The Do Not Track List and the Law of Unintended Consequences

Over the last few months, several news articles have reported on the collection and use of information gathered from consumers as they visit certain websites, often without their knowledge and consent. These reports have attracted the attention of Congress and may result in legislation governing these practices.

In addition, the Chairman of the Federal Trade Commission recently intimated when testifying before Congress that the consumer protection agency is considering several privacy-related initiatives, including the development of a registry similar to the Do Not Call list, which would provide consumers with the ability to opt out of having their online behavior tracked by website operators and advertising networks.

However, the feasibility of such an initiative, while well-intentioned, may result in greater costs to businesses and a reduction of access to free online content for consumers. In addition, there are many logistical issues surrounding the idea of a registry that may make it difficult, if not impossible, to implement at this time.

Congressional Action

While the issue of online tracking is not new, a series of recent articles in The Wall Street Journal revealed the data collection practices of some of the largest and most visited websites, focusing on their use of tracking devices to capture information about visitors to the sites. The WSJ reported that in all instances, these tracking devices are used without the express permission of the visitors, and while many operators may disclose their data collection practices, many others do not. Similarly, some operators allow consumers to opt out of this tracking, while others do not.

While the tracking itself does not generally identify specific individuals, the profile can be related back to a specific computer by its IP address. However, in some instances, specific individuals may be tracked through website login ID and password. Website operators use this information to deliver targeted advertisements to consumers on their sites and share it with third parties to develop profiles about these visitors as they visit other sites on the Web.

As a direct result of the WSJ articles, on Aug. 5, Congressmen Markey and Barton, Co-Chairs of the House Bi-Partisan Privacy Caucus, sent letters to the 50 website operators identified in the WSJ articles seeking detailed information about their data collection practices. Prior to this, in May 2010, Congressmen Boucher and Stearns introduced draft legislation that would require website operators to disclose their data collection and use policies, allow consumers to opt out of certain use and sharing, and require consumer opt in for the collection and use of sensitive data.

A recent statement from FTC Chairman Jon Leibowitz before Congress regarding a do not track registry breathed new life into an idea that was considered and failed in 2007, when a group of privacy advocates urged the FTC to pursue a similar initiative. At that time, industry group Network Advertising Initiative successfully fought the proposal, arguing that the industry policies itself sufficiently and that consumers are able to opt out by simply downloading a cookie to their computer. Critics, however, argued that this solution unfairly places the onus on consumers to opt out on each website and ad network.

Implementation and Implications

To address this criticism, the concept of a “one stop shop” registry appears attractive. However, while the putative registry would give consumers the opportunity to opt out just once from all tracking, it is still unclear as to how this registry will be implemented and who would bear the cost of its creation and maintenance.

Some have suggested that it will be e-mail-based. However, a person surfing the Web cannot be tracked by their e-mail, but rather through their browser, by an IP address or a cookie to their computer. If the registry is somehow cookie-based, then the tracking would be applicable to the computer itself as opposed to a particular individual. If this is the case, a consumer would need to register each of the computers that they use in order to fully opt out of all tracking.

In addition to concerns about how a registry would be implemented, there are real concerns about the implications of allowing consumers to opt out of online tracking. Many publishers and advertisers rely on the information gathered by individual websites and ad networks to target their message and content to persons who fit a desired profile, thus making tracking a highly efficient and cost-effective model for advertisers and marketers as well as consumers. By serving ads only to those people that exhibit a desired behavior, advertisers pay for ads to be displayed only to a particular group of people that fit their target demographic. In return, consumers see ads that are most relevant to interests based on their online behavior, and online publishers subsidize the cost of providing free content with fees earned by advertisers.

If tracking is compromised or curtailed entirely, marketers will be faced with new challenges as they attempt to balance their data collection and use practices with the sensitivities and rights of consumers. Advertisers will be driven to pay for a larger number of impressions across a broader spectrum of websites, online publishers will be forced to charge for content, and consumers will be faced with restrictive paywalls.

FTC Standpoint

The FTC acknowledged these issues last year when it issued guidelines that set out expectations and best practices for website operators that collect and use information gathered from consumers online activities. In developing these principles, the FTC acknowledged “the potential benefits of behavioral advertising to consumers, including the free online content that advertising generally supports and personalization that many consumers appear to value.”

This point was recently supported by the FTC’s Director of Consumer Protection David Vladeck when he commented in an interview with Advertising Age that he doesn’t enable the do-not-track function on his browser, as he “sort of like[s] the personalization.” Vladeck also appears to be a proponent of allowing website operators to track consumer activities online, provided consumers know about such activities, commenting “[m]y view is if you tell people you’re collecting information for the singular purpose of delivering targeted ads to make the Internet more personal, I don’t think most consumers would have a problem with that at all.”

However, on the issue of disclosures, he warned, “one of our principal concerns here at the FTC is that consumers generally don’t realize they’re being tracked.” In that regard, he suggested that a company’s failure to adequately inform consumers of their data collection practices or collecting data under false pretenses will likely be considered a deceptive practice by the FTC. Interestingly, on the feasibility of a do not track registry, Vladeck offered “its not a technically viable option for the moment.”

Best Practices

The debate on online tracking is far from over. In fact, it’s just heating up. Advertisers, ad networks and publishers that track or rely on aggregating customer behavior are pitted against privacy advocates, regulators and legislators that question the amount and use of information being collected online.

Congress will no doubt consider this issue in its next session, and the FTC will continue pursuing companies that collect information from consumers without disclosing such practices. For the time being, companies that track consumer behavior online are well-advised to comply with the four Fair Information Practice Principles espoused by privacy advocates and endorsed by the FTC:

1. Notice (of collection and use practices)
2. Choice/Consent (allowing consumers to choose how their information may be used)
3. Access/Participation (allowing consumer access to their information for accuracy and updating)
4. Integrity/Security (maintaining information in a safe and secure environment)

Adopting and adhering to these guidelines will likely result in multiple benefits as regulators and legislators might favor a self-regulatory scheme that works efficiently and effectively over legislation that may have unintended implications for business and consumers.