Q&A: FTC’s Top Technologist Talks Data Tracking

When the Federal Trade Commission says “do-not-track,” what does it mean exactly? What types of online data is the agency referring to in its proposal for a browser-based mechanism allowing consumers to opt-out from tracking? To clear up confusion, ClickZ News interviewed the FTC’s new – and first – chief technologist, Edward Felten, who advises the FTC on technology and policy issues.

ClickZ: There is some confusion over what type of data tracking the FTC wants a potential do-not-track mechanism to control. Does the FTC support do-not-track for all third-party tracking technologies including analytics technologies that measure site audiences, for instance – or for online advertising technologies only? If an FTC-endorsed do-not-track system were put in place, would any first-party tracking be allowable?

Felten: The recent FTC report envisions a do-not-track mechanism that lets consumers opt out of third party tracking for behavioral advertising, which is one of the most common forms of online tracking. If companies wish to share personal information with third parties for purposes other than online behavioral advertising, we think some greater form of user consent should be obtained. The system as currently envisioned would not apply to ordinary first party tracking or to a first party’s use of a service provider for website analytics, assuming the service provider makes no additional use of the collected data. It is important to note that what the FTC is discussing is a consumer choice mechanism, not a blanket ban on tracking.

ClickZ: Your colleague David Vladeck, director of the FTC’s Bureau of Consumer Protection, has said that current methods can fool consumers into thinking they are opting-out from “all third party tracking mechanisms” while they’re in fact opting out from ad targeting only. Can you elaborate on what was meant by this?

Felten: Some existing opt-out mechanisms allow the user to opt out of seeing tracking-based behavioral ads, rather than allowing the users to opt out of tracking. In such systems, sites could still track opted-out users, as long as they used the tracking information for purposes other than showing ads. Users whose concerns are about tracking itself, or about non-advertising uses of tracking data, will not have their concerns addressed by such a system; and users who do not read the documentation carefully might not realize that the lack of behavioral ads does not mean that tracking has stopped.

ClickZ: Some publishers allow third party tracking firms to track their users in exchange for payment for that data, even if they don’t allow those data tracking partners to target ads on their sites. How might a do-not-track mechanism account for this complicated reality?

Felten: Do-not-track would allow users to opt out of third party tracking across sites. For users who did not opt out, the expectations would not change. Users who did opt out would not be subject to third party tracking across sites without the user’s consent. If the value exchange were made clear to users – some collection and tracking of their web browsing behavior supports the content provided – many users might very well continue to allow the tracking and targeting to occur.

ClickZ: If the FTC is indeed supportive of do-not-track for all forms of online tracking, how might the agency address concerns from site publishers that are reliant on various tracking systems – many of them third party systems – for things like audience measurement and analytics?

Felten: The FTC report recognizes that site publishers use analytics and audience measurement companies to help improve the publisher’s services. As long as these service providers do not use collected data for other purposes, such as combining it with data about the user’s behavior on other websites, these uses would still be acceptable. The report recognizes a distinction between third party companies that act as services providers for companies with whom the customer has a direct relationship and other third party companies.

ClickZ: The FTC has specifically suggested that a browser-based do-not-track mechanism would be feasible and enforceable. Some have suggested that to be truly relevant, the FTC framework must accommodate data tracking on mobile devices, televisions, game consoles, and even household appliances. Do you agree that the proliferation of connected devices might reduce the effectiveness of a browser-based mechanism? How would the FTC propose to control data collection in the future as consumers increase their use of connected devices?

Felten: The FTC report asks for comment on these issues. The discussion about tracking is most fully developed in the web setting, so it could make sense to offer a consumer choice mechanism in the web setting first, while continuing to evaluate the situation in other settings.

ClickZ: Vladeck argues do-not-track is “enforceable.” How might a browser-based do-not-track mechanism be enforced? Would the FTC monitor browser providers to ensure they are all compliant? Would the onus be on ad companies and data tracking firms to comply with whatever regulations or laws are put in place? If so, would the FTC rely on complaints to sniff out violations, or take a more proactive approach to monitoring for compliance?

Felten: The specifics of enforcement would depend on how a do-not-track system came into being. If a do-not-track system is created by industry self-regulation, the FTC’s main enforcement role might be to prevent companies from deceiving consumers about their participation in the system or to handle compliance problems referred by the self-regulatory organization. If Congress directs the FTC to create and enforce a do-not-track system, then the FTC would likely be in a position of investigating and enforcing against sites that engage in improper tracking of opted-out consumers. Violations might come to the FTC’s attention via consumer complaint, proactive investigation, or referrals from publishers or companies that do comply with the restrictions.