A House Subcommittee gathered today for what was most likely their last hearing of this congressional session to discuss the feasibility of a do-not-track mechanism for the Web. While the hearing provided little in the way of technical discussion regarding how such a mechanism might be implemented, a Federal Trade Commission representative assured that implementation of a universal method for opting-out of online data tracking – a.k.a. a do-not-track mechanism – is doable.
In addition to the hearing, intended to discuss the need for do-not-track legislation, both Senator John Kerry and Rep. Ed Markey each have indicated they will propose bills relating to online privacy.
The FTC is “confident that do-not-track is feasible and can be effective,” said David Vladeck, director of the FTC’s Bureau of Consumer Protection. He said the agency’s technology staff has assured the practicality of a do-not-track approach.
“The FTC has not taken a position on how do-not-track should be implemented,” continued Vladeck, who sought to clarify what a report unveiled by the FTC yesterday endorses. “We’re not proposing the creation of a list, nor are we proposing a centralized system managed by the Federal Government,” he said. “There is no need for a do-not-track mechanism to be administered by the Federal Government.”
Vladeck also stressed such a system would be “enforceable.” All along, the FTC has pushed for increased enforcement authority in regards to its privacy initiatives, and has asked for Congress to grant it more authority in conjunction with possible legislation that could call for an online privacy protection tool. Essentially, the commission wants the ability to slap fines on companies that do not abide by privacy laws, and to create rules without the approval of Congress.
The FTC yesterday published a lengthy report proposing a framework for protecting consumer privacy. In the report, the commission refers to a do-not-track approach, describing it as a mechanism involving a persistent cookie-like browser setting notifying third party ad tracking and targeting firms that a consumer does not want to have data collected or used.
One thing that remains unclear is whether the FTC supports do-not-track for all third-party tracking technologies – which could include analytics technologies – or for online advertising technologies only. The report refers to its proposed framework as applicable “broadly to online and offline commercial entities that collect, maintain, share, or otherwise use consumer data that can be reasonably linked to a specific consumer, computer or device.” When referring to its support for a universal do-not-track type method, the report refers to such a tool in reference to online behavioral advertising, and describes it as something “signaling the consumer’s choices about being tracked and receiving targeted ads.”
During the hearing, to explain why currently available industry self-regulatory methods are inadequate, Vladeck suggested that they can fool consumers into thinking they are opting-out from “all third party tracking mechanisms” while they’re in fact opting out from ad targeting only.
The proposal leaves much ambiguity about what constitutes tracking, said hearing witness Daniel Castro, senior analyst, Information Technology and Innovation Foundation. The hearing was held by the House Commerce, Trade, and Consumer Protection Subcommittee.
“I’m not sure the technology is in place to establish such a mechanism,” said Rep. Ed Whitfield, ranking member on the House Commerce Subcommittee, who expressed concern over how do-not-track could affect advertising supported Internet content. Whitfield, a Republican, is among several legislators whose campaigns have received donations from the Interactive Advertising Bureau’s Political Action Committee.
The IAB is closely involved with the ad industry’s most recent self-regulatory regime. In October, a coalition of ad industry organizations including the IAB unveiled an icon intended to be displayed on ads targeted using behavioral data, as well as other forms of targeting in some cases. The symbol will link to more information about how the ad was targeted, and allow users to click to opt out of targeting by participating publishers and ad networks. The group recently made a beta version of the system available to consumers.
“We’re going to continue to build the program,” said Mike Zaneis, the IAB’s Public Policy VP. Zaneis suggested that the alliance’s program fulfills the goals set forth in the FTC’s report.
The FTC report is still being parsed by industry groups and their lawyers as well as privacy advocates. The U.S. Department of Commerce plans to publish its own report – expected to follow similar lines – “in weeks, not months,” according to Daniel Weitzner, associate administrator for the Office of Policy Analysis and Development at the department’s National Telecommunications and Information Administration body.
The FTC report, said Weitzner, “Will certainly inform the administration’s thinking going forward.”
The FTC’s suggestion for a do-not-track mechanism could be mandated by legislation. In the House, Rep. Bobby Rush of Illinois, current chair of the Commerce and Trade Subcommittee, introduced a privacy bill in July. Meanwhile, Massachusetts Senator John Kerry announced he has been drafting privacy legislation in recent months.
“During the process of drafting legislation, I’ve concluded that consumers should have three nonnegotiable rights. First, all firms must put procedures in place to secure personally identifiable information. Second, consumers have a right to know in clear and concise terms what firms intend to collect, why, and how it will be used. Third, consumers should be given a simple mechanism for opting out of the process,” stated Kerry in a press release.
In addition, a third Democrat, Rep. Edward Markey of Massachusetts, announced today his intentions to propose legislation featuring a do-not-track requirement specifically to protect children’s privacy.