A 41-member advisory committee named by the Federal Trade Commission meets for the first time Feb. 4 to deal with the question of what sort of information gathered at Web sites should be viewable by consumers and under what conditions.
The issue entered the courts Jan. 28 when a California woman sued DoubleClick, accusing the major online ad network of illegally collecting and selling private information. The case comes as DoubleClick moves forward on plans to mesh offline and online databases, giving advertisers access to a wealth of information about consumers.
CONSUMERS PUSH FULL ACCESS
Consumer groups say consumers should be able to easily view and change all information collected about them.
"Fair information practices require full access," said Jason Catlett, president of Junkbusters, a company that promotes privacy.
"It is not up to the company to decide what information consumers should see," added Andrew Shen, a policy analyst for the Electronic Privacy Information Center.
Marketers, however, say there has to be some reasonableness in regard to providing the information.
"What is appropriate for non-sensitive information are different levels of access. People have a right to look at their information whenever it will be used for credit or employment, but I'm not sure Americans are terribly interested in seeing marketing information that may determine only whether they see an ad or a catalog," said Christine Varney, a former FTC commissioner who chairs the Online Privacy Alliance. The alliance includes more than 80 Internet and non-Internet companies.
One e-commerce site last week was suggesting a middle ground. Dash urged 14 other e-commerce sites to let consumers view their information, but a site official said the viewing could depend on the extent to which information is collected.
"If we collect information that is wrong, then it is in our interest to get correct information into our database," said Rob Goldman, exec VP-customer service at Dash. "I would hate to see consumers hesitant to get software or information from the Web."
The formation of the committee, which will also examine security issues, comes as pressure builds on the FTC to look more closely at the definition of adequate notice.
DoubleClick in November bought Abacus Direct, which had a database of consumers' offline purchasing habits. DoubleClick now has begun to collect personally identifiable information, such as names and addresses, through an alliance of undisclosed, data-sharing sites, allowing it to merge online and offline data. Several consumer groups last week complained DoubleClick is not adequately informing consumers.
"For years DoubleClick has said their cookies don't identify personally. To now change that, they need an affirmative consent from consumers," said Mr. Catlett.
Mr. Shen said the problem is that "no one has an idea of how much information DoubleClick has collected," also charging the company's disclosure isn't adequate.
But DoubleClick said it is giving sufficient notice and collecting users' personally identifiable information only with users' consent. Users must volunteer their names and addresses before completing any online transaction on all DoubleClick Alliance sites, said Jonathan Shapiro, senior VP.
"Any site that we work with that provides us with personally identifiable information that we can associate with a browser must provide the user with the notice and choice. Otherwise, we will not accept the information and put it in our database," Mr. Shapiro said.
Mr. Shapiro said DoubleClick collects no health information, detailed financial information, information on consumer visits to sex sites or data relating to children's activities.
THE BIGGER CONCERN
More threatening to Web sites and advertisers could be pressure from privacy advocates to have the process of identifying users' browsers with cookies become an opt-in, rather than an opt-out, arrangement, said Chris Hansen, senior equity analyst at Bank of America Securities. "Then they can't get any data," he said.
Just last week, a California woman filed suit against DoubleClick accusing it of unlawfully collecting and selling private information. The suit is asking the California Superior Court, Marin County, to bar DoubleClick from using technology to collect personal information without prior written consent of the user.
The woman's lawyer argues that the notice given is not adequate for consumers. "I reject their position that [consumer consent] is open, obvious and knowing," said Ira Rothken, the attorney representing the plaintiff.
DoubleClick declined to comment on the lawsuit.