Inside Google

Consumers would get greater privacy control, but first, experts must agree

Washington — The White House wants a “Do Not Track” option put on websites to give consumers greater control of their personal information online but Internet companies and privacy groups are at odds on how tight the controls should be.

The stalemate could lead to a legislative crackdown on Internet privacy if left unresolved.

That has firms like Google and Facebook that rely heavily on collecting user data worried that any legislation could lead to cuts in online advertising that would eat into their profits.

The U.S. administration has looked to an Internet standards setting body, already eyeing a “Do Not Track” mechanism and with an aggressive timeline in place, to corral everyone into a room and onto teleconferences to reach a deal.

With over 10 months of talks under the group’s belt, they are still talking but are arguably no closer to an agreement than when they started. The sides are so far apart that they don’t even agree on what “Do Not Track” means.

To privacy advocates, it is halting data collection so a consumer can surf the Web without any prying eyes collecting information about their online activities for economic gain. To the industry, however, it means not targeting ads to a consumer based on their Web viewing history, but data collection would continue for other purposes.

The next step, if no consensus is reached by year’s end, will likely test regulatory and congressional threats of legislation to enforce Internet privacy.

This puts Internet companies in the midst of an existential dilemma as their business models rely on consumers parting with their personal information to bolster ad revenue.

“We want to reduce the profile, the data footprint of citizens who increasingly spend a lot of time online today,” said Jeffrey Chester, executive director of the Center for Digital Democracy, a nonprofit active in policing privacy.

Online advertisers and Web companies say such data is now the lifeblood of the Internet.

“If you get rid of that, you kill the Internet. It’s just that simple,” Linda Woolley, executive vice president of government affairs at the Direct Marketing Association, said of the dangers of ceasing data collection.

What some once viewed as a sideline — collecting and selling consumers’ data to advertisers — the Internet ecosystem took on as its main source of revenue, in return providing consumers with free Web content and services.

With more sophisticated data mining, more prevalent ad targeting and more cognizant Internet users, companies are starting to see fallout from this relatively novel way of doing business.

Any clamp down on data collection deals a blow to their bottom lines. Targeting has almost tripled what brands pay websites to run ads, and companies like Google and Facebook rely heavily on advertising for the bulk of their revenue.

U.S. online ad revenue was just shy of $15 billion in the first half of 2011, 23 percent higher than the previous year.

Yet abuses in which companies are not honest about how they exploit their users’ movements on the Internet threaten to drive users away, another hit to revenue.

“If you have a business model that relies on spying on your customers, as people begin to understand that, there will be tremendous push back,” said John Simpson, privacy project director for the nonprofit Consumer Watchdog.

How we got here
Some browsers, including Mozilla’s Firefox, Microsoft Corp’s Internet Explorer and Apple Inc’s Safari, allow consumers to indicate that they do not want to be tracked as they surf the Web. But under current regulations, websites and advertisers can ignore these requests.

The Obama administration has called for a universal “Do Not Track” system with industry buy-in.

The concept has floated around since consumer groups asked the U.S. Federal Trade Commission (FTC) in 2007 to create a “Do Not Track” list for online advertisers, which would work like the “Do Not Call” registry that caused telemarketing industry havoc.

The FTC first endorsed a “Do Not Track” tool that would convey directly to websites the user’s choice to opt out of tracking in a preliminary staff report released in December 2010.

In recent years Internet giants have gotten into trouble for various privacy abuses, including secretly tracking users’ locations and selling consumers’ data to advertisers without their knowledge. Both Google, the world’s No. 1 search engine, and Facebook, the No. 1 social networking site, reached settlements with the FTC last year because of privacy problems.

The faux pas got regulators’ attention. The White House and FTC unveiled privacy frameworks earlier this year to curtail abuses, but they relied heavily on voluntary commitments by industry players to responsibly and transparently handle information about the online activities of consumers.

The frameworks came with a caveat: “We are confident that consumers will have an easy to use and effective Do Not Track option by the end of the year because companies are moving forward expeditiously to make it happen and because lawmakers will want to enact legislation if they don’t,” FTC Chairman Jon Leibowitz said in March.

The administration is now looking to the World Wide Web Consortium (W3C), an international standards organization for the Web, to produce a “Do Not Track” tool by year’s end.

The group began talks with Internet firms, online advertisers and privacy advocates last September to define how a “Do Not Track” mechanism would work.

The added pressure from regulators in March has not triggered agreement. Instead, two very different visions have emerged — do not collect versus do not target ads.

The W3C wrapped up what was supposed to be its fifth and last face-to-face meeting of its Tracking Protection Working Group on June 22. With no consensus reached, the W3C has extended the group’s charter. Weekly conference calls resumed in July with another face-to-face meeting likely in the fall.

Two different visions
Industry heavyweights say the Obama administration’s push for a clear tool to opt out of tracking should only give consumers control over the type of advertising they receive.

Restricting data collection further could cause the Internet to go dark and undermine the economic health of companies, industry leaders argued at the June W3C meeting.

Advertisers point to a self-regulatory program already followed by 90 percent of the ad industry that places an “icon” on ads consumers see due to behavioral advertising.

Clicking the icon directs consumers to a website that explains why they received the ad and gives them the option to opt-out of receiving the company and ad network’s advertising. It does not stop data collection, only its use for targeted ads.

A coalition of online advertisers in February said its members would honor these “Do Not Track” requests. Twitter in May said it would support a standardized initiative to honor requests from users who do not want to be tracked.

Yet still there is no consensus on what “Do Not Track” means.

The leading “Do Not Track” proposal from the Internet industry — prepared by representatives from Google, Yahoo! Inc and consultants — would bar companies from using consumers’ personal information to target advertising to them across multiple websites if they opted out of tracking. It would, however, allow them to keep collecting data.

Privacy advocates said the industry proposal is little different from what companies are subject to now — a problem, they say, given continued reports of misuse of consumers’ data.

Consumer advocacy groups and others noted charges that Google used special computer code, or “cookies,” to trick Apple’s Safari browser so Google could monitor users who had blocked such tracking and other reported privacy violations to help make their case for stronger protections.

Last month they harped on findings that data collection allows the travel site Orbitz to identify if a user is on a Mac or PC. The online travel booking company last year began using that data to recommend pricier hotel rooms to Mac users as studies show Mac users on average are more affluent and willing to pay for more expensive hotel stays.

Simpson said industry’s proposal would do nothing to prevent a user that does not want to be tracked from having their personal information used to tailor what pricing on a website is more dominantly displayed to them.

A proposal from privacy advocates, written by the Electronic Frontier Foundation, Mozilla and Stanford University student Jonathan Mayer would bar third parties — companies with ads displayed on a page or ad networks that track users across unrelated websites — from collecting information about a user if they opt not to be tracked with limited exceptions like security and fraud prevention.

Advocates said their proposal would still allow companies that users have a direct relationship with, such as when logged into Amazon.com or YouTube, to collect personal information in order to give recommendations and otherwise tailor a user’s experience.

“If we can’t get a reasonable agreement very soon, consumer groups are going to go to the FTC and the European Union and Congress and say Do Not Track is dead on arrival and we need legislation and regulation,” Chester said.

A stalemate risks legislation
European Union proposals that would give Internet users the right to bar any collection of personal data are also putting pressure on U.S. officials to beef up privacy safeguards.

Leibowitz has been adamant that “Do Not Track” should mean do not collect data, with some narrow exceptions like fraud prevention.

“How exactly to get to that goal is still under discussion, but my sense is if there’s not a resolution from the discussions, then Congress may take a look at the issue,” said Ed Felten, the FTC’s chief technology officer.

The specter of legislation this year is generally viewed as a hollow threat given the tense, gridlocked legislative landscape. But Washington insiders say pressure from the European Union and an escape from election-year politicking will greatly increase the prospects for a bill to move next year.

Representatives Edward Markey and Joe Barton, co-chairmen of the Congressional Privacy Caucus, wrote to the W3C last month championing a “Do Not Track” definition that bars accumulating, using and sharing personal data.

“Joe Barton is one of the most conservative Republicans in the House of Representatives, and Ed Markey is one of the most liberal,” said Consumer Watchdog’s Simpson. “The fact that those two guys can come together on this leads me to believe that privacy is likely to be one of the issues where there will be bipartisan agreement about the need to do something.”