Consumer And Privacy Groups Urge Congress to Enact Consumer Privacy

Some very exciting news to report today! Yesterday a coalition of ten consumer and privacy advocacy organizations called on Congress to enact legislation to protect consumer privacy in response to threats from the growing practices of online behavioral tracking and targeting.

The coalition consists of the Consumer Federation of America, Center for Digital Democracy, Consumers Union, Consumer Watchdog, Electronic Frontier Foundation, Privacy Lives, Privacy Rights Clearinghouse, Privacy Times, U.S. Public Interest Research Group, and The World Privacy Forums.

This is a very impressive coalition speaking out on a very important privacy issue at a very important time.

So let me first give some backdrop on the issue of behavioral targeting on the Internet by quoting a few passages from the coalition's legislative primer entitled "Online Behavioral Tracking and Targeting Concerns and Solutions":

Privacy is a fundamental right in the United States. For four decades, the foundation of U.S. privacy policies has been based on Fair Information Practices: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability.

Those principles ensure that individuals are able to control their personal information, help to protect human dignity, hold accountable organizations that collect personal data, promote good business practices, and limit the risk of identity theft. Developments in the digital age urgently require the application of Fair Information Practices to new business practices. Today, electronic information from consumers is collected, compiled, and sold; all done without reasonable safeguards.

Consumers are increasingly relying on the Internet and other digital services for a wide range of transactions and services, many of which involve their most sensitive affairs, including health, financial, and other personal matters. At the same time many companies are now engaging in behavioral advertising, which involves the surreptitious tracking and targeting of consumers.

Click by click, consumers’ online activities – the searches they make, the Web pages they visit, the content they view, the videos they watch and their other interactions on social networking sites, the content of emails they send and receive, how they spend money online, their physical locations using mobile Web devices, and other data – are logged into an expanding profile and analyzed in order to target them with more "relevant" advertising.

This is different from the "targeting" used in contextual advertising, in which ads are generated by a search that someone is conducting or a page the person is viewing at that moment. Behavioral tracking and targeting can combine a history of online activity across the Web with data derived offline to create even more detailed profiles. The data that is collected through behavioral tracking can, in some cases, reveal the identity of the person, but even when it does not, the tracking of individuals and the trade of personal or behavioral data raise many concerns.

The report also lays out a series of specific concerns:

Tracking people’s every move online is an invasion of privacy. Online behavioral tracking is even more distressing when consumers aren’t aware who is tracking them, that it’s happening, or how the information will be used. Often consumers are not asked for their consent and have no meaningful control over the collection and use of their information, often by third parties with which they have no relationships. Online behavioral tracking and targeting can be used to take advantage of vulnerable consumers.

Information about a consumer’s health, financial condition, age, sexual orientation, and other personal attributes can be inferred from online tracking and used to target the person for payday loans, sub-prime mortgages, bogus health cures and other dubious products and services. Children are an especially vulnerable target audience since they lack the capacity to evaluate ads.

Online behavioral tracking and targeting can be used to unfairly discriminate against consumers. Profiles of individuals, whether accurate or not, can result in "online redlining" in which some people are offered certain consumer products or services at higher costs or with less favorable terms than others, or denied access to goods and services altogether. Online behavioral profiles may be used for purposes beyond commercial purposes.

Internet Service Providers (ISPs), cell phone companies, online advertisers and virtually every business on the web retains critical data on individuals. In the absence of clear privacy laws and security standards these profiles leave individuals vulnerable to warrantless searches, attacks from identity thieves, child predators, domestic abusers and other criminals.

Also, despite a lack of accuracy, employers, divorce attorneys, and private investigators may find the information attractive and use the information against the interests of an individual. Individuals have no control over who has access to such information, how it is secured, and under what circumstances it may be obtained.

Before I get to more of the coalition's specific proposals to address these concerns, let me detail why I think this effort is coming at an ideal time. The Federal Trade Commission (FTC) - as I have written about on this blog - has gone through some enormous positive changes under President Obama, and is apparently now committed to better protecting internet users from behavioral targeting and ads.

In a recent article in Business Week, FTC Chairman Jon Leibowitz, Obama's top consumer watchdog, said he wants to terminate—or at least rein in—delivering ads to individuals based on the Web pages they visit and searches they carry out (supporting the establishment of “opt-in” as the standard rather than “opt-out”).

Similarly, David C. Vladeck - the new head of the Bureau of Consumer Protection at the FCT – said in a New York Times article this week that the frameworks used historically for privacy on the web are no longer sufficient, and wants to expand the definition of what is considered “harm” to the consumer when a company infringes on their privacy to beyond solely a monetary measurement, but to whether their dignity was violated.

So two important signals (among others articulated in the articles) have been sent by Leibowitz and Vladek indicating the FTC is considering pushing for two essential legislative reforms (among many others) advocated by privacy leaders that would protect consumers: establishing "opt-in" as the standard and precedent and redefining what is considered “harm” to the consumer when his/her privacy is violated.

If ever enacted, each would represent a landmark improvement in protections for consumers against aggressive behavioral marketing techniques and industry data collection practices.

Before I get to the New York Times write up on the coalition's proposals to address behavioral targeting, let me provide some choice clips from their press release outlining some of their specific policy ideas as well as some choice quotes from privacy leaders:

“The rise of behavioral tracking has made it possible for consumer information to be almost invisibly tracked, complied and potentially misused on or offline. It’s critical that government enact strong privacy regulations whose protections will remain with consumers as they interact on their home computer, cell phones, PDAs or even at the store down the street. Clear rules will help consumers understand how their information is used, obtained and tracked,” said Amina Fazlullah of U.S. Public Interest Research Group. “In the event of abuse of consumer information, this legislation could provide consumers a clear pathway for assistance from government agencies or redress in the courts.”

“Respect for human dignity is at the core of our concerns, but we are also worried that online behavioral tracking can be used to target vulnerable consumers for high-price loans, bogus health cures and other potentially harmful products and services,” said Susan Grant, director of Consumer Protection at Consumer Federation of America.

“Limiting commercial tracking of our online activities may also help protect privacy against the government, which often gets information about us from private companies,” said Lee Tien, of the Electronic Frontier Foundation.

“The record is clear: industry self-regulation doesn't work,” said Beth Givens, Director of the Privacy Rights Clearinghouse “It is time for Congress to step in and codify the principles into law.”

...

Among the main points that the coalition said should be included in consumer privacy legislation:

· Sensitive information should not be collected or used for behavioral tracking or targeting.
· No behavioral data should be collected or used from anyone under age 18 to the extent that age can be inferred.
· Web sites and ad networks shouldn’t be able to collect or use behavioral data for more than 24 hours without getting the individual’s affirmative consent.
· Behavioral data shouldn’t be used to unfairly discriminate against people or in any way that would affect an individual's credit, education, employment, insurance, or access to government benefits.

Now let's get to the New York Times write up:

Privacy advocates, with their best chance in years to get new legislation limiting Internet targeting passed in Washington, are skipping their summer vacation this year.

...

Among the things they’re asking for: No sensitive information (like health or financial information) should be used for behavioral tracking, no one under 18 should be behaviorally tracked, Web sites and ad networks shouldn’t be able to keep behavioral data for more than a day without getting an OK from the individual they’re tracking, and behavioral data can’t be used for discriminatory purposes.

Some Congress members have indicated they will consider such legislation in the fall. That’s something industry has adamantly opposed. In July, industry groups offered new principles on how they would regulate tracking without government intervention They argue that legislation will lag the technology by a matter of years. Meanwhile, over at the Federal Trade Commission, David Vladeck, the new head of consumer protection, has indicated he has broader definitions of intrusive tracking than his predecessors did.

Click here to read the coalition press release, and here to read their detailed analysis and proposals for Congress to consider.

I don't think there's all that much for me to add here. Clearly these are critically important proposals for Congress to consider that will have an enormously positive impact on the future of consumer privacy on the Internet. There is nothing I can say that is not said better in the documents I have provided.

I can't really overstate how supportive I am of this work, and the proposals therein. Clearly some exhaustive work went into compiling this report and formulating these solutions to a growing problem and threat to individual privacy. A threat that will exponentially increase by the day if nothing is done. Now this will be a story I'll follow for you here!