NEW YORK (AdAge.com) -- The stakes for online privacy just got a little higher.
The Federal Trade Commission revealed its proposal for a universal "do not track" mechanism on Wednesday that would allow people to choose whether they want internet companies to collect information on their browsing habits. On Thursday, a House subcommittee is holding a separate hearing on the matter. Online publishers and advertisers have come to rely on such data, and any significant alteration of current practices would have deep implications for the internet industry.
The FTC's report stated that despite numerous attempts at self-regulation, the industry has not done enough to protect consumers' privacy online, and that they need to work faster and improve their efforts.
"We're sending a clear message that self-regulation of privacy has not worked accurately," FTC Chairman Jon Leibowitz said in a call with reporters Wednesday. "The industry as a whole needs to do a far better job."
A coalition of advertising industry trade groups calling itself the Digital Advertising Alliance initiated a self-regulatory effort a few weeks ago that would allow consumers to choose to prohibit marketers from targeting them with advertising. The DAA, which is comprised of the 4As, the American Advertising Federation (AAF), the Association of National Advertisers (ANA), the Direct Marketing Association (DMA), and the Interactive Advertising Bureau (IAB), represent more than 5,000 corporations.
This initiative had been met with some praise from officials at the FTC when first launched, but it has not progressed quickly enough, according to Chairman Leibowitz.
"I think the people who are doing that are very well-intentioned," he said, "but it has been in pre-beta development for quite some time -- I think for more than two years. We'd like to see them move faster." Chairman Leibowitz did indicate, however, that the industry group appears to be taking proper steps and that its efforts could lead to a "more comprehensive" system.
Stuart P. Ingis, partner at Washington law firm Venable and counsel for the DAA, said that the online ad industry has delivered the kind of choice the Commission has asked for, and that the business community is in the best position to execute these plans. "We've built a very good framework," he said of their consumer opt-out program, which launched a few weeks ago. A significant component of the industry's program includes an icon that will appear on ads, which will lead consumers to an opt-out page. "In the next months, this will be ubiquitous," Mr. Ingis said.
Stopping collection, not just targeting
The Commission had expressed concern that the industry program does not allow people to keep online marketers from collecting data on their surfing habits, but only prevents marketers from serving, or targeting users with more relevant advertising. "We support the opt-out of collection not just targeting," Chairman Leibowitz clarified.
But according to Mr. Ingis, the industry program does stop marketers from collecting data once they choose to opt out, underscoring a larger question over what purposes the Commission defines beyond the scope of advertising. "We've had dialogue with them on this issue before, and we've met that goal," he said, "but if they want to extend the opt outs to include collecting data for purposes other than marketing, I don't know how that will work." He pointed out that third parties collect data for purposes other than advertising, such as email log-in authentication, as well as traffic data such as Google Analytics, which is widely employed across the web.
"That's why 'Do Not Track' is such a misnomer," he said.
The Commission's guidelines are preliminary, and it underscores the FTC's limited authority. A Do Not Track law could only be enacted by Congress, suggesting that this report is an appeal to whichever party -- industry or Congress -- will act more quickly. A subcommittee is holding a hearing called "Do-Not-Track Legislation: Is Now the Right Time?" on Thursday.
How it would work
A sticking point is how exactly a Do Not Track feature would work. The Commission's report spells out a specific example whereby a web browser, such as Firefox, would install a piece of software such as a cookie onto the user's browser that would signal to online marketers whether that consumer has chosen to make available his or her browsing habits in return for targeted advertising. But such a mechanism would only be specific to that browser and not to the specific person, as the Do Not Call legislation offers.
A browser-enabled Do Not Track feature would also have to differentiate between data collected for marketing purposes, or other reasons, whether for traffic data or log-in authentication, such as online banking.
But privacy advocates have largely approved of the Commission's report, and argue that a Do Not Track program is technically feasible. "The browser-based mechanism is simple and very generalize-able," said Peter Eckersley, senior staff technologist at the Electronic Frontier Foundation. "It could apply to mobile platforms without changing much. There is some flexibility on this proposal."
Chairman Leibowitz also said that despite the specific Do Not Track example outlined in the report, "it's not the only way, and that's why we're seeking comment. We're big believers in transparency and process, and if someone has a better idea, we want to hear it."