Do Not Track: FTC Proposes Sweeping New Framework For Consumer Privacy Protection

Much of the attention and online discussion around the US Federal Trade Commission’s (FTC’s)  just-released privacy report focuses on the concept of a “Do Not Track” mechanism, similar to the “Do Not Call” list now in place. The recommendation is that any such capability operate at the browser level and communicate to publishers and their cookies in real time whether the consumer wishes to be tracked or targeted.

Here’s a relevant excerpt about the idea from the commission’s report:

Commission staff supports a more uniform and comprehensive consumer choice mechanism for online behavioral advertising, sometimes referred to as “Do Not Track.” … The most practical method of providing uniform choice for online behavioral advertising would likely involve placing a setting similar to a persistent cookie on a consumer’s browser and conveying that setting to sites that the browser visits, to signal whether or not the consumer wants to be tracked or receive targeted advertisements.

Yet the report and its recommendations are much broader than online behavioral targeting or the idea of a Do Not Track capability. It proposes a sweeping new privacy framework that would encompass both online (including mobile) and offline marketing and data collection:

The framework applies to all commercial entities that collect or use consumer data that can be reasonably linked to a specific consumer, computer, or other device.

The early part of the report, which argues that consumers do care about privacy, is full of references to privacy snafus and scandals with all our favorite internet brands, including Google and Facebook:

Consumer survey data discussed during roundtable panels and in comments also evidences consumer interest in privacy. For instance, consumer surveys have shown that a majority of consumers are uncomfortable with being tracked online, although the surveys provide little or no information about the degree of such discomfort or the proportion of consumers who would be willing to forego the benefits of targeted advertising to avoid being tracked. In addition, the public outcry and backlash in response to the rollout of new services, such as Facebook Beacon and Google’s social networking service “Buzz,” further evidence consumer interest in the privacy of their information.

The immediate purpose of the report is to elicit further comment on principles and recommendations and to provide guidelines for potential Congressional legislation and rule-making. There are a number of principles that are at the core of the new framework: make consumer privacy central to data collection, simplify privacy and provide more disclosures to consumers about how their data will be used.

While many companies may publicly welcome better consumer privacy protection, the ideas in the report go against most of the targeting and data collection practices in use today. Most of them (with some notable exceptions) rely on consumer ignorance.

The new framework would place burdens on online ad networks, data vendors and others in the advertising value chain that most would find unwelcome. And more information disclosures and consumer control over data would probably mean more consumers opting out of much of online tracking and targeting.

Display ads would potentially suffer but search would probably not be substantially impacted. That’s because search is one of the few online ad vehicles that doesn’t rely heavily on audience or behavioral targeting — although some of that has crept into search recently.

All this is speculative right now and none of these recommendations have the force of law. Much could change as this framework is discussed by lawmakers and potentially codified. But if regulations consistent with the report were enacted it would mean a comprehensive overhaul of current privacy and data collection practices for marketers across the board.