FTC Official Indicates Readiness to Back Off Specifying Browser System for ‘Do Not Track’
An FTC official signaled that the commission’s staff is already prepared to back off, in the face of pushback, its proposal this month that an online “do not track” mechanism be browser-based. “We really need to open our minds to some other alternatives,” said Jessica Rich, the Consumer Protection Bureau’s deputy director. Speaking Tuesday on a teleconference of the American Bar Association’s Antitrust Section, she said, “Maybe the browser-based system isn’t the best solution.” Rich declined to embrace a new technology offered by Microsoft.
Sign up for a free preview to unlock the rest of this article
If your job depends on informed compliance, you need International Trade Today. Delivered every business day and available any time online, only International Trade Today helps you stay current on the increasingly complex international trade regulatory environment.
"Do not track” has drawn the most response of any suggestion in a draft staff report on businesses’ collection and use of consumer data, including for behavioral advertising, Rich said. But the “principal objections” to the recommendation are off-base, she said -- “more about what it’s not.”
Rich said she’s pleased by the response to the effort overall. “I was incredibly heartened by the reaction to the report, because overwhelmingly there was a focus on the substance. … I actually expected there to be a little more criticism,” including of the FTC’s consideration of recommending enactment of federal do-not-track legislation.
The FTC expects a great deal of comment by the Jan. 31 deadline, much more than in response to the “original call” before the report, Rich said. “It could take a number of months to issue the final report,” because “we will take the public comment seriously, and it will be reflected” in the product, she said. A vote by the commissioners on the staff report will allow them to take credit if the report is well received, Rich said half-jokingly, and duck blame if it isn’t. “Four commissioners support” do not track, but the fifth, William Kovacic, dissented from the recommendation, calling it “premature” and saying “he didn’t have enough information,” Rich recounted.
Enforcement actions can be expected after the final report is released, because the FTC needs to “show there are teeth” to its privacy policies, Rich said. “You're going to see more data security cases and you will see cases involving undermining of consumer choice” under laws such as the Fair Credit Reporting Act, Gramm-Leach-Bliley and the FTC Act’s ban on “unfair or deceptive acts or practices,” she said.
The FTC hasn’t taken a position on whether do-not-track legislation is needed or self-regulation will work, Rich said. “I don’t believe we have authority under our existing rules and regulations” to require the system, she acknowledged. Besides, the commission’s rulemaking procedure “is very cumbersome, and we don’t often use it,” Rich said.
"It would be an uphill battle” to enact legislation, said law Professor Jeffrey Rosen of George Washington University, one of the session’s moderators. “It would be an ambitious project to get Congress to pass something like this.” Rich said, “Do not track has a lot of cachet, and it’s easy to understand, unlike some other privacy proposals.” She wouldn’t handicap the chances of passing a law. The response that “industry opt-out mechanisms are adequate” fails to take into account several points, Rich said: They have been “slow” in coming, they haven’t been carried out, they are “not prominent” or “easy to be used by consumers” and no private system is “likely to be universal, because it requires individual companies to sign on."
Worries that a do-not-track system “would create privacy problems” of its own are based on the misconception that, like Do Not Call, it would involve a federal registry of consumers vulnerable to breaches, Rich said. There will be no “big honeypot with all of the IP addresses” of participants, she said. An objection that the system wouldn’t be feasible isn’t supported by the agency’s study, but it does point up that “only part of it would be automatic and through technology,” such as preventing cookie placement, and FTC enforcement would be needed to back up the rest of the policy, she said. Do not track wasn’t workable when a coalition including the Center for Democracy & Technology and privacy activist Pam Dixon proposed it at a commission “behavioral advertising town hall a couple of years ago,” Rich said. But now the FTC’s new chief technology officer, Ed Felten from Princeton University, and colleagues have come “up with what we think is a feasible proposal.”
Only when asked did Rich take up the contention that promoting opt-outs would undermine the business model for free online content, including most journalism. The FTC doesn’t want to destroy the benefits of behavioral advertising, she said. The commission has sought comment on the possibility of giving consumers “granular choices,” such as allowing them to control the kinds of information collected about them or the types of ads they would receive, Rich said. “One of the main things that we've been contacted about” is that the agency was too quick “about signaling our preference for a browser-based system,” Rich said. “We hope to get comment about that from technologists. … We do not want a technological freeze” resulting from a government choice of a particular approach.
Microsoft said last week that Internet Explorer 9 will soon allow users to list sites whose tracking they want to block, Rich noted. Consumer groups or other trusted nonprofits could circulate lists of sites for users to download, she said. “There is doubt about whether this is the best system,” Rich said in response to a comment that it wouldn’t deal with sites that users haven’t anticipated visiting. But “we commend companies that are coming up with ideas on this,” she said. “This is by no means easy."