Notes from Digital Hollywood: Industry Solutions to Privacy Issues in Online Behavioral Advertising May Not Satisfy FTC Chiefs
Santa Monica, California: A dominant theme at this week's Digital Hollywood conference is the tension between the need to for truly targeted advertising to online audiences and an individual's right to privacy. The Internet creates the ability for businesses to gather a marketer's dream world of data about their customers. This can include identification data (name, address, phone number, email address), demographic data (age, gender, marital status, sexual orientation), financial data (bank and credit card account data), and behavioral data (browsing history, downloading history) and much, much more. If this type of data falls into the wrong hands, it can subject the customer or identify fraud. But even many purely commercial uses can cause embarrassment or harm to the consumer.
In a recent speech, David Vladeck, Director of the FTC Bureau of Consumer Protection gave the example of an adolescent who didn't want to state publicly that he was gay. A generation ago, if he had wanted to find information about persons in his situation, he could have gone to his local library, and emerged with no record of his search. "That effort would be anonymous, and would leave no paper trail. There was no privacy debate to be had," Vladeck said. Today, he would probably look for information on the Internet on his home computer. But, if he did so, Vladeck pointed out "he may be surprised -- indeed, even mortified -- to receive advertising based on his searches and to learn that third parties have access to information about his searches.
I'll take this one step further. If he was a member of a social networking site, and purchased a book on "coming out" from an online retailer, he might be shocked to find that the social networking site had broadcast his purchase to all his online "friends" -- this outing him.
At today's Digital Hollywood sessions, there were many opinions about how to design a privacy policy to deal with concerns like these. Here are some of the commonly-proposed ideas:
• Only use opt-in targeted advertising: This suggestion, which is on the most privacy protective end of the scale, would prevent the embarrassment that the young man in our hypothetical would have faced -- assuming that the advertiser didn't sell the data to some other firm with different policies.
• Disclose the data that is being gathered: Given the dislike of many consumers for reviewing small print, this suggest would be less privacy protective. But might have prevented the problem raised in our hypothetical.
• Provide consumers with access to the data that has been collected about this -- and permit them decide if they wish to permit this data to be used.
• "Anonymization": This was the most frequent suggestion in today's sessions. Anonymization means that the marketer avoids collecting information about individual users, but simply collects information about the use of a particular computer. The information gathered in this way would be less refined in cases where multiple persons used a single computer. For example, in my household, my 4 year old daughter, 5 year old son, wife and myself all share the same home computer.
Many of these ideas are in line with current FTC policy on privacy. However, in recent speeches, David Vladeck indicates that the FTC is moving to an even more privacy-protective stance. In an October 2, 2009 speech, Vladeck claimed that the FTC did not want to end behavioral Internet marketing, because such marketing helped pay for much valuable free Internet content. However, he indicated that the FTC believed that the following changes were needed in current privacy policy:
• Website privacy policies should not be in "fine print" but should be conspicuous and easily understood by consumers. For example, "if a consumer gets a targeted ad based on his or her search history . . . a company could provide an effective disclosure if it provides a link in close proximity to the ad, with the title "Why did I get this ad?" The text in the link could explain how data is collected for purposes of delivering targeted advertising. Indeed, such a disclosure is likely to be far more effective that a discussion -- even a clear one -- that is buried within a companies privacy policy."
• Privacy is a value in itself. Consumers may not want their personal information collected used or shared without their permission -- regardless of whether disclosure can cause them financial harm. Vladek stated that the "FTC "will keep this lesson in mind as we move forward on our project to explore new privacy frameworks."
• The definition of "personally identifiable" information needs expansion. Vladeck stated that it is now "easier to identify an individual based on information traditionally considered to be nonpersonally identifiable. For instance, although industry has traditionally considered most IP addresses to be non-personally identifiable, it soon may be possible to link more IP addresses to specific individuals. In addition, even if certain items of information are anonymous by themselves, they can become identifiable when combined with other information. Professor LaTanya Sweeney from Carnegie Mellon University has estimated that 87% of the U.S. population can be uniquely identified if only a date of birth, gender and five-digit zip code are known."
Vladeck's statements call into question "anonymization" as a complete solution to privacy concerns. My take-away is that the FTC may start moving toward an all opt-in model for gathering or using information about consumers. Some participants at Digital Hollywood indicated that they supported such a policy. On the other hand, an all opt-in model would impose greater privacy burdens on Internet advertisers than real-world advertisers. It also does not seem to be mandated by current U.S. law. My guess is that we will not see an all opt-in model mandated by the FTC any time soon.
David D. Johnson is a business lawyer whose practice focuses on litigation and other issues relating to digital media and consumer electronics companies. David can be contacted at (310) 785-5371 or DJohnson@jmbm.com.
