FTC Considers Privacy Rules for Online Ads
Head of consumer protection agency hints at action to protect users online.
The Federal Trade Commission (FTC) on Monday convened a summit to explore the privacy concerns associated with online advertising, the latest signal that the federal government is inching toward a more active approach to a largely unregulated industry.
FTC Chairman Jon Leibowitz did not lay out specific plans for how the agency might proceed, but expressed alarm at the proliferation of data companies are collecting and sharing, saying the industry is at a "watershed moment in privacy."
To Leibowitz, part of the issue stems from the plummeting costs of collecting and storing data, a situation that has resulted in Internet firms that are awash in information about their users, which they use to sell more relevant -- and higher-priced -- ads.
"The computer cost of data collection seems to be approaching zero," he said. "Companies can store and crunch massive amounts of data relatively cheaply."
The FTC has been operating under a policy of self-regulation regarding online advertising. The agency has published guidelines outlining best practices for companies to treat their users' information, but without an enforcement mechanism critics say the self-regulatory principles, last updated in February, don't go far enough.
Leibowitz said today that he felt "the time is right to build on the February behavioral targeting principles," and that the traditional approach online companies have taken to data collection falls short.
The privacy policies that companies maintain tend to be written in dense legalese, he said, reiterating his support for a more meaningful way of securing consent from their users to collect and store data.
"We all agree that consumers don't read privacy policies, or EULAs (end user license agreements), for that matter," Leibowitz said. "I've been a supporter of opt in for quite some time."
Some prominent members of the industry have been moving lately to develop new privacy controls, efforts that opponents of heavy-handed government action cite as evidence that self-regulation works and that businesses will address the privacy problem in such a way that does not hinder the growth of a dynamic and fast-moving sector.
Just this morning, Yahoo! unveiled its Ad Interests Manager, an online portal that invites users to edit a list of interests that Yahoo! uses to serve ads, and also to opt out of interest-based advertising altogether.
Last month, Google rolled out a similar feature, and Facebook has been updating its privacy policies and controls in an effort to give users a more understandable view of how their information is collected and shared.
Panelists at today's FTC event, comprised of industry representatives, academics, and advocates, agreed that there is a broad lack of understanding among the public regarding Web firms' data collection practices.
"I think it's fair to say that generally speaking they know very, very little about what goes on online," said Joseph Turow, a professor at the University of Pennsylvania's Annenberg School of Communications. "People have this great sense that laws protect them far more than they do."
But even if the general awareness about online data collection were improved, Internet privacy still wouldn't be a red-meat issue to everyone, according to Alan Westin, a Columbia University professor emeritus of public law and government.
"It's useful to see that there's a pattern that the American public divides into," he said, noting that while some people care deeply about remaining anonymous online, there are others who freely share information about themselves without a worry. In between is a group Westin calls the privacy pragmatists, the moderates who accept that advertising makes content free and that it is a data-driven business, but still have certain limits about how much they're willing to share about themselves.
That is the balance any effort to regulate or legislate online privacy will try to strike.
"One thing that occurs to me is that there are just simply responsible practices and irresponsible practices in the advertising space," said Michael Hintze, Microsoft's associate general counsel. The firms that engage in these debates agree that compiling profiles about people that include health and financial information, for instance, should be off-limits. Likewise, most consumer advocates would concede that serving an ad for a car to a Web user who frequently visits automotive Web sites isn't on its face a violation of a person's privacy.
But between those two extremes stretches a vast gray area of different types of data and technologies and degrees of security and anonymization that would confound any efforts on the part of Congress or the FTC to set detailed rules concerning specific practices.
"It's hard to draw a bright line that says this category should be off limits," Hintze said.
Kenneth Corbin is an associate editor at InternetNews.com. Based in Washington, D.C., Kenneth's coverage areas range from government regulation to e-commerce and online media.