigman, a New York lawyer who represents advertisers before the FTC. “That’s why all this content is available for a very low price or free.”

But attorney Eric Menhart, who specializes in legal issues in cyberspace, said a Do Not Track system potentially serves the interests of both Internet surfers who want their privacy protected and advertisers who want the biggest return on their online postings.

It enables advertisers — at no cost to themselves — to discover those consumers who want to be solicited and those who definitely do not, said Menhart, who made a name for himself while still in law school by forming MaryCLE LLC to sue over unsolicited ads, or spam e-mails, the company received. His actions helped establish the validity of Maryland’s anti-spam laws. He later opened his law firm, CyberLaw PC, in Washington, D.C.

“If people feel that they’re being ‘spied on’ and they see ads that are very targeted to them … they are going to feel this company has too much information about me,” Menhart said. “The advertiser doesn’t have to worry about [targeting] that segment of the population.”

The FTC proposed its Do Not Track system in a preliminary staff report released in December. In that report, FTC staff members expressed concern that privacy policies of online companies insufficiently warn consumers how their information will be used, particularly with regard to the sale of online information to advertisers.

“Privacy policies have become longer, more complex, and, in too many instances, incomprehensible to consumers,” according to the report, “Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers.”

“Too often, privacy policies appear designed more to limit companies’ liability than to inform consumers about how their information will be used,” the report said. “Consumers may feel harmed when their personal information — particularly sensitive health or financial information — is collected, used, or shared without their knowledge or consent or in a manner that is contrary to their expectations.”

The Do Not Track system the FTC contemplates would most likely involve placing a “persistent cookie” on a consumer’s browser and conveying that setting to sites the browser visits to indicate if the consumer wants to be tracked or receive targeted advertisements, the report stated.

Potomac cyberspace lawyer Peter Toren called the FTC’s proposal “a small baby step” in protecting privacy on the Internet because it would require users to opt out of permitting online companies to sell information to advertisers for the protection to take effect. A more aggressive approach would prohibit the personal information from being sold unless the consumer expressly opts in and informs companies they can share the data, said Toren, of Shulman Rogers Gandal Pordy & Ecker PA in Potomac.

However, he termed the proposal “a good first step in the sense that it opens a needed dialogue about perhaps increasing privacy standards.”

Self-regulation

Baltimore advertising attorney James B. Astrachan said the FTC’s proposal is a warning to the online industry that if it fails to address the privacy concerns raised in the report, the agency or Congress might take action to force the companies to act.

The agency is attempting to get industry leaders who rely on advertising as a revenue base — such as Google, Facebook and LinkedIn — to create an effective method to enable Internet surfers to bar companies from collecting or sharing information with advertisers, added Astrachan, a partner at Astrachan Gunst Thomas Rubin PC and chairman of The Daily Record’s Editorial Advisory Board.

Selling advertising is “part of the revenue model” for these websites, Astrachan said. The FTC is essentially telling these companies, “You guys need to sit at the table and come up with a self-policing model,” he added.

Jessica Rich, deputy director of the FTC’s Bureau of Consumer Protection, confirmed Astrachan’s view.

“We definitely are asking the industry to step up to the plate,” Rich said. Online companies must give consumers “meaningful choices” regarding whether and how information about their Web visits is collected and disseminated, she added.

The commission is accepting public comments on its proposal until Feb. 18 and seeks input on ways to balance the privacy interest of consumers and the desire to keep the Internet free.

The FTC had originally set a Jan. 31 deadline for comments but extended it amid requests from the American Bar Association’s Section of Intellectual Property Law, the American Association of Advertising Agencies, and the Computer and Communications Industry Association.

Astrachan said the issue of webtracking for advertising purposes is essentially a 21st-century application of the age-old business practice of market research.

For years companies have tracked the buying habits of people through telephone surveys, questionnaires and by enclosing postcards in consumer goods.

The postcards often asked questions regarding one’s household income and the type of car they drove.

“This is an old question of, ‘We’ve gathered data on you. Can we use it? Can we sell it to advertisers?’” said Astrachan, author of The Law of Advertising, published by Matthew Bender. “This is not a new question. It’s just more technologically sophisticated in how they’re doing it.”

For example, Astrachan said, he would welcome receiving advertisements about tennis rackets and Wimbledon tickets if he were to visit a tennis camp’s website. However, he would object on privacy grounds if he were to receive an advertisement from a hospital after an online search about a disease.

“There’s definitely some benefits to have people perhaps track you…,” Astrachan said, but added, “I should be able to opt out of some areas. If I’m looking for a DWI lawyer, I don’t want the world to know.”

The focus of any industry, regulatory or statutory Do Not Track system should allow users to “opt out of the gathering of all data or certain data in an easy-to-use, conspicuous manner,” Astrachan said. “If you visit a site, there ought to be some way to click on that site and say ‘Do not track me’ and the company would have to comply.”

Google and LinkedIn said they are doing exactly that, without being compelled to by federal law. The two companies, in response to inquiries regarding FTC’s Do Not Track proposal, issued statements saying they have taken and continue to take steps to address privacy concerns related to the dissemination of information to advertisers.

Google, an online search engine, said it has begun using a downloadable directive that enables users to tell Internet sites not to share information with advertisers.

“The idea of ‘Do Not Track’ is interesting, but there doesn’t seem to be wide consensus on what ‘tracking’ really means, nor how new proposals could be implemented in a way that respects people’s current privacy controls,” Google’s statement said. “As our first step in addressing these concerns, we have created Keep My Opt-outs, which allows users to opt-out of the vast majority of interest-based and behavioral advertising today. This is a new tool — one that is effective today — to give people more control over their online privacy, and we hope it contributes to continuing dialogue about what ‘Do Not Track’ could look like.”

Honor system

Web browsers like Mozilla and Firefox have also started offering opt-out options. While Google’s system may differ from those offered by the browsers, The Wall Street Journal has reported they share at least one feature: they all rely on their advertisers to honor the user’s request.

An aide to U.S. Rep. Jackie Speier, D-Calif., says Speier will introduce legislation this week that will support the FTC’s opt-out rule and require covered entities to respect the consumer’s choice.

Not all five of the FTC’s commissioners favor the Do Not Track proposal, however.

Commissioner William E. Kovacic called the proposal “premature,” saying not enough attention has been paid to the argument that revenue generated from online advertising keeps the Internet free. Online use by consumers who opt not to be tracked would be subsidized by those who allow their information to be sold to advertisers, he said.

“Assuming a content provider continues to provide free content, consumers who opt out of tracking contribute less to the provision of content than do consumers who do not opt out, but enjoy the same content as those who agree to be tracked,” Kovacic wrote in a concurring statement to the preliminary report.

Rich, of the FTC’s consumer protection division, said the agency welcomes the industry’s internal efforts to control the flow of personal information.

“We think it’s great that industry is working to come up with a solution,” Rich said. “They are working on it and we want them to keep working on it.”

So far, though, those efforts have fallen short of enabling consumers to prevent not only the dissemination of personal information, but the collection of the data in the first place, she said.

And, in testimony to a House Energy and Commerce subcommittee the day after the FTC’s report came out, the Consumer Federation of America said the potential invasions of privacy that can occur online are too great to entrust a Do Not Track system to self-regulation by industry.

“This behavioral tracking is primarily used for marketing purposes at this point, but it can also be used to make assumptions about people in connection with employment, housing, insurance and financial services; for purposes of lawsuits against individuals; and for government surveillance,” Susan Grant, the federation’s director of consumer protection, told the subcommittee in written testimony. “If someone were following you around in the physical world — tailing you and making note of everywhere you go, what you read, what you eat, who you see, what music you listen to, what you buy, what you watch — you might find that disturbing.”