Rockefeller Says Legislation Necessary to Ensure Online Privacy

Rockefeller, author of the Do-Not-Track Online Act, has been critical of websites’ collection of personal information about visitors, including in an interview Tuesday (CD April 24 p12). S-418 would require all online companies to minimize data collection about users’ browsing habits once it’s requested by the consumer, require online companies to destroy or anonymize individual browsing data once they are no longer needed and enable the FTC to pursue enforcement actions against any violators (CD March 1 p11).

Rockefeller noted that in February 2012, the White House unveiled its proposal for baseline consumer privacy protections on the Internet, called the Consumer Privacy Bill of Rights. At that time, groups representing the largest online ad companies committed to implement do-not-track technologies into most major Web browsers to enable greater user control over online tracking within nine months. “We are past that time,” said Rockefeller in the hearing. “It is now April 2013 and consumers are waiting for do-not-track standards.” Sen. Richard Blumenthal, D-Conn., said he too was “disappointed” that the development of voluntary standards has taken such a long time. “No one seems to know when the voluntary standards will be completed.”

Digital Advertising Alliance Managing Director Luigi Mastria wouldn’t provide a timeline but said DAA is “willing to abide by the White House agreement that was made in 2012.” DAA is “hopeful an agreement can be reached,” said Mastria, but “this does take a little bit of time. The reality is that we are working at it.” He added that the group’s efforts were “short-circuited” by browsers’ decisions to block third-party cookies and further delayed and complicated by the World Wide Web Consortium’s work to develop do-not-track policies. DAA represents the American Association of Advertising Agencies, Association of National Advertisers, American Advertising Federation, Direct Marketing Association, Interactive Advertising Bureau and Network Advertising Initiative.

Mastria touted the DAA’s opt-out tool via the AdChoices icon, which he said offers users persistent choice regarding their privacy expectations. “To be clear, the DAA program is the solution here, not the problem,” said Mastria. Industry self-regulation is the “appropriate approach,” he said. “Because it is flexible and can adapt to rapid changes in technology and consumer expectations, whereas legislation and government regulation, particularly in such a rapidly-developing area, can stifle innovation, reduce competition, and add unnecessary costs,” according to his prepared remarks. The DAA’s self-regulatory effort “obviates the need for new legislation,” he said. “We remain concerned that laws and regulations are inflexible and can quickly become outdated in the face of extraordinarily rapidly-evolving technologies. When this occurs, legislation thwarts innovation and hinders economic growth and can impede a competitive marketplace that offers a full range of choice to consumers.”

Industry development of do-not-track “has not moved forward quickly enough,” said Mozilla General Counsel Harvey Anderson in prepared remarks. “Consumers have shown increased concern about online tracking and privacy, more users are sending [do-not-track] signals, and yet the efficacy of the Ad Choice [sic] program remains questionable.” Anderson added that “many stakeholders view this as an indicator of the inadequacy of the industry- led, self -regulatory program.” He commended the work of some companies like Twitter, the Associated Press and Jumptap, which all have voluntarily implemented do-not-track options into their services.

Ranking Member John Thune, R-S.D., asked witnesses if there are specific and identifiable harms from behavioral ads. Mastria said “there hasn’t been any that has been demonstrated. There have been issues of creepiness. To be sure, there are people who want control of their privacy online, and that’s what we provide.” Anderson said “it is tough” to define any specific harms, but said behavioral ads could potentially “undermine” the Internet ecosystem by deterring people from browsing the Web.

"The harm is that the people don’t know what they are getting into,” Rockefeller said. “They don’t know because they can’t find it in some small print. … I want privacy, that is a pretty basic American instinct.” Rockefeller said he thought the reason ad groups are upset with browsers “is that they have made it even easier for the consumer. We are about [the] consumer here.” Mastria said DAA’s program “tracks very closely to the principles” of Rockefeller’s bill. “We offer a single one-button choice for those who don’t want to have their data collected or used,” he said. “I think we have delivered what you have laid out in your bill … we are open to modifications.”

Sen. Dean Heller, R-Nev., said he is opposed to a federal legislative solution to deter online tracking. “Any solution that blocks third-party advertising companies from placing cookies on the Internet will have economic consequences,” he said. “I think the last thing any member wants to do is propose a solution that chills investment and innovation.”

The elephant in the room is the fact that “a lot of this is about competing with Google,” which is a first-party holder of many consumers’ online information, said Sen. Claire McCaskill, D-Mo. “I want to make sure we are not shutting down something after all the big guys have gotten all the cows out of the barn, so that the little guys don’t have access to the richness of online commerce.”

Justin Brookman, director of the Center for Democracy and Technology’s project on consumer privacy, urged lawmakers to enact privacy legislation because industry self-regulation has “failed to grapple with the dramatic expansion of the scope of tracking online,” in opening remarks. “The tortured do-not-track saga is a stark demonstration of why consumers fundamentally need comprehensive privacy law,” his prepared testimony said. “Despite industry’s commitment from 14 months ago, today, only a handful of third party companies acknowledge and respond to do-not-track headers in any way,” he said. “Consumers deserve a strong but flexible horizontal privacy law governing all collection, use, and retention of personal information based on the fair information practice principles."

Adam Thierer, a senior research fellow at George Mason University, said it’s “unwise” for lawmakers to place too much faith in any single, silver-bullet solution to privacy, in opening remarks. Concepts like do-not-track “are easily evaded or defeated and often fail to live up to their billing,” he said. Thierer said “no matter how well-intentioned, restrictions on data collection could negatively impact the competitiveness of America’s digital economy, as well as consumer choice.” He suggested that lawmakers seek “alternative and less costly approaches to protecting privacy that rely on education, empowerment, and targeted enforcement of existing laws. Serious and lasting long-term privacy protection requires a layered, multifaceted approach incorporating many solutions.”