[Senate Hearing 106-1117]
[From the U.S. Government Publishing Office]
S. Hrg. 106-1117
ONLINE PROFILING AND PRIVACY
=======================================================================
HEARING
before the
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
__________
JUNE 13, 2000
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
82-146 U.S. GOVERNMENT PRINTING OFFICE
WASHINGTON : 2003
____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
JOHN McCAIN, Arizona, Chairman
TED STEVENS, Alaska ERNEST F. HOLLINGS, South Carolina
CONRAD BURNS, Montana DANIEL K. INOUYE, Hawaii
SLADE GORTON, Washington JOHN D. ROCKEFELLER IV, West
TRENT LOTT, Mississippi Virginia
KAY BAILEY HUTCHISON, Texas JOHN F. KERRY, Massachusetts
OLYMPIA J. SNOWE, Maine JOHN B. BREAUX, Louisiana
JOHN ASHCROFT, Missouri RICHARD H. BRYAN, Nevada
BILL FRIST, Tennessee BYRON L. DORGAN, North Dakota
SPENCER ABRAHAM, Michigan RON WYDEN, Oregon
SAM BROWNBACK, Kansas MAX CLELAND, Georgia
Mark Buse, Republican Staff Director
Martha P. Allbright, Republican General Counsel
Kevin D. Kayes, Democratic Staff Director
Moses Boyd, Democratic Chief Counsel
C O N T E N T S
----------
Page
Hearing held on June 13, 2000.................................... 1
Statement of Senator Bryan....................................... 5
Statement of Senator Burns....................................... 2
Statement of Senator Cleland..................................... 40
Prepared statement........................................... 43
Statement of Senator Hollings.................................... 3
Prepared statement........................................... 4
Statement of Senator Kerry....................................... 44
Statement of Senator McCain...................................... 1
Prepared statement........................................... 2
Statement of Senator Wyden....................................... 5
Witnesses
Bernstein, Jodie, Director, Bureau of Consumer Protection,
Federal Trade Commission, (Accompanied by David Medine,
Associate Director for Financial Practices, Bureau of Consumer
Protection, Federal Trade Commission and Dawne Holz, Federal
Trade Commission).............................................. 6
Prepared statement of Jodie Bernstein........................ 9
Polonetsky, Jules, Chief Privacy Officer, Doubleclick............ 47
Prepared statement........................................... 49
Jaye, Daniel, Chief Technology Officer, Engage Technologies...... 50
Prepared statement........................................... 52
Rotenberg, Marc, Director, Electronic Privacy Information Center. 55
Prepared statement........................................... 57
Smith, Richard, Internet Consultant.............................. 71
Prepared statement........................................... 73
Appendix
Markowitz, Steve, Chairman and CEO, MyPoints.com, Inc., prepared
statement...................................................... 97
Smith, Richard, Internet Consultant, additional testimony........ 98
ONLINE PROFILING AND PRIVACY
----------
TUESDAY, JUNE 13, 2000
U.S. Senate,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Committee met, pursuant to notice, at 10:03 a.m. in
room SR-253, Russell Senate Office Building, Hon. John McCain,
Chairman of the Committee, presiding.
OPENING STATEMENT OF HON. JOHN McCAIN,
U.S. SENATOR FROM ARIZONA
The Chairman. Good morning. This morning the Committee will
hear testimony on online profiling done by Internet network
advertisers and how it impacts consumers' privacy. I welcome
and thank all the witnesses we will hear from today. Your
testimony will help the Committee gain a better understanding
of the issues involved and the appropriate action the Committee
should take.
As has been said so often, the Internet continues to
transform our lives and our economy. Each day more and more
Americans access the web to shop, read the news, find a job, or
for a variety of other reasons. The Internet continues to offer
great opportunities to consumers, but it also raises concerns
about individual privacy.
Online profiling, and specifically profiling done by
network advertisers, raises serious privacy concerns among many
consumers. Through the use of cookies and other technologies,
network advertisers have the ability to collect and store a
great deal of information about individual consumers. They can
track the websites we visit, the pages we view on websites, the
time and duration of our visits, terms entered into search
engines, purchases, responses to advertisements, and the page
we visited before coming to a site.
All of this information can be collected without clicking
on an advertisement. In fact, often this information is
collected without the consumer's knowledge or consent. The FTC
noted in its May report on online privacy that just 22 percent
of websites that allow the placement of third party cookies
provide notice to customers. Recently, USA Today noted in a May
1st article that, even when consumers are aware of this
practice, it can be extremely difficult to opt out of the
collection of this data.
While online profiling raises serious privacy concerns,
some consumers desire this service and benefit by receiving
targeted advertisements that appeal to them. What we need to
find is the delicate balance between benefiting consumers and
invading their privacy, and I am hopeful that today's witnesses
will help us eventually find that balance. I look forward to
the testimony presented today.
Senator Burns, thank you for being here.
[The prepared statement of Senator McCain follows:]
Prepared Statement of Hon. John McCain,
U.S. Senator from Arizona
This morning, the Committee will hear testimony on online profiling
done by Internet network advertisers and how it impacts consumers'
privacy. I welcome and thank all of the witnesses we will hear from
today. Your testimony will help the Committee gain a better
understanding of the issues involved and the appropriate action the
Committee should take.
As has been said so often, the Internet continues to transform our
lives and our economy. Each day more and more Americans access the web
to shop, read the news, find a job or for a variety of other reasons.
The Internet continues to offer great opportunities to consumers, but
it also raises concerns about individual privacy.
Online profiling and specifically profiling done by network
advertisers raises serious privacy concerns among many consumers.
Through the use of cookies and other technologies, network advertisers
have the ability to collect and store a great deal of information about
individual consumers. They can track the websites we visit; the pages
we view in websites; the time and duration of our visits; terms entered
into search engines; purchases; responses to advertisements and the
page we visited before coming to a site. All of this information can be
collected without clicking on an advertisement.
In fact, often this information is collected without the consumer's
knowledge or consent. The FTC noted in its May report on online privacy
that just 22% of websites that allow the placement of third party
cookies provide notice to consumers. Recently, USA Today noted in a May
1st article that, even when consumers are aware of this practice, it
can be extremely difficult to opt out of the collection of this data.
While online profiling raises serious privacy concerns, some
consumers desire this service and benefit by receiving targeted
advertisements that appeal to them. What we must find is the delicate
balance between benefiting consumers and invading their privacy. I am
hopeful that today's witnesses will help us eventually find that
balance.
I look forward to your testimony and to working with all of you to
address this vital issue.
STATEMENT OF HON. CONRAD BURNS,
U.S. SENATOR FROM MONTANA
Senator Burns. Thank you, Mr. Chairman, and I thank you for
holding this hearing. It's very timely, too, because it does
concern something of vital importance to today's digital era,
so to speak, the protection of online privacy.
While the Internet is growing at an amazing rate and it
offers educational and commercial opportunities to millions of
Americans, new information technologies have allowed the
collection of personal information on an unprecedented scale.
Many times this information is collected without the knowledge
of consumers. Online profiling poses particular concerns,
especially when these profiles are merged with offline
information to create massive individualized databases on
consumers.
Given the continuing erosion of Americans' privacy, I am
more convinced than ever that legislation is necessary to
protect and empower consumers in the online world. Privacy is
not a partisan issue, but a deeply held American principle.
I would like to thank Senator Wyden for his hard work on
this and many other related issues, including spamming and
encryption, when we start dealing with the Internet. Over year
ago, Senator Wyden and I introduced the Online Privacy
Protection Act, which was based on our shared view that, while
self-regulation should be encouraged, we also need to provide
strong enforcement mechanisms to punish bad actors. In short,
the approach should be trust but verify.
I have grown increasingly frustrated with the industry's
continuing stance that no legislation is necessary, even in the
face of overwhelming public concern. Just last week, during his
address to the Internet Caucus, Bill Gates claimed that the
Burns-Wyden bill goes too far and that the time is still not
right for privacy legislation. Unfortunately, his view is
nearly unanimous among the technology industry.
Senator Wyden has been engaging in the discussions with
industry for well over a year and we continue to hear nothing
more than how self-regulation is working. The need for privacy
legislation has increased over the last year, not decreased. I
want to reiterate my commitment to moving strong privacy
legislation to protect consumers whether industry agrees or
not.
I commend the Federal Trade Commission for recognizing the
industry has failed to produce progress and finally calling for
legislation itself. The Commission's recent report to Congress
revealed the extent of the stunning lack of consumer privacy on
the Internet. Even among the 100 most popular websites, only 42
percent have implemented fair information practices to ensure
consumer privacy. Among a broader random sample of all
commercial websites, the number drops dramatically to 20
percent compliance.
Several industry representatives have argued that the
increase in privacy policies being posted by websites reveals
that no privacy legislation is necessary. While the majority of
commercial websites now post privacy policies, the difference
between posting a privacy policy and actually providing real
privacy to users can be huge. While I applaud the increase in
posting of those privacy policies, many of them are overly
complex and they are technical. I never cease to be amazed when
you click one and then 20 pages of legalese comes up. I have
never been hinged with the title ``lawyer,'' so I don't even
try to work my way through the thing. I find it interesting
that the Commission itself had to use teams of lawyers to
decipher the privacy policies of many websites in the
preparation of its report.
So, Mr. Chairman, I want to thank you for holding this
hearing. Also, I remain open to working with Senator Wyden and
the rest of my colleagues on this Committee. I am more
committed than ever that we should move a privacy bill forward.
And I thank the Chairman.
The Chairman. Senator Hollings.
STATEMENT OF HON. ERNEST F. HOLLINGS,
U.S. SENATOR FROM SOUTH CAROLINA
Senator Hollings. I thank you, Mr. Chairman. I will file my
statement for the record. Thank you.
[The prepared statement of Senator Hollings follows:]
Prepared Statement of Hon. Ernest F. Hollings,
U.S. Senator from South Carolina
I want to thank Chairman McCain for holding this hearing, the third
this Committee has conducted in this Congress on the important issue of
Internet privacy. Today we examine the troubling privacy implications
raised by the practice of ``online profiling.'' While many commercial
entities collect data about individuals on the Internet, the practice
of profiling, particularly as it is conducted by network advertisers,
threatens individual privacy in a manner that raises serious concerns,
and warrants special consideration by this Committee.
On the Internet, individuals knowingly initiate relationships with
Internet service providers or commercial websites. For example, they
join AOL or subscribe to The New York Times online, or visit the search
portal Yahoo. Third party network advertisers, however, collect and use
individuals' personal information but almost never possess a direct
relationship with those individuals. Instead, these advertisers reach
through the site and collect information about individuals--most likely
without notice or consent--by placing ``cookies'' on users' computers
that then track their every move on the Internet. The advertisers then
examine the contents of these ``cookies'' so as to collect and analyze
the results of this surreptitious monitoring.
For the most part, Internet users are completely unaware that this
surveillance is occurring. And yet this surveillance allows the
advertisers to collect and compile incredibly detailed profiles of
individual's tastes, preferences, and research habits as observed
throughout the Internet. To make matters worse, these same companies
may use the actual information they have collected to develop so called
``psycographic'' profiles that reflect the companies' inferences and
conclusions about the individual's interests, habits, associations, and
traits. Such a profile by its very nature includes predictive
information about an individual that the individual has not, in fact,
personally provided, and which may not be an accurate characterization
of that individual at all. And all this is going on without any real
informed notice or consent on the part of the individual who is being
monitored.
If I purchased a pair of shoes, and a computer chip in the sole
monitored every place I walked, and then others collected used that
information to target me with ``personalized'' advertisements, I would
be outraged. If a phone company tape recorded my conversations and then
used my statements to market products to me I would be irate. And yet
such obviously unacceptable practices in the traditional marketplace
are appropriate analogies to the activities practiced by network
advertisers on the Internet. The fact that individuals often use the
Internet in the quiet seclusion of their homes only exacerbates the
sense of trespass occasioned by these activities.
Of course, not all sharing of information is bad. Some people
probably desire targeted, personalized advertisements. The magic of the
Internet makes that possible to a degree we never before experienced.
However, the use of individuals' personal information to purportedly
improve their Internet experience is only appropriate if the individual
has been informed, and has made a conscious decision to consent to that
practice. As we will learn today, that is not currently the case in the
marketplace.
Moreover, there are no sensible limits in place to ensure that
individuals' personal information is, in fact, only used for relatively
benign purposes, such as commercial advertisements. As The New York
Times reported on February 2, 2000, 19 out of the top 21 health sites
on the Internet had privacy policies but had unwittingly shared users'
personal information with third parties through ``cookies'' that had
been placed on the sites by network advertisers. Simply put, we need
federal legislation to ensure that these violations do not occur.
Some network advertisers do not collect personal information and
instead target their marketing only to computers or Internet protocol
addresses about which they have developed an anonymous profile.
Although this practice demonstrates that these entities can function
without collecting personal information, we must examine this activity,
as well, to determine any possible risk it poses to individuals on the
Internet.
Again, I thank the Chairman for calling this hearing and look
forward to the testimony of the witnesses.
The Chairman. Thank you, sir.
Senator Wyden.
STATEMENT OF HON. RON WYDEN,
U.S. SENATOR FROM OREGON
Senator Wyden. Mr. Chairman, I will be very brief. First
let me say that I share Senator Burns' view that it is time to
move on with a bipartisan bill to address these privacy issues.
He and I have worked for more than a year with a variety of
groups, business and others, toward that effort.
I happen to think Senator Hollings and Senator Rockefeller
have made an excellent contribution, have constructive ideas.
Senator Kerry has ideas on this matter. The clock is ticking
down on this session, and I think we ought to go forward with a
bipartisan privacy bill.
Now, today's session it seems to me is particularly
important. Most of what we have looked at is personal data that
a consumer provides to websites he or she visits--such as name,
address, and personal information supplied in order to purchase
a product or register for a service online. The practice that
we are looking at today is different in that it frequently
involves the collection and compilation of information by third
parties, companies whose websites the consumer has never
visited, but who are nonetheless constructing profiles of the
consumer's Internet habits.
I am of the view that online profiling does raise difficult
and troublesome issues. The mere fact that consumers often are
not aware of the profiling is troubling enough, but even more
serious is the prospect that a company might try to merge
online profile data with personally identifiable data,
producing detailed sets of information about specific
individuals. We have already seen that represented in the
debate about DoubleClick.
Finally, Mr. Chairman, it seems to me that there is a role
for self-regulation. All of the bills try to give a wide berth
for self-regulation, and I believe that programs like TRUSTe
have made a difference. But I continue to believe that, absent
legislation, meaningful enforcement, and air-tight coverage, we
will continue to vitiate a lot of the constructive work that is
being done by the privacy sector. That is why I think we ought
to go forward with bipartisan legislation.
Mr. Chairman, I look forward particularly to working with
you and Senator Hollings as the leadership of this Committee to
get it done, and I yield back.
The Chairman. Senator Bryan.
STATEMENT OF HON. RICHARD H. BRYAN,
U.S. SENATOR FROM NEVADA
Senator Bryan. Mr. President, let me commend you for
holding this important hearing. Undeniably, the Internet and e-
commerce provide enormous opportunities for Americans. I think
on balance it has been an extraordinary and remarkable
development. But there is also a dark side to it and that is
the loss of privacy.
I think most Americans, if they were thinking about this in
the context of their local shopping center or their local mall,
that somebody was following them around taking notes as to
which store they went into, how long they were there, which
items they looked at, and then at the end of that shopping
session all of this was compiled and this information was sold
to a third-party marketer. People would be absolutely offended
and outraged.
In a real sense, that is what is happening today in the
world of cyberspace. Now, I know, Mr. Chairman, some of our
colleagues take the position that this industry is so
sacrosanct that it is sacrilegious to even suggest that there
be some type of regulatory review. It seems to me, as my
colleague Senator Wyden pointed out, there is opportunity for
some self-regulation involved. But, in my sense, the time is
now for us to appropriately take a look at what kind of basic
protections we can provide for American consumers. I think the
hearing that you have convened is extraordinarily important,
and I am delighted to be here and hope to work in a bipartisan
fashion with our colleagues to develop an appropriate response.
The Chairman. I thank you, Senator Bryan.
Before we turn to our witness, Senator Wyden, I believe
that our first witness will comment that there are some
negotiations going on now between her organization, the
Department of Commerce, and some of the online advertisers as
to some agreement that may be made on self-regulation. I hope
our witness will illuminate us on that aspect of this issue.
Welcome, Ms. Bernstein. You are our first witness. For the
record, Ms. Jodie Bernstein is the Director of the Bureau of
Consumer Protection of the Federal Trade Commission. Welcome.
STATEMENT OF JODIE BERNSTEIN, DIRECTOR, BUREAU OF CONSUMER
PROTECTION, FEDERAL TRADE COMMISSION, (ACCOMPANIED BY DAVID
MEDINE, ASSOCIATE DIRECTOR FOR FINANCIAL PRACTICES, BUREAU OF
CONSUMER
PROTECTION, FEDERAL TRADE COMMISSION, AND DAWNE HOLZ, FEDERAL
TRADE COMMISSION)
Ms. Bernstein. Thank you, Mr. Chairman and members of the
Committee. With me this morning is David Medine, who works
closely with me on Internet privacy issues particularly, and
Dawne Holz, who is our guru of information technology, who is
at her desk over there.
We very much appreciate the opportunity to discuss the
Commission's report on online profiling. The report describes
the nature of profiling, consumer privacy concerns about these
practices, and the Commission's efforts so far to address the
concerns. As the Commission has in other areas, the Commission,
along with the Department of Commerce, as you indicated, Mr.
Chairman, we have encouraged effective industry self-
regulation, and the network advertising industry has
cooperatively responded with working drafts of principles for
our consideration.
All parties agree that there are real challenges to
creating an effective self-regulatory program, including how
network advertisers disclose practices to consumers and how
consumers should exercise choice. As a result, there has been a
serious effort by this industry group to craft a program. After
the Commission has had an opportunity to consider the final
proposal, it will make a recommendation to Congress.
With the remarkable growth of e-commerce has come increased
consumer awareness as well as increased consumer concern about
the online collection and use of personal data. One of the
areas that has generated most public concern and about which,
as several of you have mentioned, there is relatively little
public knowledge or understanding is online profiling by
network advertising companies.
In my testimony, I thought the most useful thing to do
would be to try to illustrate how profiling works. So, if I
may, I would like to show you an example of profiling. First,
we will see what the consumer sees as he surfs the web. Then I
would like to take you behind the scenes and explain what the
consumer does not see.
Our online consumer, Joe Smith, logs onto the Internet and
goes first to Webdragonsports. That is a site we made up that
sells sporting goods. He is looking for a new golf bag and so
he clicks on the link for golf and then he browses for golf
bags. Then Joe says, I am going to go to TraveltheUS. He and
his wife are considering taking a vacation, so he decides to go
to search for information--about where? Let us go to Arizona,
he says.
A week later Joe visits his favorite online news site,
which is also SenateCommerceNews. He immediately notices an ad
for a golf vacation package in Arizona. Well, he is delighted.
He clicks on the ad.
Only later, Joe begins to wonder, how did that ad come to
appear on my computer? Now let us look at what is going on
behind the scenes and what Joe does not see. Joe's first stop
was the wagon--I keep saying ``wagon''--Webdragonsports site.
Hidden in the computer code was an invisible link to USAads.
Now, USAads is what we talked about before. It is a network
advertising company--we also made it up--that delivers ads in
the banner space on the Webdragonsite.
Joe's computer automatically sent a message to USAads
asking for an ad. It also sent information about Joe's
computer, as well as the fact that he was at Webdragonsports.
USAads immediately placed a file, known to all of us as a
cookie, with a unique ID number on Joe's hard drive, unknown to
Joe.
Meanwhile, back at USAads a profile associated with that
cookie was also created showing Joe's interest in sports. Now,
it does not take a lot of studies to know--and they do know
this--that an interest in sports is often related to an
interest in sports cars. Therefore, USAads quickly sends Joe an
add for Motorworks sports cars. When Joe clicked on the golf
page, this information was transferred, transmitted to USAads
and his profile was immediately updated to reflect an interest
in golf.
When Joe went to TraveltheUS, a similar process occurred.
An invisible link to USAads produced yet another ad. Because
they knew the site was travel-related, USAads sent an ad for
rental cars. When Joe entered a search for Arizona, his search
term was transmitted again to USAads. As a result, travel and
Arizona were added to the profile associated with the cookie on
Joe's computer.
When Joe then went to his favorite online news site, that
was also served by USAads. The cookie on his computer was read
and he was presented with an ad targeted to his profile, a golf
vacation package in Arizona.
Now, some consumers would be delighted to receive an ad
targeted to their specific interest. Others, however, would be
troubled by having been tracked through prior website browsing
without their knowledge.
Now let us suppose it occurred to Joe, and it did occur to
him, that somebody had some information about him, that maybe
he got the golfing vacation in Tucson ad because of a cookie
placed on his computer. One way for Joe to see at least a small
part of the process, the placement of the cookie on his
machine, is for him to set the browser to notify him before
accepting cookies. Now, you decide whether or not this is an
easy thing for Joe or anyone to do.
There is a capability to do it. Let's look and see how easy
it is. What would Joe do to change the cookie settings on his
browser? Now, nothing up there says ``cookies,'' but maybe he
would say, try the edit menu, and that would be a good one to
try. Then maybe he'd decide to try ``Preferences.'' Now what?
Would the smart choice be ``Smart browsing,'' that category
under ``Navigator''? No.
Maybe Joe needs a lifeline here. Maybe he will try to even
poll the Committee members who might help him out. Try clicking
on ``Advance,'' and then someone would say, ``Is that your
final answer?'' Now you would see a checkbox that says ``Warn
me before accepting cookies.'' Well, that sounds right. That
sounds intuitive almost.
So let us see what Joe, what he accomplished after he
clicked on ``Warn me before accepting cookies.'' What does the
notification or warning from the browser look like? This is
what it tells you. It tells you that someone named ``USAads''
wants to put a cookie on your computer with a particular ID
number on it and the cookie will stay there until the year
2010.
With the way computers, personal computers, change, it'll
probably outlast any number of computers that you have. But the
cookie will be there twice as long. Notice, however, that this
warning from your browser does not tell you who USAads is or
what their cookie does. In other words, you have to choose to
accept or reject this cookie without knowing very much at all.
You know, if it is that hard to deal with one cookie, we
wanted to see what it would be like and how many cookies were
likely to come up soon that you would have to deal with. Here
is a sample cookie file that we constructed. We did it by
deleting all the cookies from an FTC computer and we had a law
clerk spend about 15 minutes only surfing some of the popular
sites, the most popular sites on the web.
In just 15 minutes, 124 cookies were deposited on the
computer, some of which are shown. The highlighted cookies were
placed by third party advertising networks, in other words
``profilers.''
One other interesting thing to note is that the message--I
really like this--that appears at the top of this file says
``This is a generated file. Do not edit.'' That reminds me of
the label that you all have seen, and I have too, on the
mattress that says ``Under penalty of law, do not remove this
label.'' Well, the reason for this--the suggestion is that the
user cannot selectively edit the cookie file to keep really
helpful cookies and get rid of the unwanted cookies.
That is not true. The user can edit cookie files, but you
might end up as confused as we were as we tried to work through
the cookie files.
Let me conclude, and I do thank the Committee for allowing
us this amount of time. As the Commission's report details,
targeted advertising can provide benefits to both consumers and
business. Nonetheless, current profiling practices raise a
number of serious concerns. The most serious concern, which I
hope this presentation illustrated, is that profiling is
largely invisible to consumers.
Another concern is, because network advertisers can monitor
consumers across numerous unrelated websites over time, the
profiles they create can be extremely detailed and many would
say extremely intrusive.
The Commission looks forward to working with the Committee
to address the many privacy issues raised by online profiling
and would be pleased to answer your questions. Thank you again,
Mr. Chairman, for the opportunity to present the Commission's
report.
[The prepared statement of Ms. Bernstein follows:]
Prepared Statement of Jodie Bernstein, Director, Bureau of Consumer
Protection, Federal Trade Commission (Accompanied by David Medine,
Associate Director for Financial Practices, Bureau of Consumer
Protection, Federal Trade Commission, and Dawne Holz, Federal Trade
Commission)
The Federal Trade Commission on
``Online Profiling: Benefits and Concerns''
Mr. Chairman and Members of the Committee, I am Jodie Bernstein,
Director of the Bureau of Consumer Protection of the Federal Trade
Commission.\1\ I appreciate this opportunity to discuss the
Commission's report on profiling issued today.\2\ The report describes
the nature of online profiling, consumer privacy concerns about these
practices, and the Commission's efforts to date to address these
concerns. The Commission is not making any recommendations at this
time.
As it has in other areas, the Commission has encouraged effective
industry self-regulation, and the network advertising industry has
responded with drafts of self-regulatory principles for our
consideration. As discussed further in this testimony, there are real
challenges to creating an effective self-regulatory regime for this
complex and dynamic industry, and this process is not yet complete. The
Commission will supplement this report with specific recommendations to
Congress after it has an opportunity to fully consider the self-
regulatory proposals and how they interrelate with the Commission's
previous views and recommendations in the online privacy area.
I. Introduction and Background
A. FTC Law Enforcement Authority
The FTC's mission is to promote the efficient functioning of the
marketplace by protecting consumers from unfair or deceptive acts or
practices and to increase consumer choice by promoting vigorous
competition. As you know, the Commission's responsibilities are far-
reaching. The Commission's primary legislative mandate is to enforce
the Federal Trade Commission Act (``FTCA''), which prohibits unfair
methods of competition and unfair or deceptive acts or practices in or
affecting commerce.\3\ With the exception of certain industries and
activities, the FTCA provides the Commission with broad investigative
and law enforcement authority over entities engaged in or whose
business affects commerce.\4\ Commerce on the Internet falls within the
scope of this statutory mandate.
B. Privacy Concerns in the Online Marketplace
Since its inception in the mid-1990's, the online consumer
marketplace has grown at an exponential rate. Recent figures suggest
that as many as 90 million Americans now use the Internet on a regular
basis.\5\ Of these, 69%, or over 60 million people, shopped online in
the third quarter of 1999.\6\ In addition, the Census Bureau estimates
that retail e-commerce sales were $5.2 billion for the fourth quarter
of 1999, and increased to $5.3 billion for the first quarter of
2000.\7\
At the same time, technology has enhanced the capacity of online
companies to collect, store, transfer, and analyze vast amounts of data
from and about the consumers who visit their Web sites. This increase
in the collection and use of data, along with the myriad subsequent
uses of this information that interactive technology makes possible,
has raised public awareness and consumer concerns about online
privacy.\8\ Recent survey data demonstrate that 92% of consumers are
concerned (67% are ``very concerned'') about the misuse of their
personal information online.\9\ The level of consumer unease is also
indicated by a recent study in which 92% of respondents from online
households stated that they do not trust online companies to keep their
personal information confidential.\10\ To ensure consumer confidence in
this new marketplace and its continued growth, consumer concerns about
privacy must be addressed.\11\
C. The Commission's Approach to Online Privacy--Initiatives Since 1995
Since 1995, the Commission has been at the forefront of the public
debate concerning online privacy.\12\ The Commission has held public
workshops; examined Web site information practices and disclosures
regarding the collection, use, and transfer of personal information;
and commented on self-regulatory efforts and technological developments
intended to enhance consumer privacy. The Commission's goals have been
to understand this new marketplace and its information practices, and
to assess the costs and benefits to businesses and consumers.\13\
In June 1998 the Commission issued Privacy Online: A Report to
Congress (``1998 Report''), an examination of the information practices
of commercial sites on the World Wide Web and of industry's efforts to
implement self-regulatory programs to protect consumers' online
privacy.\14\ The Commission described the widely-accepted fair
information practice principles of Notice, Choice, Access and Security.
The Commission also identified Enforcement--the use of a reliable
mechanism to provide sanctions for noncompliance--as a critical
component of any governmental or self-regulatory program to protect
privacy online.\15\ In addition, the 1998 Report presented the results
of the Commission's first online privacy survey of commercial Web
sites. While almost all Web sites (92% of the comprehensive random
sample) were collecting great amounts of personal information from
consumers, few (14%) disclosed anything at all about their information
practices.\16\
Based on survey data showing that the vast majority of sites
directed at children also collected personal information, the
Commission recommended that Congress enact legislation setting forth
standards for the online collection of personal information from
children.\17\ The Commission deferred its recommendations with respect
to the collection of personal information from online consumers
generally. In subsequent Congressional testimony, the Commission
referenced promising self-regulatory efforts suggesting that industry
should be given more time to address online privacy issues. The
Commission urged the online industry to expand these efforts by
adopting effective, widespread self-regulation based upon the long-
standing fair information practice principles of Notice, Choice,
Access, and Security, and by putting enforcement mechanisms in place to
assure adherence to these principles.\18\ In a 1999 report to Congress,
Self-Regulation and Privacy Online, a majority of the Commission again
recommended that self-regulation be given more time.\19\
On May 22, 2000, the Commission issued its third report to Congress
examining the state of online privacy and the efficacy of industry
self-regulation. Privacy Online: Fair Information Practices in the
Electronic Marketplace (``2000 Report'') presented the results of the
Commission's 2000 Online Privacy Survey, which reviewed the nature and
substance of U.S. commercial Web sites' privacy disclosures, and
assessed the effectiveness of self-regulation. In that Report, a
majority of the Commission concluded that legislation is necessary to
ensure further implementation of fair information practices online and
recommended a framework for such legislation.\20\
II. Online Profiling
On November 8, 1999, the Commission and the United States
Department of Commerce jointly sponsored a Public Workshop on Online
Profiling.\21\ As a result of the Workshop and public comment, the
Commission learned a great deal about what online profiling is, how it
can benefit both businesses and consumers, and the privacy concerns
that it raises.
A. What is Online Profiling?
More than half of all online advertising is in the form of ``banner
ads'' displayed on Web pages--small graphic advertisements that appear
in boxes above or to the side of the primary site content.\22\ Often,
these ads are not selected and delivered by the Web site visited by a
consumer, but by a network advertising company that manages and
provides advertising for numerous unrelated Web sites.
In general, these network advertising companies do not merely
supply banner ads; they also gather data about the consumers who view
their ads. This is accomplished primarily by the use of ``cookies''
\23\ which track the individual's actions on the Web.\24\ The
information gathered by network advertisers is often, but not always,
anonymous, that is, the profiles are frequently linked to the
identification number of the advertising network's cookie on the
consumer's computer rather than the name of a specific person. In some
circumstances, however, the profiles derived from tracking consumers'
activities on the Web are linked or merged with personally identifiable
information.\25\
Once collected, consumer data is analyzed and can be combined with
demographic and ``psychographic'' \26\ data from third-party sources,
data on the consumer's offline purchases, or information collected
directly from consumers through surveys and registration forms. This
enhanced data allows the advertising networks to make a variety of
inferences about each consumer's interests and preferences. The result
is a detailed profile that attempts to predict the individual
consumer's tastes, needs, and purchasing habits and enables the
advertising companies' computers to make split-second decisions about
how to deliver ads directly targeted to the consumer's specific
interests.
The profiles created by the advertising networks can be extremely
detailed. A cookie placed by a network advertising company can track a
consumer on any Web site served by that company, thereby allowing data
collection across disparate and unrelated sites on the Web. Also,
because the cookies used by ad networks are generally persistent, their
tracking occurs over an extended period of time, resuming each time the
individual logs on to the Internet. When this ``clickstream''
information is combined with third-party data, these profiles can
include hundreds of distinct data fields.\27\
Although network advertisers and their profiling activities are
nearly ubiquitous,\28\ they are most often invisible to consumers. All
that consumers see are the Web sites they visit; banner ads appear as a
seamless, integral part of the Web page on which they appear and
cookies are placed without any notice to consumers.\29\ Unless the Web
sites visited by consumers provide notice of the ad network's presence
and data collection, consumers may be totally unaware that their
activities online are being monitored.\30\
B. Profiling Benefits and Privacy Concerns
Network advertisers' use of cookies \31\ and other technologies to
create targeted marketing programs can benefit both consumers and
businesses. As noted by commenters at the Public Workshop, targeted
advertising allows customers to receive offers and information about
goods and services in which they are actually interested.\32\
Businesses clearly benefit as well from the ability to target
advertising because they avoid wasting advertising dollars marketing
themselves to consumers who have no interest in their products.\33\
Additionally, a number of commenters stated that targeted advertising
helps to subsidize free content on the Internet.\34\
Despite the benefits of targeted advertising, there is widespread
concern about current profiling practices. The most consistent and
significant concern expressed about profiling is that it is conducted
without consumers' knowledge.\35\ The presence and identity of a
network advertiser on a particular site, the placement of a cookie on
the consumer's computer, the tracking of the consumer's movements, and
the targeting of ads are simply invisible in most cases.
The second most persistent concern expressed by commenters was the
extensive and sustained scope of the monitoring that occurs.
Unbeknownst to most consumers, advertising networks monitor individuals
across a multitude of seemingly unrelated Web sites and over an
indefinite period of time. The result is a profile far more
comprehensive than any individual Web site could gather. Although much
of the information that goes into a profile is fairly innocuous when
viewed in isolation, the cumulation over time of vast numbers of
seemingly minor details about an individual produces a portrait that is
quite comprehensive and, to many, inherently intrusive.\36\
For many of those who expressed concerns about profiling, the
privacy implications of profiling are not ameliorated in cases where
the profile contains no personally identifiable information.\37\ First,
commenters feared that companies could unilaterally change their
operating procedures and begin associating personally identifiable
information with non-personally identifiable data previously
collected.\38\ Second, these commenters objected to the use of
profiles--regardless of whether they contain personally identifiable
information--to make decisions about the information individuals see
and the offers they receive. Commenters expressed concern that
companies could use profiles to determine the prices and terms upon
which goods and services, including important services like life
insurance, are offered to individuals.\39\
C. Online Profiling and Self Regulation: the NAI Effort
The November 8th workshop provided an opportunity for consumer
advocates, government, and industry members not only to educate the
public about the practice of online profiling, but to explore self-
regulation as a means of addressing the privacy concerns raised by this
practice. In the Spring of 1999, in anticipation of the Workshop,
network advertising companies were invited to meet with FTC and
Department of Commerce staff to discuss their business practices and
the possibility of self-regulation. As a result, industry members
announced at the Workshop the formation of the Network Advertising
Initiative (NAI), an organization comprised of the leading Internet
Network Advertisers--24/7 Media, AdForce, AdKnowledge, Avenue A, Burst!
Media, DoubleClick, Engage, and MatchLogic--to develop a framework for
self-regulation of the online profiling industry.
In announcing their intention to implement a self-regulatory
scheme, the NAI companies acknowledged that they face unique challenges
as a result of their indirect and invisible relationship with consumers
as they surf the Internet. The companies also discussed the fundamental
question of how fair information practices, including choice, should be
applied to the collection and use of data that is unique to a consumer
but is not necessarily personally identifiable, such as clickstream
data generated by the user's browsing activities and tied only to a
cookie identification number.\40\
Following the workshop, the NAI companies submitted working drafts
of self-regulatory principles for consideration by FTC and Department
of Commerce staff. Although efforts have been made to reach a consensus
on basic standards for applying fair information practices to the
business model used by the network advertisers, this process is not yet
complete. The Commission will supplement this report with specific
recommendations to Congress after it has an opportunity to fully
consider the self-regulatory proposals and how they interrelate with
the Commission's previous views and recommendations in the online
privacy area.
III. Conclusion
The Commission is committed to the goal of ensuring privacy online
for consumers and will continue working to address the unique issues
presented by online profiling. I would be pleased to answer any
questions you may have.
Endnotes
1. The Commission vote to issue this testimony was 5-0, with
Commissioner Swindle concurring in part and dissenting in part.
Commissioner Swindle's separate statement is attached to the testimony.
2. My oral testimony and responses to questions you may have
reflect my own views and are not necessarily the views of the
Commission or any individual Commissioner.
3. 15 U.S.C. Sec. 45(a).
4. The Commission also has responsibility under 45 additional
statutes governing specific industries and practices. These include,
for example, the Truth in Lending Act, 15 U.S.C. Sec. Sec. 1601 et
seq., which mandates disclosures of credit terms, and the Fair Credit
Billing Act, 15 U.S.C. Sec. Sec. 1666 et seq., which provides for the
correction of billing errors on credit accounts. The Commission also
enforces over 30 rules governing specific industries and practices,
e.g., the Used Car Rule, 16 C.F.R. Part 455, which requires used car
dealers to disclose warranty terms via a window sticker; the Franchise
Rule, 16 C.F.R. Part 436, which requires the provision of information
to prospective franchisees; the Telemarketing Sales Rule, 16 C.F.R.
Part 310, which defines and prohibits deceptive telemarketing practices
and other abusive telemarketing practices; and the Children's Online
Privacy Protection Rule, 16 C.F.R. Part 312.
In addition, on May 12, 2000, the Commission issued a final rule
implementing the privacy provisions of the Gramm-Leach-Bliley Act, 15
U.S.C. Sec. Sec. 6801 et seq. The rule requires a wide range of
financial institutions to provide notice to their customers about their
privacy policies and practices. The rule also describes the conditions
under which those financial institutions may disclose personal
financial information about consumers to nonaffiliated third parties,
and provides a method by which consumers can prevent financial
institutions from sharing their personal financial information with
nonaffiliated third parties by opting out of that disclosure, subject
to certain exceptions. The rule is available on the Commission's Web
site at . See Privacy of
Consumer Financial Information, to be codified at 16 C.F.R. pt. 313.
The Commission does not, however, have criminal law enforcement
authority. Further, under the FTCA, certain entities, such as banks,
savings and loan associations, and common carriers, as well as the
business of insurance, are wholly or partially exempt from Commission
jurisdiction. See Section 5(a)(2) and (6)a of the FTC Act, 15 U.S.C.
Sec. 45(a)(2) and 46(a). See also The McCarran-Ferguson Act, 15 U.S.C.
Sec. 1012(b).
5. The Intelliquest Technology Panel, Panel News, available at
[hereinafter ``Technology
Panel''] (90 million adult online users as of third-quarter 1999).
Other sources place the number in the 70-75 million user range. See
Cyber Dialogue, Internet Users, available at (69 million users);
Cyberstats, Internet Access and Usage, Percent of Adults 18+, available
at (75 million
users).
6. Technology Panel. This represents an increase of over 15 million
online shoppers in one year. See id.
7. United States Department of Commerce News, Retail E-commerce
Sales Are $5.3 Billion In First Quarter 2000, Census Bureau Reports
(May 31, 2000), available at .
8. Survey data is an important component in the Commission's
evaluation of consumer concerns, as is actual consumer behavior.
Nonetheless, the Commission recognizes that the interpretation of
survey results is complex and must be undertaken with care.
9. Alan F. Westin, Personalized Marketing and Privacy on the Net:
What Consumers Want, Privacy and American Business at 11 (Nov. 1999)
[hereinafter ``Westin/PAB 1999'']. See also IBM Multi-National Consumer
Privacy Survey at 72 (Oct. 1999), prepared by Louis Harris & Associates
Inc. [hereinafter ``IBM Privacy Survey''] (72% of Internet users very
concerned and 20% somewhat concerned about threats to personal privacy
when using the Internet); Forrester Research, Inc., Online Consumers
Fearful of Privacy Violations (Oct. 1999), available at (two-thirds of
American and Canadian online shoppers feel insecure about exchanging
personal information over the Internet).
10. Survey Shows Few Trust Promises on Online Privacy, Apr. 17,
2000, available at (citing recent Odyssey survey).
11. The Commission, of course, recognizes that other consumer
concerns also may hinder the development of e-commerce. As a result,
the agency has pursued other initiatives such as combating online fraud
through law enforcement efforts. See FTC Staff Report: The FTC's First
Five Years Protecting Consumers Online (Dec. 1999). The Commission,
with the Department of Commerce, recently held a public workshop and
soliciting comment on the potential issues associated with the use of
alternative dispute resolution for online consumer transactions. See
Initial Notice Requesting Public Comment and Announcing Public
Workshop, 65 Fed. Reg. 7,831 (Feb. 16, 2000); Notice Announcing Dates
and Location of Workshop and Extending Deadline for Public Comments, 65
Fed. Reg. 18,032 (Apr. 6, 2000). The workshop was held on June 6 and 7,
2000. Information about the workshop, including the federal register
notices and public comments received, is available at .
12. The Commission's review of privacy has mainly focused on online
issues because the Commission believes privacy is a critical component
in the development of electronic commerce. However, the FTC Act and
most other statutes enforced by the Commission apply equally in the
offline and online worlds. As described infra, n.11, the agency has
examined privacy issues affecting both arenas, such as those implicated
by the Individual Reference Services Group, and in the areas of
financial and medical privacy. It also has pursued law enforcement,
where appropriate, to address offline privacy concerns. See FTC v.
Rapp, No. 99-WM-783 (D. Colo. filed Apr. 21, 1999); In re Trans Union,
Docket No. 9255 (Feb. 10, 2000), appeal docketed, No. 00-1141 (D.C.
Cir. Apr. 4, 2000). These activities--as well as recent concerns about
the merging of online and offline databases, the blurring of
distinctions between online and offline merchants, and the fact that a
vast amount of personal identifying information is collected and used
offline--make clear that significant attention to offline privacy
issues is warranted.
13. The Commission held its first public workshop on privacy in
April 1995. In a series of hearings held in October and November 1995,
the Commission examined the implications of globalization and
technological innovation for competition and consumer protection
issues, including privacy concerns. At a public workshop held in June
1996, the Commission examined Web site practices regarding the
collection, use, and transfer of consumers' personal information; self-
regulatory efforts and technological developments to enhance consumer
privacy; consumer and business education efforts; the role of
government in protecting online information privacy; and special issues
raised by the online collection and use of information from and about
children. The Commission held a second workshop in June 1997 to explore
issues raised by individual reference services, as well as issues
relating to unsolicited commercial e-mail, online privacy generally,
and children's online privacy.
The Commission and its staff have also issued reports describing
various privacy concerns in the electronic marketplace. See, e.g., FTC
Staff Report: The FTC's First Five Years Protecting Consumers Online
(Dec. 1999); Individual Reference Services: A Federal Trade Commission
Report to Congress (Dec. 1997); FTC Staff Report: Public Workshop on
Consumer Privacy on the Global Information Infrastructure (Dec. 1996);
FTC Staff Report: Anticipating the 21st Century: Consumer Protection
Policy in the New High-Tech, Global Marketplace (May 1996). Recently,
at the request of the Department of Health and Human Services
(``HHS''), the Commission submitted comments on HHS' proposed Standards
for Privacy of Individually Identifiable Health Information (required
by the Health Insurance Portability and Accountability Act of 1996).
The Commission strongly supported HHS' proposed ``individual
authorization'' or ``opt-in'' approach to health providers' ancillary
use of personally identifiable health information for purposes other
than those for which the information was collected. The Commission also
offered HHS suggestions it may wish to consider to improve disclosure
requirements in two proposed forms that would be required by the
regulations. The Commission's comments are available at .
The Commission also has brought law enforcement actions to protect
privacy online pursuant to its general mandate to fight unfair and
deceptive practices. See FTC v. ReverseAuction.com, Inc., No. 00-0032
(D.D.C. Jan. 6, 2000) (consent decree) (settling charges that an online
auction site obtained consumers' personal identifying information from
a competitor site and then sent deceptive, unsolicited e-mail messages
to those consumers seeking their business); Liberty Financial
Companies, Inc., FTC Dkt. No. C-3891 (Aug. 12, 1999) (consent order)
(challenging the allegedly false representations by the operator of a
``Young Investors'' Web site that information collected from children
in an online survey would be maintained anonymously); GeoCities, FTC
Dkt. No. C-3849 (Feb. 12, 1999) (consent order) (settling charges that
Web site misrepresented the purposes for which it was collecting
personal identifying information from children and adults).
14. The Report is available on the Commission's Web site at http://
www.ftc.gov/reports/privacy3/index.htm.
15. 1998 Report at 11-14.
16. Id. at 23, 27.
17. Id. at 42-43. In October 1998, Congress enacted the Children's
Online Privacy Protection Act of 1998 (``COPPA''), which authorized the
Commission to issue regulations implementing the Act's privacy
protections for children under the age of 13. 15 U.S.C. Sec. Sec. 6501
et seq. In October 1999, as required by COPPA, the Commission issued
its Children's Online Privacy Protection Rule, which became effective
last month. 16 C.F.R. Part 312.
18. See Prepared Statement of the Federal Trade Commission on
``Consumer Privacy on the World Wide Web'' before the Subcommittee on
Telecommunications, Trade and Consumer Protection of the House
Committee on Commerce, U.S. House of Representatives (July 21, 1998),
available at .
19. Self-Regulation and Privacy Online (July 1999) at 12-14
(available at ).
20. The 2000 Report is available at . The Commission's vote to issue the report was 3-2, with
Commissioner Swindle dissenting and Commissioner Leary concurring in
part and dissenting in part.
21. A transcript of the Workshop is available at and will be cited as ``Tr. [page],
[speaker].'' Public comments received in connection with the Workshop
can be viewed on the Federal Trade Commission's Web site at and will be cited as
``Comments of [organization or name] at [page].''
22. In 1999, 56% of all online advertising revenue was attributable
to banner advertising. Online advertising has grown exponentially in
tandem with the World Wide Web: online advertising revenues in the U.S.
grew from $301 million in 1996 to $4.62 billion in 1999. See Press
Release: Internet Advertising Revenues Soar to $4.6 billion in 1999
(available at ).
Advertising revenues are projected to reach $11.5 billion by 2003. See
Jupiter Communications, Inc., Online Advertising Through 2003 (July
1999) (summary available at ).
23. A cookie is a small text file placed on a consumer's computer
by a Web server that transmits information back to the server that
placed it. As a rule, a cookie can be read only by the server that
placed it.
24. In addition to cookies, which are largely invisible to
consumers, other hidden methods of monitoring consumers' activities on
the Web may also be used. One such method is through the use of ``Web
bugs,'' also known as ``clear GIFs'' or ``1-by-1 GIFs.'' Web bugs are
tiny graphic image files embedded in a Web page, generally the same
color as the background on which they are displayed. They are one pixel
in height by one pixel in length--the smallest image capable of being
displayed on a monitor--and are invisible to the naked eye. The Web bug
sends back to its home server (which can belong to the host site, a
network advertiser or some other third party): the IP (Internet
Protocol) address of the computer that downloaded the page on which the
bug appears; the URL (Uniform Resource Locator) of the page on which
the Web bug appears; the URL of the Web bug image; the time the page
containing the Web bug was viewed; the type of browser that fetched the
Web bug; and the identification number of any cookie on the consumer's
computer previously placed by that server. Web bugs can be detected
only by looking at the source code of a Web page and searching in the
code for 1-by-1 IMG tags that load images from a server different than
the rest of the Web page. At least one expert claims that, in addition
to disclosing who visits the particular Web page or reads the
particular e-mail in which the bug has been placed, in some
circumstances, Web bugs can also be used to place a cookie on a
computer or to synchronize a particular e-mail address with a cookie
identification number, making an otherwise anonymous profile personally
identifiable. See generally Comments of Richard M. Smith; see also Big
Browser is Watching You!, Consumer Reports, May 2000, at 46; USA Today,
A new wrinkle in surfing the Net: Dot-coms' mighty dot-size bugs track
your every move, Mar. 21, 2000 (available at ).
25. Personally identifiable data is data that can be linked to
specific individuals and includes, but is not limited to such
information as name, postal address, phone number, e-mail address,
social security number, and driver's license number. The linkage of
personally identifiable information with non-personally identifiable
information generally occurs in one of two ways when consumers identify
themselves to a Web site on which the network advertiser places banner
ads. First, the Web site to whom personal information is provided may,
in turn, provide that information to the network advertiser. Second,
depending upon how the personal information is retrieved and processed
by the Web site, the personally identifying information may be
incorporated into a URL string that is automatically transmitted to the
network advertiser through its cookie. In addition, network advertising
companies can and do link personally identifiable information to non-
personally identifiable information at their own Web sites by asking
consumers to provide personal information (for example, to enter a
sweepstakes) and then linking that information to the cookie previously
placed on the consumer's computer; the linkage of personally
identifying information to a cookie makes all of the data collected
through that cookie personally identifiable.
26. Psychographic data links objective demographic characteristics
like age and gender with more abstract characteristics related to
ideas, opinions and interests. Data mining specialists analyze
demographic, media, survey, purchasing and psychographic data to
determine the exact groups that are most likely to buy specific
products and services. See Comments of the Center for Democracy and
Technology (CDT) at 5 n.5. Psychographic profiling is also referred to
in the industry as ``behavioral profiling.''
27. For example, the Web site for Engage states repeatedly that its
profiles contain 800 ``interest categories.'' See, e.g., .
28. DoubleClick has approximately 100 million consumer profiles,
see Heather Green, Privacy: Outrage on the Web, Business Week, Feb 14,
2000, at 38; Engage has 52 million consumer profiles, see ; and 24/7 Media has 60
million profiles, see .
29. Most Internet browsers can be configured to notify users that a
cookie is being sent to their computer and to give users the option of
rejecting the cookie. The browsers' default setting, however, is to
permit placement of cookies without any notification.
30. Not all profiles are constructed by network advertising
companies. Some Web sites create profiles of their own customers based
on their interactions. Other companies create profiles as part of a
service--for example, offering discounts on products of interest to
consumers or providing references to useful Web sites on the same topic
as those already visited by the consumer. See, e.g., Megan Barnett, The
Profilers: Invisible Friends, The Industry Standard, Mar. 13, 2000, at
220; Ben Hammer, Bargain Hunting, The Industry Standard, Mar. 13, 2000,
at 232. These profiles are generally created by companies that have a
known, consensual relationship with the consumer and are not addressed
in this report. This report uses the term ``profiling'' to refer only
to the activities of third-party network advertising companies.
31. Cookies are used for many purposes other than profiling by
third-party advertisers, many of which significantly benefit consumers.
For example, Web sites often ask for user names and passwords when
purchases are made or before certain kinds of content are provided.
Cookies can store these names and passwords so that consumers do not
need to sign in each time they visit the site. In addition, many sites
allow consumers to set items aside in an electronic shopping cart while
they decide whether or not to purchase them; cookies allow a Web site
to remember what is in a consumer's shopping cart from prior visits.
Cookies also can be used by Web sites to offer personalized home pages
or other customized content with local news and weather, favorite stock
quotes, and other material of interest to individual consumers.
Individual online merchants can use cookies to track consumers'
purchases in order to offer recommendations about new products or sales
that may be of interest to their established customers. Finally, by
enabling businesses to monitor traffic on their Web sites, cookies
allow businesses to constantly revise the design and layout of their
sites to make them more interesting and efficient. The privacy issues
raised by these uses of cookies are beyond the scope of this report.
32. See, e.g., Comments of the Magazine Publishers of America (MPA)
at 1; Comments of the Direct Marketing Association (DMA) at 2; Comments
of the Association of National Advertisers (ANA) at 2; Tr. 30, Smith;
Tr. 120, Jaffe.
33. See, e.g., Comments of the Association of National Advertisers
(ANA) at 2.
34. See, e.g., Comments of the Magazine Publishers of America (MPA)
at 1; Comments of Solveig Singleton at 3-4; Tr. 20, Jaye; Tr. 124,
Aronson.
35. See, e.g., Comments of the Center for Democracy and Technology
(CDT) at 2, 16; Reply Comments of the Electronic Information Privacy
Center (EPIC) at 1; Comments of TRUSTe at 2; Tr. 113, Mulligan.
36. See, e.g., Comments of the Center for Democracy and Technology
(CDT) at 2; Reply Comments of Electronic Information Privacy Center
(EPIC) at 1-2.
37. See, e.g., Comments of the Center for Democracy and Technology
(CDT) at 2-3; Tr. 112, Steele; Tr. 128, Smith.
38. See Comments of the Center for Democracy and Technology (CDT)
at 2-3; Comments of Christopher K. Ridder (Nov. 30, 1999) at 6 (listing
examples of sites whose privacy policies explicitly reserve the right
of the site to change privacy policies without notice to the consumer);
Tr. 158, Mulligan. These commenters also felt that the comprehensive
nature of the profiles and the technology used to create them make it
reasonably easy to associate previously anonymous profiles with
particular individuals.
39. See Comments of the Center for Democracy and Technology (CDT)
at 3; Comments of the Electronic Frontier Foundation (EFF) Session II
at 2; Rebuttal Comments of the Electronic Frontier Foundation (EFF) at
4; Tr. 81, Feena; Tr. 114, Hill; Tr. 146-7, Steele; see also John
Simons, The Coming Privacy Divide, The Standard, Feb. 21, 2000, . For
example, products might be offered at higher prices to consumers whose
profiles indicate that they are wealthy, or insurance might be offered
at higher prices to consumers whose profiles indicate possible health
risks. This practice, known as ``web-lining,'' raises many of the same
concerns that ``redlining'' and ``reverse redlining'' do in offline
financial markets. See, e.g., Rebuttal Comments of the Electronic
Frontier Foundation (EFF) at 4 (expressing concern about ``electronic
redlining''); Tr. 81, Feena (describing technology's potential use for
``red-lining'' [sic]); Tr. 146-7, Steele (describing risk of
``electronic redlining and price discrimination'').
40. Tr. 186, Jaye; Tr. 192-193, Zinman.
______
Statement of Commissioner Orson Swindle Concurring in Part and
Dissenting in Part to Prepared Statement of the Federal Trade
Commission on ``Online Profiling: Benefits and Concerns''
I concur in the issuance of the Prepared Statement of the Federal
Trade Commission on ``Online Profiling: Benefits and Concerns'' before
the Committee on Commerce, Science, and Transportation, United States
Senate (June 13, 2000) (``Commission Statement''), but I dissent from
how certain consumer opinion surveys are used in the Commission
Statement.
First, consumer opinion surveys like the ones used in the
Commission Statement often are not reliable predictors of consumer
behavior. For several reasons, and as the Commission Statement
acknowledges in footnote 8, survey results should be examined with
scrupulous care. Surveys are one-time snapshots of consumer opinion,
are easily biased by design, and must be examined for methodological
integrity.
Ideally, consumer opinion surveys should complement, but not be a
substitute for, empirical evidence of consumer behavior relating to
privacy. They should not serve as the substantive basis for policy.\1\
---------------------------------------------------------------------------
\1\ A portion of my dissent from the Commission's 2000 Privacy
Report addressed the Commission's dubious reliance on consumer opinion
surveys. See Dissenting Statement of Commissioner Orson Swindle,
Federal Trade Commission, ``Privacy Online: Fair Information Practices
in the Electronic Marketplace: A Report to Congress'' (May 22, 2000) at
12-16.
---------------------------------------------------------------------------
Second, when the Commission reports to or testifies before
Congress, it owes the Congress a certain degree of thoroughness. A
statistic included in a Commission report likely will be given
credibility beyond what might attach to the use of that same number in
a brief news story or an advertisement. Because of the added degree of
credibility attached to a Commission report, the Commission should not
uncritically repeat estimates, projections, or other statistics unless
it knows how the numbers were derived, including the assumptions on
which they may have been based. This requires going directly to the
source of a number. If that standard of analysis cannot be met, then
the Commission either should not use the number or should explicitly
qualify its use of the number by the uncertainties attached to it.
For example, both the Online Profiling Report and this testimony
contain an estimate of future advertising revenue drawn from an
overview of a July 1999 report by a management consulting firm. (see
``Online Profiling: A Report to Congress'' at 2, n.7; Commission
Statement at n.22). The Commission has no basis for assessing what
assumptions went into that projection, nor does the Report or the
testimony highlight that the July 1999 date of the projection alone
likely means it is less accurate in light of the tremendous growth in
online commerce since then. In my dissent from the Commission's 2000
Privacy Report, I criticized the Commission's use of a lost sales
projection by the same management consulting firm based on the
repetition of that projection in a news article and the information
available from an online overview of the study. An examination of the
full study revealed that the lost sales projection was based on
assumptions that completely invalidated the Privacy Report's reliance
on that lost sales projection. See 2000 Privacy Report, Dissenting
Statement of Commissioner Orson Swindle at 13-14.
Another example of relying on numbers without assessing their
validity is the testimony's reference to an Odyssey study in which 92%
of respondents from online households stated that they do not trust
online companies to keep their personal information confidential.
(Commission Statement at 5-6 n.10). This figure comes from the same
Odyssey Study cited by the majority in the Privacy Report and appears
to be subject to the same flaws that I discussed in my dissent from the
Privacy Report. Unfortunately, the Odyssey Study does not reveal the
specific questions used to derive the 92% that either agree or strongly
agree with the proposition repeated in the Commission Statement. If the
Odyssey Study uses the same methodology as for other questions, it
likely biases the responses to ``agree'' categories by not allowing a
choice to ``somewhat disagree.'' (See 2000 Privacy Report, Dissenting
Statement of Commissioner Orson Swindle at 11.)
I respectfully ask that Congress keep these limitations in the data
in mind as it considers the Commission's Online Profiling Report and
the Commission Statement.
______
Online Profiling: A Report to Congress
Federal Trade Commission*
---------------------------------------------------------------------------
* The Commission vote to issue this Report was 5-0, with
Commissioner Swindle concurring in part and dissenting in part.
Commissioner Swindle's separate statement is attached to the Report.
---------------------------------------------------------------------------
Robert Pitofsky, Chairman
Sheila F. Anthony, Commissioner
Mozelle W. Thompson, Commissioner
Orson Swindle, Commissioner
Thomas B. Leary, Commissioner
Bureau of Consumer Protection, Division of Financial Practices
I. Introduction
On November 8, 1999, the Federal Trade Commission (hereinafter
``FTC'' or ``Commission'') and the United States Department of Commerce
jointly sponsored a Public Workshop on Online Profiling.\1\ The goals
of the Workshop were to educate government officials and the public
about online profiling and its implications for consumer privacy, and
to examine efforts of the profiling industry to implement fair
information practices.\2\ The Commission also sought public comment on
any issues of fact, law or policy that might inform its consideration
of the practice of online profiling.\3\
In keeping with its longstanding support of industry self-
regulation, the Commission has encouraged the network advertising
industry in its efforts to craft an industry-wide program. The industry
has responded with working drafts of self-regulatory principles for our
consideration. In examining the practice of online profiling, as well
as our work in online privacy, we nonetheless recognize there are real
challenges to creating an effective self-regulatory regime for this
complex and dynamic industry, and this process is not yet complete.
This report describes the current practice of online profiling by
the network advertisers \4\ and the benefits and concerns it presents
for consumers. It also discusses the ongoing effort of the industry to
develop self-regulatory principles. The Commission expects to
supplement this report with specific recommendations to Congress after
it has an opportunity to fully consider the self-regulatory proposals
and how they interrelate with the Commission's previous views and
recommendations in the online privacy area.
II. What is Online Profiling?
A. Overview
Over the past few years, online advertising has grown exponentially
in tandem with the World Wide Web. Online advertising revenues in the
U.S. grew from $301 million in 1996 \5\ to $4.62 billion in 1999,\6\
and were projected to reach $11.5 billion by 2003.\7\ A large portion
of that online advertising is in the form of ``banner ads'' displayed
on Web pages--small graphic advertisements that appear in boxes above
or to the side of the primary site content.\8\ Currently, tens of
billions of banner ads are delivered to consumers each month as they
surf the World Wide Web.\9\ Often, these ads are not selected and
delivered by the Web site visited by a consumer, but by a network
advertising company that manages and provides advertising for numerous
unrelated Web sites. DoubleClick, Engage, and 24/7 Media, three of the
largest Internet advertising networks, all estimate that over half of
all online consumers have seen an ad that they delivered.\10\
In general, these network advertising companies do not merely
supply banner ads; they also gather data about the consumers who view
their ads. This is accomplished primarily by the use of ``cookies''
\11\ and ``Web bugs'' which track the individual's actions on the
Web.\12\ Among the types of information that can be collected by
network advertisers are: information on the Web sites and pages within
those sites visited by consumers; the time and duration of the visits;
query terms entered into search engines; purchases; ``click-through''
responses to advertisements;\13\ and the Web page a consumer came from
before landing on the site monitored by the particular ad network (the
referring page). All of this information is gathered even if the
consumer never clicks on a single ad.
The information gathered by network advertisers is often, but not
always, anonymous, i.e., the profiles are frequently linked to the
identification number of the advertising network's cookie on the
consumer's computer rather than the name of a specific person. This
data is generally referred to as non-personally identifiable
information (``non-PII''). In some circumstances, however, the profiles
derived from tracking consumers' activities on the Web are linked or
merged with personally identifiable information (``PII'').\14\ This
generally occurs in one of two ways when consumers identify themselves
to a Web site on which the network advertiser places banner ads.\15\
First, the Web site to whom personal information is provided may, in
turn, provide that information to the network advertiser. Second,
depending upon how the personal information is retrieved and processed
by the Web site, the personally identifying information may be
incorporated into a URL string \16\ that is automatically transmitted
to the network advertiser through its cookie.\17\
Once collected, consumer data can be analyzed and combined with
demographic and ``psychographic'' \18\ data from third-party sources,
data on the consumer's offline purchases, or information collected
directly from consumers through surveys and registration forms. This
enhanced data allows the advertising networks to make a variety of
inferences about each consumer's interests and preferences. The result
is a detailed profile that attempts to predict the individual
consumer's tastes, needs, and purchasing habits and enables the
advertising companies' computers to make splitsecond decisions about
how to deliver ads directly targeted to the consumer's specific
interests.
The profiles created by the advertising networks can be extremely
detailed. A cookie placed by a network advertising company can track a
consumer on any Web site served by that company, thereby allowing data
collection across disparate and unrelated sites on the Web. Also,
because the cookies used by ad networks are generally persistent, their
tracking occurs over an extended period of time, resuming each time the
individual logs on to the Internet. When this ``clickstream''
information is combined with third-party data, these profiles can
include hundreds of distinct data fields.\19\
Although network advertisers and their profiling activities are
nearly ubiquitous,\20\ they are most often invisible to consumers. All
that consumers see are the Web sites they visit; banner ads appear as a
seamless, integral part of the Web page on which they appear and
cookies are placed without any notice to consumers.\21\ Unless the Web
sites visited by consumers provide notice of the ad network's presence
and data collection, consumers may be totally unaware that their
activities online are being monitored.
B. An Illustration of How Network Profiling Works
Online consumer Joe Smith goes to a Web site that sells sporting
goods. He clicks on the page for golf bags. While there, he sees a
banner ad, which he ignores as it does not interest him. The ad was
placed by USAad Network. He then goes to a travel site and enters a
search on ``Hawaii.'' USAad Network also serves ads on this site, and
Joe sees an ad for rental cars there. Joe then visits an online
bookstore and browses through books about the world's best golf
courses. USAad Network serves ads there, as well. A week later, Joe
visits his favorite online news site, and notices an ad for golf
vacation packages in Hawaii. Delighted, he clicks on the ad, which was
served by the USAad Network. Later, Joe begins to wonder whether it was
a coincidence that this particular ad appeared and, if not, how it
happened.
At Joe's first stop on the Web, the sporting goods site, his
browser will automatically send certain information to the site that
the site needs in order to communicate with Joe's computer: his browser
type \22\ and operating system;\23\ the language(s) accepted by the
browser; and the computer's Internet address. The server hosting the
sporting goods site answers by transmitting the HTTP \24\ header and
HTML \25\ source code for the site's home page, which allows Joe's
computer to display the page.
Embedded in the HTML code that Joe's browser receives from the
sporting goods site is an invisible link to the USAad Network site
which delivers ads in the banner space on the sporting goods Web site.
Joe's browser is automatically triggered to send an HTTP request to
USAad which reveals the following information: his browser type and
operating system; the language(s) accepted by the browser; the address
of the referring Web page (in this case, the home page of the sporting
goods site); and the identification number and information stored in
any USAad cookies already on Joe's computer. Based on this information,
USAad will place an ad in the pre-set banner space on the sporting
goods site's home page. The ad will appear as an integral part of the
page. If an USAad cookie is not already present on Joe's computer,
USAad will place a cookie with a unique identifier on Joe's hard drive.
Unless he has set his browser to notify him before accepting cookies,
Joe has no way to know that a cookie is being placed on his
computer.\26\ When Joe clicks on the page for golf bags, the URL
address of that page, which discloses its content, is also transmitted
to USAad by its cookie.
When Joe leaves the sporting goods site and goes to the travel
site, also serviced by USAad, a similar process occurs. The HTML source
code for the travel site will contain an invisible link to USAad that
requests delivery of an ad as part of the travel site's page. Because
the request reveals that the referring site is travel related, USAad
sends an advertisement for rental cars. USAad will also know the
identification number of its cookie on Joe's machine. As Joe moves
around the travel site, USAad checks his cookie and modifies the
profile associated with it, adding elements based on Joe's activities.
When Joe enters a search for ``Hawaii,'' his search term is transmitted
to USAad through the URL used by the travel site to locate the
information Joe wants and the search term is associated with the other
data collected by the cookie on Joe's machine. USAad will also record
what advertisements it has shown Joe and whether he has clicked on
them.
This process is repeated when Joe goes to the online bookstore.
Because USAad serves banner ads on this site as well, it will recognize
Joe by his cookie identification number. USAad can track what books Joe
looks at, even though he does not buy anything. The fact that Joe
browsed for books about golf courses around the world is added to his
profile.
Based on Joe's activities, USAad infers that Joe is a golfer, that
he is interested in traveling to Hawaii someday, and that he might be
interested in a golf vacation. Thus, a week later, when Joe goes to his
favorite online news site, also served by USAad, the cookie on his
computer is recognized and he is presented with an ad for golf vacation
packages in Hawaii. The ad grabs his attention and appeals to his
interests, so he clicks on it.
III. Profiling Benefits and Privacy Concerns
A. Benefits
Cookies are used for many purposes other than profiling by third-
party advertisers, many of which significantly benefit consumers. For
example, Web sites often ask for user names and passwords when
purchases are made or before certain kinds of content are provided.
Cookies can store these names and passwords so that consumers do not
need to sign in each time they visit the site. In addition, many sites
allow consumers to set items aside in an electronic shopping cart while
they decide whether or not to purchase them; cookies allow a Web site
to remember what is in a consumer's shopping cart from prior visits.
Cookies also can be used by Web sites to offer personalized home pages
or other customized content with local news and weather, favorite stock
quotes, and other material of interest to individual consumers.
Individual online merchants can use cookies to track consumers'
purchases in order to offer recommendations about new products or sales
that may be of interest to their established customers. Finally, by
enabling businesses to monitor traffic on their Web sites, cookies
allow businesses to constantly revise the design and layout of their
sites to make them more interesting and efficient.\27\
Network advertisers' use of cookies and other technologies to
create targeted marketing programs also benefits both consumers and
businesses. As noted by commenters at the Public Workshop, targeted
advertising allows customers to receive offers and information about
goods and services in which they are actually interested.\28\ Targeted
advertising can also improve a consumer's Web experience simply by
ensuring that she is not repeatedly bombarded by the same ads.\29\
Businesses clearly benefit as well from the ability to target
advertising because they avoid wasting advertising dollars marketing
themselves to consumers who have no interest in their products.\30\
Additionally, a number of commenters stated that targeted
advertising helps to subsidize free content on the Internet. By making
advertising more effective, profiling allows Web sites to charge more
for advertising. This advertising revenue helps to subsidize their
operations, making it possible to offer free content rather than
charging fees for access.\31\
Finally, one commenter suggested that profiles can also be used to
create new products and services. First, entrepreneurs could use
consumer profiles to identify and assess the demand for particular
products or services. Second, targeted advertising could help small
companies to more effectively break into the market by advertising only
to consumers who have an interest in their products or services.\32\
In sum, targeted advertising can provide numerous benefits to both
business and consumers.
B. Concerns
Despite the benefits of targeted advertising, there is widespread
concern about current profiling practices.\33\ Many commenters at the
Workshop objected to network advertisers' hidden monitoring of
consumers and collection of extensive personal data without consumers'
knowledge or consent; they also noted that network advertisers offer
consumers few, if any, choices about the use and dissemination of their
individual information obtained in this manner. As one of the
commenters put it, current profiling practices ``undermine[]
individuals' expectations of privacy by fundamentally changing the Web
experience from one where consumers can browse and seek out information
anonymously, to one where an individual's every move is recorded.''
\34\
The most consistent and significant concern expressed about
profiling is that it is conducted without consumers' knowledge.\35\ The
presence and identity of a network advertiser on a particular site, the
placement of a cookie on the consumer's computer, the tracking of the
consumer's movements, and the targeting of ads are simply invisible in
most cases. This is true because, as a practical matter, there are only
two ways for consumers to find out about profiling at a particular site
before it occurs.\36\ The first is for Web sites that use the services
of network advertisers to disclose that fact in their privacy policies.
Unfortunately, this does not typically occur. As the Commission's
recent privacy survey discovered, although 57% of a random sample of
the busiest Web sites allowed third parties to place cookies, only 22%
of those sites mentioned third-party cookies or data collection in
their privacy policies; of the top 100 sites on the Web, 78% allowed
third-party cookie placement, but only 51% of those sites disclosed
that fact.\37\ The second way for consumers to detect profiling is to
configure their browsers to notify them before accepting cookies.\38\
One recent survey indicates, however, that only 40% of computer users
have even heard of cookies and, of those, only 75% have a basic
understanding of what they are.\39\
The second most persistent concern expressed by commenters was the
extensive and sustained scope of the monitoring that occurs.
Unbeknownst to most consumers, advertising networks monitor individuals
across a multitude of seemingly unrelated Web sites and over an
indefinite period of time. The result is a profile far more
comprehensive than any individual Web site could gather. Although much
of the information that goes into a profile is fairly innocuous when
viewed in isolation, the cumulation over time of vast numbers of
seemingly minor details about an individual produces a portrait that is
quite comprehensive and, to many, inherently intrusive.\40\
For many of those who expressed concerns about profiling, the
privacy implications of profiling are not ameliorated in cases where
the profile contains no personally identifiable information.\41\ First,
these commenters felt that the comprehensive nature of the profiles and
the technology used to create them make it reasonably easy to associate
previously anonymous profiles with particular individuals.\42\ This
means that anyone who obtains access to ostensibly anonymous data--
either by purchasing the data or hacking into it--might be able to mine
the data and link it to identifiable individuals. Second, commenters
feared that companies could unilaterally change their operating
procedures and begin associating personally identifiable information
with non-personally identifiable data previously collected.\43\ Third,
commenters noted that, regardless of whether they contain personally
identifiable information, profiles are used to make decisions about the
information individuals see and the offers they receive. These
commenters expressed concern that companies could use profiles to
determine the prices and terms upon which goods and services, including
important services like life insurance, are offered to individuals (for
example, products might be offered at higher prices to consumers whose
profiles indicate that they are wealthy, or insurance might be offered
at higher prices to consumers whose profiles indicate possible health
risks).\44\ This practice, known as ``weblining,'' raises many of the
same concerns that ``redlining'' and ``reverse redlining'' do in
offline financial markets.\45\
Another concern expressed by commenters is that, as consumers begin
to learn more about companies' monitoring activities, fear of online
monitoring will discourage valuable uses of the Internet that are
fostered by its perceived anonymity. As one commenter noted:
The anonymity that the Internet affords individuals has made it
an incredible resource for those seeking out information.
Particularly where the information sought is on controversial
topics such as sex, sexuality, or health issues such as HIV,
depression, and abortion; [sic] the ability to access
information without risking identification has been
critical.\46\
Indeed, in support of this point, this commenter cites studies that it
believes suggest that, in both the online and offline world, the
perceived anonymity of computer research facilitates access to these
kinds of sensitive information.\47\ By chilling use of the Internet for
such inquiries, several commenters asserted, profiling may ultimately
prevent access to important kinds of information.\48\
Finally, some commenters expressed the opinion that targeted
advertising is inherently unfair and deceptive. They argued that
targeted advertising is manipulative and preys on consumers' weaknesses
to create consumer demand that otherwise would not exist, and that, as
a result, targeted advertising undermines consumers' autonomy.\49\
Recent consumer surveys indicate that consumers are troubled by the
monitoring of their online activities. First, as a general matter,
surveys consistently show that Americans are worried about online
privacy. Ninety-two percent say they are concerned about threats to
their personal privacy when they use the Internet and seventy-two
percent say they are very concerned.\50\ Eighty percent of Americans
believe that consumers have lost all control over how personal
information is collected and used by companies.\51\
In particular, surveys show that consumers are not comfortable with
profiling. A Business Week survey conducted in March of this year found
that 89% of consumers are not comfortable having their browsing habits
and shopping patterns merged into a profile that is linked to their
real name and identity.\52\ If that profile also includes additional
personal information such as income, driver's license, credit data and
medical status, 95% of consumers express discomfort.\53\ Consistent
with the comments received in connection with the Public Workshop,
consumers are also opposed to profiling even when data are not
personally identifiable: sixty-three percent of consumers say they are
not comfortable having their online movements tracked even if the data
is not linked to their name or real-world identity.\54\ An overwhelming
91% of consumers say that they are not comfortable with Web sites
sharing information so that they can be tracked across multiple Web
sites.\55\
Many consumers indicate that their concerns about the collection of
personal information for online profiling would be diminished if they
were given clear notice of what data would be collected about them and
what it would be used for, and were given a choice to opt-out of data
collection or of particular uses of their personal data. A recent
survey by Privacy & American Business explained to Internet users that,
in order to offer consumers personalized advertising, companies would
need information about the consumer.\56\ Internet users were then asked
about their willingness to provide that information by: (1) describing
their interests; (2) allowing the use of information on their Web site
visits; (3) allowing the use of information on their Internet
purchases; (4) allowing the use of information on their offline
purchases; and (5) allowing the combination of online and offline
purchasing information. When told that the company providing tailored
ads would spell out how they would use the consumer's information and
the consumer would be given a chance to opt-out of any uses that he did
not approve, a majority of consumers indicated willingness to provide
personal information. With notice and choice, 68% were willing to
describe their interests; 58% were willing to allow site visit data to
be used; 51% were willing to allow use of online purchasing
information; 53% were willing to allow use of offline purchasing data;
and 52% were willing to allow the use of combined online and offline
purchasing information.\57\
Although this survey indicates that, with appropriate notice and
choice, many consumers would be willing to allow companies to use their
personal information in order to deliver advertising targeted to the
consumer's individual needs and interests, the statistics also
demonstrate that many consumers are not willing to allow this kind of
profiling regardless of whether notice and choice are given. A
substantial minority of Internet users--between 32% and 49%--indicated
that they would not be willing to participate in personalization
programs even if they were told what would be done with their
information and were given the choice to opt-out of uses that they did
not approve.\58\
Internet users are also overwhelmingly opposed to the wholesale
dissemination of their personal information. Ninety-two percent say
that they are not comfortable with Web sites sharing their personal
information with other organizations and 93% are uncomfortable with
their information being sold.\59\ Eighty-eight percent of consumers say
they would like a Web site to ask their permission every time it wants
to share their personal information with others.\60\
Ultimately, consumers' privacy concerns are businesses' concerns;
the electronic marketplace will not reach its full potential unless
consumers become more comfortable browsing and purchasing online. That
comfort is unlikely to come unless consumers are confident (1) that
they are notified at the time and place information is collected who is
collecting information about them, what information is being collected,
and how it will be used and (2) that they can choose whether their
personal information is gathered, how it is used, and to whom it is
disseminated.\61\
IV. The FTC'S Role in Addressing Online Privacy Issues and Self-
Regulation
A. Legal Authority
The FTC's mission is to promote the efficient functioning of the
marketplace by protecting consumers from unfair or deceptive acts or
practices and to increase consumer choice by promoting vigorous
competition. The Commission's primary legislative mandate is to enforce
the Federal Trade Commission Act (``FTCA''), which prohibits unfair
methods of competition and unfair or deceptive acts or practices in or
affecting commerce.\62\ With the exception of certain industries and
activities, the FTCA provides the Commission with broad investigative
and law enforcement authority over entities engaged in or whose
business affects commerce.\63\ Commerce on the Internet falls within
the scope of this statutory mandate.
B. Online Privacy
As noted in Section III.B., the online collection and use of
consumers' information, including the tracking of individual browsing
habits, raise significant concerns for many consumers. These concerns
are not new; since 1997, surveys have consistently demonstrated
consumer unease with data collection practices in the online
marketplace.\64\ The Commission has responded to these concerns with a
series of workshops and reports focusing on a variety of privacy
issues, including the collection of personal information from children,
self-regulatory efforts and technological developments to enhance
consumer privacy, consumer and business education efforts, and the role
of government in protecting online privacy.\65\ The Commission's
longstanding goal has been to understand this new marketplace and its
information practices and to assess its cost and beneficial effects. It
has also used its law enforcement authority to challenge Web sites with
deceptive privacy policy statements.\66\
In its 1998 report, Privacy Online: A Report to Congress, the
Commission summarized widely-accepted principles regarding the
collection, use, and dissemination of personal information.\67\ These
fair information practice principles, which predate the online medium,
have been recognized and developed by government agencies in the United
States, Canada, and Europe since 1973, when the United States
Department of Health, Education, and Welfare released its seminal
report on privacy protections in the age of data collection, Records,
Computers, and the Rights of Citizens.\68\ The 1998 Report identified
the core principles of privacy protection common to the government
reports, guidelines, and model codes that had emerged as of that time:
(1) Notice--data collectors must disclose their information
practices before collecting personal information from
consumers;\69\
(2) Choice--consumers must be given options with respect to
whether and how personal information collected from them may be
used for purposes beyond those for which the information was
provided;\70\
(3) Access--consumers should be able to view and contest the
accuracy and completeness of data collected about them;\71\ and
(4) Security--data collectors must take reasonable steps to
assure that information collected from consumers is accurate
and secure from unauthorized use.\72\
It also identified Enforcement--the use of a reliable mechanism to
impose sanctions for noncompliance with these fair information
practices--as a critical ingredient in any governmental or self-
regulatory program to ensure privacy online.\73\
The 1998 Report assessed the information practices of commercial
Web sites and the existing self-regulatory efforts in light of these
fair information practice principles and concluded that an effective
self-regulatory system had not yet taken hold.\74\ The Commission
deferred judgment on the need for legislation to protect the online
privacy of consumers generally, and instead urged industry to focus on
the development of broad-based and effective self-regulatory
programs.\75\ One year later, the Commission issued a second report,
Self-Regulation and Online Privacy: A Report to Congress (``1999
Report'').\76\ In the 1999 Report, a majority of the Commission again
recommended that self-regulation be given more time, but called for
further industry efforts to implement the fair information
practices.\77\ The Commission also outlined plans for future Commission
actions to encourage greater implementation of online privacy
protections, including the public workshop on online profiling.\78\ In
its 2000 Report, a majority of the Commission concluded that, despite
its significant work in developing self-regulatory initiatives,
industry efforts alone have been insufficient. Thus, the majority
recommended that Congress enact legislation to ensure consumer privacy
online.\79\
C. Online Profiling and Self Regulation: the NAI Effort
The November 8th workshop provided an opportunity for consumer
advocates, government, and industry members not only to educate the
public about the practice of online profiling, but to explore self-
regulation as a means of addressing the privacy concerns raised by this
practice. In the Spring of 1999, in anticipation of the Workshop,
network advertising companies were invited to meet with FTC and
Department of Commerce staff to discuss their business practices and
the possibility of self-regulation. As a result, industry members
announced at the Workshop the formation of the Network Advertising
Initiative (NAI), an organization comprised of the leading Internet
Network Advertisers--24/7 Media, AdForce, AdKnowledge, Avenue A, Burst!
Media, DoubleClick, Engage, and MatchLogic--to develop a framework for
self-regulation of the online profiling industry.
In announcing their intention to implement a self-regulatory
scheme, the NAI companies acknowledged that they face unique challenges
as a result of their indirect and invisible relationship with consumers
as they surf the Internet. The companies also discussed the fundamental
question of how fair information practices, including choice, should be
applied to the collection and use of data that is unique to a consumer
but is not necessarily personally identifiable, such as clickstream
data generated by the user's browsing activities and tied only to a
cookie identification number.\80\
Following the workshop, the NAI companies submitted working drafts
of self-regulatory principles for consideration by FTC and Department
of Commerce staff. Although efforts have been made to reach a consensus
on basic standards for applying fair information practices to the
business model used by the network advertisers, this process is not yet
complete. The Commission will supplement this report with specific
recommendations to Congress after it has an opportunity to fully
consider the self-regulatory proposals and how they interrelate with
the Commission's previous views and recommendations in the online
privacy area.
IV. Conclusion
The Commission is committed to the goal of ensuring privacy online
for consumers and will continue working to address the unique issues
presented by online profiling.
Endnotes
1. A transcript of the Workshop is available at and will be cited as ``Tr. [page],
[speaker].'' Public comments received in connection with the Workshop
can be viewed on the Federal Trade Commission's Web site at and will be cited as
``Comments of [organization or name] at [page].''
2. See FTC and Commerce Dept. to Hold Public Workshop on Online
Profiling, .
3. See 64 Fed. Reg. 50813, 50814 (1999) (also available at ).
4. Not all profiles are constructed by network advertising
companies (also known as online profilers). Some Web sites create
profiles of their own customers based on their interactions. Other
companies create profiles as part of a service--for example, offering
discounts on products of interest to consumers or providing references
to useful Web sites on the same topic as those already visited by the
consumer. See, e.g., Megan Barnett, The Profilers: Invisible Friends,
The Industry Standard, Mar. 13, 2000, at 220; Ben Hammer, Bargain
Hunting, The Industry Standard, Mar.13, 2000, at 232. These profiles
are generally created by companies that have a known, direct
relationship with the consumer, unlike third-party network advertising
companies, and are beyond the scope of this report.
5. See Federal Trade Commission, Privacy Online: A Report to
Congress (1998) [hereinafter ``1998 Report''] at 3. The Report is
available on the Commission's Web site at .
6. See Internet Advertising Bureau, Internet Advertising Revenues
Soar to $4.6 billion in 1999 (available at ).
7. See Jupiter Communications, Inc., Online Advertising Through
2003 (July 1999) (summary available at ).
8. In 1999, 56% of all online advertising revenue was attributable
to banner advertising. See Internet Advertising Bureau, Internet
Advertising Revenues Soar to $4.6 billion in 1999 (available at ).
9. DoubleClick, the largest network advertising company, estimates
that it serves an average of 1.5 billion ads each day, for an average
of approximately 45 billion ads per month. The next largest network
advertisers, Engage and 24/7 Media, serve approximately 8.6 billion
ads/month and 3.3 billion ads/month respectively. See DoubleClick DART
Now Serving on Average 1.5 Billion Ads Per Day, ; Engage
Reports Strong Growth in Key Metrics for Fiscal 2000 Second Quarter,
; 24/7 Media, Inc.,
.
10. See, e.g., ; ; .
11. A cookie is a small text file placed on a consumer's computer
hard drive by a Web server. The cookie transmits information back to
the server that placed it and, in general, can be read only by that
server. For more information on cookies, see, e.g., .
12. ``Web bugs'' are also known as ``clear GIFs'' or ``1-by-1
GIFs.'' Web bugs are tiny graphic image files embedded in a Web page,
generally the same color as the background on which they are displayed
which are invisible to the naked eye. The Web bug sends back to its
home server (which can belong to the host site, a network advertiser or
some other third party): the IP (Internet Protocol) address of the
computer that downloaded the page on which the bug appears; the URL
(Uniform Resource Locator) of the page on which the Web bug appears;
the URL of the Web bug image; the time the page containing the Web bug
was viewed; the type of browser that fetched the Web bug; and the
identification number of any cookie on the consumer's computer
previously placed by that server. Web bugs can be detected only by
looking at the source code of a Web page and searching in the code for
1-by-1 IMG tags that load images from a server different than the rest
of the Web page. At least one expert claims that, in addition to
disclosing who visits the particular Web page or reads the particular
e-mail in which the bug has been placed, in some circumstances, Web
bugs can also be used to place a cookie on a computer or to synchronize
a particular e-mail address with a cookie identification number, making
an otherwise anonymous profile personally identifiable. See generally
Comments of Richard M. Smith; see also Big Browser is Watching You!,
Consumer Reports, May 2000, at 46; USA Today, A new wrinkle in surfing
the Net: Dot-coms' mighty dotsize bugs track your every move, Mar. 21,
2000 (available at ).
13. When a consumer requests additional information about a product
or service by clicking on a banner ad, she has ``clicked through'' the
advertisement.
14. Personally identifiable data is data that can be linked to
specific individuals and includes, but is not limited to such
information as name, postal address, phone number, e-mail address,
social security number, and driver's license number.
15. A previously anonymous profile can also be linked to personally
identifiable information in other ways. For example, a network
advertising company could operate its own Web site at which consumers
are asked to provide personal information. When consumers do so, their
personal information could be linked to the identification number of
the cookie placed on their computer by that company, thereby making all
of the data collected through that cookie personally identifiable.
16. ``URL'' stands for Uniform Resource Locator.
17. This kind of data transmission occurs when Web sites use the
``GET'' (as opposed to ``POST'') method of processing data. See, e.g.,
Janlori Goldman, Zoe Hudson, and Richard M. Smith, California
HealthCare Foundation, Privacy: Report on the Privacy Policies and
Practices of Health Web Sites (Jan. 2000). It is not presently clear
how personally identifiable information sent to network advertisers in
a URL string as the result of ``GET'' technology is recognized, stored,
or utilized.
18. Psychographic data links objective demographic characteristics
like age and gender with more abstract characteristics related to
ideas, opinions and interests. Data mining specialists analyze
demographic, media, survey, purchasing and psychographic data to
determine the exact groups that are most likely to buy specific
products and services. See Comments of the Center for Democracy and
Technology (CDT) at 5 n.5. Psychographic profiling is also referred to
in the industry as ``behavioral profiling.''
19. For example, the Web site for Engage states repeatedly that its
profiles contain 800 ``interest categories.'' See, e.g., .
20. DoubleClick has approximately 100 million consumer profiles,
see Heather Green, Privacy: Outrage on the Web, Business Week, Feb 14,
2000, at 38; Engage has 52 million consumer profiles, see ; and 24/7 Media has 60
million profiles, see .
21. Most Internet browsers can be configured to notify users that a
cookie is being sent to their computer and to give users the option of
rejecting the cookie. The browsers' default setting, however, is to
permit placement of cookies without any notification.
22. For example, Netscape's Navigator or Microsoft's Internet
Explorer.
23. For example, Windows.
24. Hypertext Transfer Protocol (the protocol for communication
between Web browsers and Web servers).
25. Hypertext Markup Language (the code/language in which most Web
content is created).
26. Because many sites require users to accept cookies in order to
view their content, or make multiple attempts to place cookies before
displaying content, the notification process may unacceptably frustrate
consumers' ability to surf the Web efficiently.
27. The privacy issues raised by these uses of cookies are beyond
the scope of this report. Data reflecting the use of cookies are
reported in the FTC's recent report Privacy Online: Fair Information
Practices in the Electronic Marketplace (May 2000) [hereinafter ``2000
Report''], available at The Commission's vote to issue the 2000 Report was 3-
2, with Commissioner Swindle dissenting and Commissioner Leary
concurring in part and dissenting in part.
28. See, e.g., Comments of the Magazine Publishers of America (MPA)
at 1; Comments of the Direct Marketing Association (DMA) at 2; Comments
of the Association of National Advertisers (ANA) at 2; Tr. 30, Smith;
Tr. 120, Jaffe.
29. See, e.g., Comments of the Magazine Publishers of America (MPA)
at 1.
30. See, e.g., Comments of the Association of National Advertisers
(ANA) at 2.
31. See, e.g., Comments of the Magazine Publishers of America (MPA)
at 1; Comments of Solveig Singleton at 3-4; Tr. 20, Jaye; Tr. 124,
Aronson.
32. See Comments of Solveig Singleton at 4-5.
33. Survey data is an important component in the Commission's
evaluation of consumer concerns, as is actual consumer behavior.
Nonetheless, the Commission recognizes that the interpretation of
survey results is complex and must be undertaken with care.
34. See Comments of the Center for Democracy and Technology (CDT)
at 3.
35. See, e.g., Comments of the Center for Democracy and Technology
(CDT) at 2, 16; Reply Comments of the Electronic Information Privacy
Center (EPIC) at 1; Comments of TRUSTe at 2; Tr. 113, Mulligan.
36. It is possible for consumers to learn about profiling after the
fact by examining the cookie files on their hard drive; the text of a
cookie will disclose the server that placed the cookie. Consumers can
also delete the cookie files stored on their computers. Deletion will
not erase any information stored by a network advertising company, but
it will prevent future Web activity from being associated with past
activity through the identification number of the deleted cookie.
37. For purposes of the FTC's survey, third parties were defined as
any domain other than the one survey participants were currently
visiting, but the majority of the third-party cookies were in fact from
network advertising companies that engage in profiling. The full
results of the FTC study, as well as a description of its methodology,
were released in the Commission's 2000 Report.
38. Even for consumers who are aware of cookies, it is often
difficult to discern how to change a browser's settings in order to
receive notification of cookies. For example, in Netscape Navigator, a
user must click on the ``Edit'' menu and select ``Preferences'' from
the dropdown menu; select ``Advanced'' under the listing of categories;
and click on a check-off box to activate the notification feature. In
Internet Explorer 5.0, the user must click on the ``Tools'' menu and
select ``Internet Options'' from the dropdown menu; click on the tab
for ``Security'' options; click on ``Custom Level''; then scroll down
to the choices for cookies and select ``Prompt.''
39. See Business Week Online, Business Week/Harris Poll: A Growing
Threat, www.businessweek.com/2000/00_12/b3673010.htm (March 20, 2000)
[hereinafter ``Business Week/Harris Poll''].
40. See, e.g., Comments of the Center for Democracy and Technology
(CDT) at 2; Reply Comments of Electronic Information Privacy Center
(EPIC) at 1-2. One commenter also worried that the existence of
detailed personal profiles may facilitate an increase in identity
theft. See Rebuttal Comments of the Electronic Frontier Foundation
(EFF) at 4.
41. See, e.g., Comments of the Center for Democracy and Technology
(CDT) at 2-3; Tr. 112, Steele; Tr. 128, Smith.
42. See, e.g., Rebuttal Comments of the Electronic Frontier
Foundation (EFF) at 2; Tr. 40-1, Catlett; Tr. 54, Smith; Tr. 62,
Weitzner.
43. See Comments of the Center for Democracy and Technology (CDT)
at 2-3; Christopher K. Ridder (Nov. 30, 1999) at 6 (listing examples of
sites whose privacy policies explicitly reserve the right of the site
to change privacy policies without notice to the consumer); Tr. 158,
Mulligan.
44. See Comments of the Center for Democracy and Technology (CDT)
at 3; Comments of the Electronic Frontier Foundation (EFF) Session II
at 2; Rebuttal Comments of the Electronic Frontier Foundation (EFF) at
4; Tr. 81, Feena; Tr. 114, Hill; Tr. 146-7, Steele; see also John
Simons, The Coming Privacy Divide, The Standard, Feb. 21, 2000, .
45. See, e.g., Rebuttal Comments of the Electronic Frontier
Foundation (EFF) at 4 (expressing concern about ``electronic
redlining''); Tr. 81, Feena (describing technology's potential use for
``redlining'' [sic]); Tr. 146-7, Steele (describing risk of
``electronic redlining and price discrimination''); see also Marcia
Stepanek, Weblining: Companies are using your personal data to limit
your choices--and force you to pay more for products, Business Week
Online, Apr. 3, 2000, . ``Redlining'' and ``reverse redlining'' are,
respectively, the practice of some financial institutions to not extend
credit or to offer less favorable credit terms to prospecitve borrowers
in predominantly minority areas.
46. Comments of the Center for Democracy and Technology (CDT) at
19; see also Rebuttal Comments of the Electronic Frontier Foundation
(EFF) at 4-5; Reply Comments of the Electronic Information Privacy
Center (EPIC) at 2.
47. See Comments of the Center for Democracy and Technology (CDT)
at 19.
48. See Comments of the Center for Democracy and Technology (CDT)
at 19; Rebuttal Comments of the Electronic Frontier Foundation (EFF) at
4-5; Reply Comments of the Electronic Information Privacy Center (EPIC)
at 2.
49. See, e.g., Comments of Robert Ellis Smith; Tr. 56-7, Catlett;
Tr. 122, 148, Chester; Tr. 129-30, Smith.
50. See Louis Harris & Assoc., IBM Multi-National Consumer Privacy
Survey (1999) [hereinafter ``IBM Privacy Survey''], at 81.
51. See IBM Privacy Survey, at 76.
52. Business Week/Harris Poll.
53. Business Week/Harris Poll.
54. Business Week/Harris Poll.
55. Business Week/Harris Poll.
56. See Alan F. Westin, Privacy and American Business, Personalized
Marketing and Privacy on the Internet: What Consumers Want (1999)
[hereinafter ``Westin/PAB 1999''] at 8-9.
57. Westin/PAB 1999 at 8-9.
58. Westin/PAB 1999 at 11. Consumers also want access to and
control over their personal information. Eighty-three percent of
Internet users say that it is important that companies engaged in
tailored advertising programs allow participants to see their
individual profiles and remove items that they do not want included;
seventy percent felt that this was absolutely vital or very important.
Id.
59. Business Week/Harris Poll.
60. Business Week/Harris Poll.
61. There may be complicated issues regarding the consequences of
choice, such as the extent to which consumers may exchange use of their
data for benefits.
62. See 15 U.S.C. Sec. 45(a).
63. The Commission also has responsibility under 45 additional
statutes governing specific industries and practices. These include,
for example, the Truth in Lending Act, 15 U.S.C. Sec. Sec. 1601 et
seq., which mandates disclosures of credit terms, and the Fair Credit
Billing Act, 15 U.S.C. Sec. Sec. 1666 et seq., which provides for the
correction of billing errors on credit accounts. The Commission also
enforces over 30 rules governing specific industries and practices,
e.g., the Used Car Rule, 16 C.F.R. Part 455, which requires used car
dealers to disclose warranty terms via a window sticker; the Franchise
Rule, 16 C.F.R. Part 436, which requires the provision of information
to prospective franchisees; the Telemarketing Sales Rule, 16 C.F.R.
Part 310, which defines and prohibits deceptive telemarketing practices
and other abusive telemarketing practices; and the Children's Online
Privacy Protection Rule, 16 C.F.R. Part 312.
In addition, on May 12, 2000, the Commission issued a final rule
implementing the privacy provisions of the Gramm-Leach-Bliley Act, 15
U.S.C. Sec. Sec. 6801 et seq. The rule requires a wide range of
financial institutions to provide notice to their customers about their
privacy policies and practices. The rule also describes the conditions
under which those financial institutions may disclose personal
financial information about consumers to nonaffiliated third parties,
and provides a method by which consumers can prevent financial
institutions from sharing their personal financial information with
nonaffiliated third parties by opting out of that disclosure, subject
to certain exceptions. The rule is available on the Commission's Web
site at ); Liberty Financial Cos., Docket No.C-3891 (Final
Order, Aug. 12, 1999) (available at ); GeoCities, Docket No. C
-3849 (Final Order, Feb. 5, 1999) (available at ).
67. 1998 Report at 7-14. See also 1996 Staff Report at 8-12,
available at
(summarizing participants' testimony on fair information practices).
68. 1998 Report at 7-11. In addition to the HEW Report, the major
reports setting forth the core fair information practice principles
are: The U.S. Privacy Protection Study Commission, Personal Privacy in
an Information Society (1977); Organization for Economic Cooperation
and Development, OECD Guidelines on the Protection of Privacy and
Transborder Flows of Personal Data (1980); U.S. Information
Infrastructure Task Force, Information Policy Committee, Privacy
Working Group, Privacy and the National Information Infrastructure:
Principles for Providing and Using Personal Information (1995); U.S.
Dept. of Commerce, Privacy and the NII: Safeguarding
Telecommunications-Related Personal Information (1995); The European
Union Directive on the Protection of Personal Data (1995); and the
Canadian Standards Association, Model Code for the Protection of
Personal Information: A National Standard of Canada (1996).
69. 1998 Report at 7-8; see also 1999 Report at 3-4; 2000 Report at
4.
70. 1998 Report at 8-9; see also 1999 Report at 3-4; 2000 Report at
4.
71. 1998 Report at 9; see also 1999 Report at 3-4; 2000 Report at
4.
72. 1998 Report at 10; see also 1999 Report at 3-4; 2000 Report at
4.
73. 1998 Report at 10-11; see also 1999 Report at 3-4; 2000 Report
at 4.
74. See 1998 Report at 41. In addition, the Commission recommended
that Congress adopt legislation setting forth standards for the online
collection of personal information from children; and indeed, just four
months after the 1998 Report was issued, Congress enacted the
Children's Online Privacy Protection Act of 1998 (``COPPA''). On
October 21, 1999, the Commission issued the Children's Online Privacy
Protection Rule, which implements the Act's fair information practices
standards for commercial Web sites directed to children under 13, or
who knowingly collect personal information from children under 13. The
Rule became effective on April 21, 2000.
75. See 1998 Report at 41-42.
76. See 1999 Report.
77. The 1999 Report was issued by a vote of 3-1, with Commissioner
Anthony concurring in part and dissenting in part.
78. See 1999 Report at 13-14. Other actions contemplated by the
Commission included the establishment of an advisory committee of
industry representatives and privacy and consumer advocates to develop
strategies to implement the fair information practices of access and
security and to assess the costs and benefits of those strategies. The
Advisory Committee on Online Access and Security was established in
December 1999 and its final report was released as an appendix to the
Commission's 2000 Report.
79. See supra at n.27; 2000 Report at 34-38. The 2000 Report did
not discuss and its legislative proposal does not address the unique
issues raised by online profiling.
80. Tr. 186, Jaye; Tr. 192-193, Zinman.
______
Statement of Commissioner Orson Swindle Concurring in Part and
Dissenting in Part in Online Profiling: A Report to Congress
File No. P994809
I concur in the issuance of ``Online Profiling: A Report to
Congress,'' but I dissent from the use of consumer opinion surveys in
the Report.
Consumer opinion surveys like the ones used in the Report are often
not reliable predictors of consumer behavior. For several reasons, and
as this Report acknowledges in footnote 33, survey results should be
examined with scrupulous care. Surveys are one-time snapshots of
consumer opinion, are easily biased by design, and must be examined for
methodological integrity.
Ideally, consumer opinion surveys should complement, but not be a
substitute for, empirical evidence of consumer behavior relating to
privacy. Consumer opinion surveys should not serve as a substantive
basis for policy decisions.
The Chairman. Thank you very much and thank you for a very
interesting, illuminating presentation.
I would like to talk for a minute about these discussions
you are having with the online advertisers. Is not a
fundamental question here opt-in or opt-out?
Ms. Bernstein. That would be a fundamental question and it
could be--or there are those who would say that, depending on
what the purpose is, it could be--one or the other, and it
might depend on the type of information that is being
collected.
The Chairman. Would that not get a little complicated
pretty quick?
Ms. Bernstein. It could get very complicated. We hope not,
because obviously it needs to be simple in order to be useful
to consumers.
The Chairman. Well, we conduct these hearings on the
basis--on the premise--that there is no such thing as a dumb
question, Okay?
It seems to me that the decision made by the consumer as to
whether they want out of one of those files is one thing. It is
an entirely different scenario if these people have to come to
me and say, we would like for you to give your positive,
affirmative permission to use your information or track your
habits.
So is this not a fundamental question here?
Ms. Bernstein. Yes, it is.
The Chairman. Mr. Medine, you want to comment?
Mr. Medine. Well, these discussions are trying to address
this issue, but of course the discussions are under way, and
obviously the Committee's views on what the proper balance is
in this area would be extremely helpful in informing us as the
discussions go forward as to whether consumers should be asked
if they want to participate in this process or should simply be
told of their ability to not participate in this process.
The Chairman. Well, do you have a view on that, Ms.
Bernstein?
Ms. Bernstein. The Commission has not taken a position on
that yet, as you know, Mr. Chairman. And in view of the fact
that we are still engaged in trying to do two things--one is to
see if we can complete an effective self-regulatory program--I
think we would be, as David said, we could be of the view that
in order for a cookie to be placed in the first instance an
affirmative consent by a consumer would be useful. Principally,
one wants to put the consumer in the position of being in
control of how his information is used.
The Chairman. Well, it just seems to me that the
advertisers would argue strenuously for an opt-out option.
Ms. Bernstein. They have and I am sure that they would
continue to.
The Chairman. What we just saw is relatively innocuous. I
believe that--I hope that every American would know of a
golfing vacation package in Tucson.
[Laughter.]
Senator Bryan. And want to go there.
The Chairman. Bypassing Nevada on the way.
[Laughter.]
Senator Bryan. And stopping there on the way back.
Senator Wyden. But still finding their way to the Oregon
coast.
Ms. Bernstein. We will try to accommodate every Senator on
this Committee.
The Chairman. Let us hear from you or Mr. Medine about the
less attractive aspects of this. Your presentation is
excellent, but, frankly, if that was the only problem we have
here, I do not think we would be having these hearings. Let us
talk about the really invasive, intrusive aspects of this kind
of procedure.
Ms. Bernstein. I will be happy to do that. One of the
things that is clear from the presentation that we decided to
use as an illustration is that so far the information is not
personal. It is only connected to the consumer's computer. That
is, it does not say John McCain asked for this information, but
rather it is connected to John McCain's computer.
That information, however, is capable of being combined
with personal information about that person.
The Chairman. For example?
Ms. Bernstein. By use of another database or combining it
with prior information, or sometimes the website itself.
The Chairman. For example, what kind of personal
information? How much money I have in a bank account, or my
credit rating?
Ms. Bernstein. Well, it could be your name, your address,
perhaps your telephone number. From that information, sometimes
more sensitive information can be obtained from another source.
So there is the capability to put together a really very
complete information profile about a consumer.
The Chairman. Do you want to add to that, Mr. Medine?
Mr. Medine. Yes. In addition to that, the consumer may
visit a website that might reveal sensitive items, like certain
health conditions or religious or political affiliations that
might be linked to somebody's name. There is also the
capability of making identifiable months or even years of web
browsing that you had thought were anonymous that could then
become identified to you. There have certainly been instances
publicly where people have been associated with past browsing
that has made them uncomfortable.
There is also the issue of merging online and offline data
as well. That is, you think your shopping online is one thing,
your shopping offline or your habits offline are different, but
to have them merged raises special concerns as well.
So this is the most innocuous of non-personally
identifiable information used to target a relatively simple ad.
But clearly there is the capability of gathering personal and
sensitive information through this process.
Ms. Bernstein. That is really where the intrusiveness comes
about and why so many people are expressing concerns about it.
In addition, it is really secret. People do not know this is
going on, and that I think is the most--most people react very
negatively to the fact that there is----
The Chairman. How do you let them know that it is going on?
Ms. Bernstein. Well, you could let them know by various
notices that could be either on the website or that would be
required to be on website where it begins in the first
instance, and then you could have a subsequent notice in the
site itself so that the consumer knew that that was going on.
But it would be fundamental notice that does not now occur.
The Chairman. Could you have something that would flash
that said ``Information is being transmitted concerning your
visit to this website; do you object?''
Ms. Bernstein. You could have that, certainly.
The Chairman. Well, I guess that question is also something
for the next panel.
Finally, I guess if you could carry it to its extreme, for
someone who is a very heavy user of the Internet, you could
compile information which would over time give someone a
dossier compiled of your political, religious, financial
information--literally everything about your life. Is that your
view, Mr. Medine?
Mr. Medine. That is certainly a potential here when you are
web browsing, which many people think of as being anonymous and
they appreciate being anonymous so that they can freely move
around, gather information, and it may no longer be anonymous
if an identifiable cookie is placed on your computer.
The Chairman. Finally, what is your degree of optimism
about reaching some kind of a deal with the online advertising
industry?
Ms. Bernstein. We have had good talks with them and I think
they are very anxious to put an effective self-regulatory
program in place. As the Commission said in its earlier
testimony, Mr. Chairman, the Commission did not view a self-
regulatory program in isolation, but rather expressed its view
that the most effective program is a self-regulatory program
that is supported or buttressed by a fundamental law that would
support the program.
I would say it is about--oh, we could flip a coin, but
better than half and half. How is that?
The Chairman. Well, let me just say that we obviously would
like to see an agreement that is acceptable to one and all. You
have heard views, strong views, expressed by both Senator Burns
and Senator Wyden that legislation is necessary. So if you do
reach an agreement, I think you are going to have a selling job
at least with some members of the Committee as well as other
members of Congress.
I thank you for being here today.
Senator Hollings.
Senator Hollings. Well, Ms. Bernstein, we only said that
legislation was necessary after five years of the Federal Trade
Commission working on it. The FTC put out reports and reviews
that suggested the voluntary approach was the proper approach.
Having done that for over five years, Mr. Pitofsky, your
Chairman, came here and testified that he thought that
legislation was necessary. That is correct; is that not right?
Ms. Bernstein. Yes, it is absolutely correct.
Senator Hollings. I mean, do not have the Federal Trade
Commission be a moving target. What we are trying to do is
maintain the integrity of the Internet so that people can trust
it. We are at the same starting line. We are going to have to
have some kind of regulation, I take it, for those who make a
business of collecting personally identifiable privacy
information.
Do you agree with me on that?
Ms. Bernstein. Yes, I do agree with you.
Senator Hollings. When we drew the bill, we looked at the
recommendations in the five-year consideration of the Federal
Trade Commission. We said that for anonymous information, like
you are taking a census, we wouldn't talk about opting in
there. We are only talking about opting out. If people are
making a business out of this, then they can collect any kind
of personal information on Senator McCain or me. Anybody in the
audience can collect the information and know it and understand
it.
Once they start making a commercial enterprise or business
out of the thing, then we say, now hold up, you owe a duty to
the public. If we do not do that, then people are going to be
fearful of using the Internet. The trust that we have and the
participation that we have won't continue. We want to continue
Internet participation.
Now, only after five years did we really start with a bill.
You toyed with it for five years and we see only the
frustration, having toyed with it and not getting a voluntary
response. You are not going to get advertisers. You have always
got that group that won't be fair. I go to a class where the
teacher grades on a curve and 95 percent of the students are
honest and they study and they are ready to take the exam. The
honest 95 percent finds out that 5 percent of the class has
already stolen the exam. I say, wait a minute, I better get a
copy of the exam, too.
That sort of breaks the discipline and the voluntariness
and everything. We have tried that for five years, and you are
not going to get it voluntarily. You are going to have certain
advertisers who are going to use every scheme there is to get
around and make money out of it.
Otherwise, we have got these states attorneys general all
moving for different kinds of rules, regulations, and laws. We
find that the longer we delay the greater the chaos and the
greater the difficulty there is to legislate.
When the Federal Trade Commission appeared before the
Committee, we asked each one of the Commissioners to critique
our bill. Do you know where they are on it? I am welcome to
criticism. I do not get any award for a bill. People back in
South Carolina could care less whether I put it in. They do not
even know I am up here hardly. The state has gone Republican; I
am having a hard time. The best thing I can do is tell them I
am a friend of John McCain and we get along.
[Laughter.]
So I do not have to have a bill. But I can see and ten
others have seen. We have tried to look at all the features,
rather than hit and run driving politically. I have got a bill
in on privacy, so tell them to study it further and hope they
voluntarily respond.
We are five years into the real study of it, and we have
got the states all moving to laws. So it begs the question now
that the federal government here in Washington move and get
some orderly measure.
So we do not discourage your moving with advertisers, but
if we wait on that we will never get a law. We will never get
what you finally say. Even if you got the voluntary agreement,
you would still have to have a law for some kind of
enforcement. Is that not correct?
Ms. Bernstein. I believe that is correct.
Senator Hollings. So we are going to pass some kind of law
on privacy for those who are trying to make a business out of
my identifiable personal information on the Internet.
You have answered the question, you said 50-50. Well, that
is a good answer, but----
Ms. Bernstein. I think I said better than 50-50, so I am a
little more optimistic than that.
Senator Hollings. Yes, but I mean, we cannot wait. You have
got to get 100 percent.
Ms. Bernstein. Yes.
Senator Hollings. When do you think you are going to get
100 percent agreement?
Ms. Bernstein. Well, we will either reach agreement or we
will--the Commission has to review this, obviously, and we are
still working at the staff level to see whether or not we have
a program that we think we could recommend enthusiastically to
the Commission. That should happen in a week or two.
Senator Hollings. Now, you identified someone in the
original instance as a ``guru.''
Ms. Bernstein. Yes.
Senator Hollings. What is his name?
Ms. Bernstein. Her name----
Senator Hollings. Her name, excuse me.
Ms. Bernstein [continuing]. Is Dawne, Dawne Holz, and she
is our technology guru who assisted us with putting this
program together, more than assisted us, even came up with some
of the names of sites and so forth so that we could do our
presentation. She works with this.
Senator Hollings. What we want to do here at the
Congressional level is pass something that is realistic. Let me
ask the guru, will you please take our bill and study it and
criticize what is unrealistic, what is too burdensome, what is
unenforceable? Any kind of criticism that you can give from
your experience, we would appreciate here at the Committee
level.
Take that bill for me and criticize it so that we can
correct it or not pass it or whatever it is, knock it out. I
would appreciate it.
Ms. Bernstein. Senator, each of the Commissioners I know is
at work preparing their own views, as you have asked.
Senator Hollings. But I want the guru.
Ms. Bernstein. Yes. Well, the guru will----
[Laughter.]
Senator Hollings. I want the guru. You know, sometimes the
Commissioners, they are political just like me. It is like sort
of delivering lettuce by way of a rabbit. The guru's ideas do
not come through. I want her ideas.
Ms. Bernstein. You have it, sir. You will have it.
Senator Hollings. Thank you very much. Thank you, Ms.
Bernstein.
The Chairman. Thank you, sir. Thank you for your kind
words.
Senator Wyden.
Senator Wyden. Thank you, Mr. Chairman.
Ms. Bernstein, if an agreement is reached on online
profiling, how could the profiling industry guarantee that all
of the profiling companies are going to participate?
Ms. Bernstein. They can guarantee it of all the companies
are signatories to the agreement. That leaves open, of course,
the issue of new entrants into the industry and whether they
could be bound. That is always a difficulty when one is dealing
with a self-regulatory program and it is probably one of the
underlying reasons why in the past self-regulatory programs
that have had an underlying legal structure have been the most
effective ones, because then everyone is bound even if there is
a new entrant.
Senator Wyden. What is troubling to me, and I think it is
what Senator Hollings is touching on, as well, is that you are
not likely to bring into the system of oversight the people who
most need to be monitored. I think my next question would be
who would enforce an action against a company that was
violating the agreement? Are profilers going to do this? Are
they going to run their own enforcement program? Are
advertising agencies, websites where banner ads are running
going to enforce this? Who is going to enforce this?
Ms. Bernstein. If they did not do what they have promised
to do in an agreement, a final agreement, the FTC could. The
FTC's underlying authority is to prevent deception and
therefore we could bring an enforcement action if they failed
to live up to their promises. So that is one method of
enforcement.
In addition, other groups have made arrangements for third
parties to audit their compliance with agreements, and if those
auditors turn up violations that could also be referred to the
FTC, as others have done.
Senator Wyden. So signatories can be brought before the
Federal Trade Commission. But, again, the people, frankly, that
I'm most concerned about are not the people who sit down and
work with you on these kinds of pieces of legislation. They're
the ones that operate in the shadows and certainly are engaged
in some practices that are far more serious than the one we saw
today involving golf.
Now, you identified four core principles for personal data,
that is what the FTC did, and that is why I tried to separate
out personal data from profiling, which is the area we are
looking at today. Now, with respect to personal data, the FTC
said it is important to deal with notice, choice, access, and
security.
What arguments would there be for not applying these
principles to data collected by online profilers?
Ms. Bernstein. There is none. In fact, the Commission's
report that was released today on online profile articulates
those same four fundamental elements of fair information
practices--notice, choice, access, and security--and
enforcement.
Senator Wyden. Now, you have been in the consumer
protection field an awfully long time. I happen to think you
give public service a good name because of the work that you
have done in consumer protection. I think I would like you to
outline whether there are any consumer laws now on the books
that significantly limit what online profilers could do with
respect to, say, medical and sensitive information?
Ms. Bernstein. In regard to medical and sensitive----
Senator Wyden. Let us just say, are there any laws on the
books today that limit in a significant way what online
profilers can do with important significant information?
Ms. Bernstein. There are some, but they are not
comprehensive and do not do what you are suggesting. But as you
know, the recent Financial Modernization Act (Gramm-Leach-
Bliley) did provide some protections for consumers for the
collection of financial information and, while we are not
expert in it, there has been some legislation in connection
with medical information that is being, I believe, worked in
the regulatory process from the Health and Human Services.
Those are the only ones that we know of.
Senator Wyden. But it does not exist today, and I think
that is the important point. I think both the questions asked
by Chairman McCain and by Senator Hollings are extremely
important. We all want to see the self-regulatory initiative
succeed and, from the very beginning, I have said they ought to
have a wide berth. But people who are not signatories to these
voluntary agreements, based on what you have just told us, as
of today those that are not and are not willing to try to
subscribe to strong consumer protection standards can do any
darn thing they want with respect to sensitive medical
information and online profiling.
I do not think that is right. I do want to give the private
sector a wide berth, but I think we do need to have enough
oversight and enough leverage on the part of government to be
able to proceed against those who would exploit and rip off the
citizens of this country with respect to sensitive medical
information and other areas. I think that is why we ought to be
trying on a bipartisan basis to put together a bill.
Mr. Chairman, I thank you.
The Chairman. Thank you.
Senator Bryan.
Senator Bryan. Thank you very much, Mr. Chairman.
Ms. Bernstein, let me continue where Senator Wyden left
off. Among those core values, notice it would seem to me is the
most fundamental and basic right that a consumer would have,
that is to be informed as to what is occurring with respect to
his activity or her activity. Is there objection to
establishing a legislative floor, to say at least there is a
requirement that you must provide notice if you are collecting
this kind of information? Is that something that is resisted by
the industry?
Ms. Bernstein. I do not believe so, and in fact the
Commission's legislative proposal that was discussed before
this Committee two weeks ago would require a website on which
there would be a third party operating to disclose that to a
consumer. So that was already contemplated in terms of the
notice requirement that the Commission was recommending.
Senator Bryan. I guess what I am saying, Ms. Bernstein,
does the industry agree with that? I know that was the proposal
that was advanced, but do they agree with that?
Ms. Bernstein. Yes, they do.
Senator Bryan. So we have an agreement that legislation
that provides one of those core values, that is notice, would
be appropriate?
Ms. Bernstein. Yes.
Senator Bryan. Okay, so at least we have crossed the
Rubicon on that issue. What are the sanctions that attach to
those companies that agree to a self-regulatory agreement if
one of the parties violate the terms of the agreement, in
general? Just do not do that again, or if you do that again we
are going to really get pretty upset with you, kind of the
Bobby Knight approach to regulation?
Ms. Bernstein. No, we do not agree with the Bobby Knight
approach. As I said before, the FTC has authority under its
deception authority to proceed to bring an action that would
force them to comply with the agreement and under some
circumstances we could seek penalties, as you know.
Senator Bryan. Would that be monetary fines of some kind,
Ms. Bernstein or Mr. Medine?
Mr. Medine. Well, there would be injunctions and possible
consumer redress if we could establish actual injury, and
certainly going forward actual fines or enforcement proceedings
if they fail to comply with an FTC order.
Senator Bryan. Just in general--you may have many options--
what would the maximum fine be? Suppose you have a signatory to
the agreement who has a habit or practice of consistently
violating the provision? This is not just, we goofed, we are
sorry, we are not going to do that again. What would be the
hammer that the FTC could bring down upon that violator?
Ms. Bernstein. Well, under existing law the penalties are
$11,000 a day per violation. So that could add up to a very
significant amount of money.
Senator Bryan. Indeed it could.
Now, with respect to those who are not participants to the
agreement, there are no penalties that would attach; am I
correct?
Ms. Bernstein. Under present circumstances, no. If they are
not signatories, they would not be subject unless they took
some other actions.
Senator Bryan. Are there other actions covered in the law?
Ms. Bernstein. Right.
Senator Bryan. Do you have any idea as to what percentage
of the universe out there would be willing to sign onto such a
self-regulatory agreement?
Ms. Bernstein. We have--there are about a dozen companies
and we believe that that represents about 90 percent of the
industry.
Senator Bryan. So we would still have 10 percent that would
be operating beyond the ambit of whatever agreement would be
entered into?
Ms. Bernstein. That is what we know at the present time,
and it is an estimate, Senator.
Senator Bryan. I appreciate that.
Ms. Bernstein. But it may be that it is greater than that.
Senator Bryan. Ms. Bernstein, you made the point that
currently, in the example that was cited, this was not
personally identifiable information.
Ms. Bernstein. Right.
Senator Bryan. You also made the point that it might be
possible, in response to the Chairman's inquiry, to in effect
combine a personally identifiable database with this and then
really put a great deal of information in it. Is there
currently any law that prohibits that?
Ms. Bernstein. No, there is not.
Senator Bryan. Let me be clear on that. So you are saying
that tomorrow, at the end of this hearing, if a determination
was made by any commercial website or one of these cookie
companies or however we would characterize them, it would be
possible for them to combine the personally identifiable
database with the non-personally identifiable information that
you provided there and that could be done without any violation
of the law at all?
Ms. Bernstein. That is correct, Senator.
Senator Bryan. Now, is there objection by the industry to
legislation that would say, you shall be prohibited from
combining those two types of database?
Ms. Bernstein. We have not discussed legislation with them,
Senator. That really has not been a part of our discussions to
date with them. Rather, we have been trying to work through a
self-regulatory program----
Senator Bryan. And I understand that. But would you not
agree that we have agreement essentially that there ought to be
a requirement in law of notice? Would it not be appropriate to
have legislation that says, look, you cannot combine those two
databases?
Ms. Bernstein. I will not be representing the views of the
Commission, so this makes it a little uncomfortable for me. And
I am not sure you want my personal views, but my personal views
are----
Senator Bryan. What would your personal view be? You have
done a great deal. We understand that for the record you have
made the disclaimer that you are not speaking on behalf of the
Commission.
Ms. Bernstein. Right.
Senator Bryan. And I am not trying to entrap you, Ms.
Bernstein.
Ms. Bernstein. I know you are not, sir.
Senator Bryan. But you are a witness with considerable
experience and a great deal of credibility, as my colleague
from Oregon pointed out.
Ms. Bernstein. It would seem to me that, unless there is at
a minimum an opt-in by consumers, that is if a company is ever
going to combine personal and non-personal information that the
consumer would have the opportunity to have a very full
disclosure of what was going to happen to them and a very firm
opportunity to say yes or no to that. And that would be at a
minimum.
Senator Bryan. Now, is there any technical reason that one
could not require an opt-in provision in terms of this whole
profiling issue that we are talking about? Is there any
technical reason, anything systematically that would prevent
that?
Ms. Bernstein. Not that I know of.
Senator Bryan. And my friend from South Carolina's guru
would agree with that statement, would she?
Ms. Bernstein. Guru, you agree with that?
Ms. Holz.
[Nods affirmatively.]
Ms. Bernstein. She agrees.
Senator Bryan. Guru indicates that----
Ms. Bernstein. Let the record show.
Senator Bryan. Let the record reflect that the guru agrees
with the witness.
Mr. Medine. Hearing no objection.
Senator Bryan. We thank the guru.
Finally, if I may, because I know there are many others
that want to comment on this, in terms of providing the
greatest measure of protection to the consumer would not the
opt-in, that is to say, look, before we are going to do this
profiling we need your prior permission. Does that not provide
the ultimate or best protection to the consumer?
Ms. Bernstein. I believe most people would agree that that
provides the greatest amount of protection or, put another way,
it allows the consumer the greatest control over their own
information; and that really is where the control should rest.
Senator Bryan. By and large, we are talking about the
consumer's personal information, activities, shopping habits,
or otherwise, of the individual. I know every one of my
colleagues fully understands that, but the opt-in requires the
prior consent. That is, none of this activity could occur
unless the consumer affirmatively agreed.
Ms. Bernstein. That is correct.
Senator Bryan. The opt-out permits the company to do so,
notify the consumer, and then the consumer can say, stop, I do
not want you to do that again; is that the essence of it?
Ms. Bernstein. Well, an opt-out could be that they could
not do it unless they gave the consumer notice of the
opportunity to not have it done. So it is just a slight
difference in the way I think you phrased it, Senator.
Senator Bryan. So would that mean, in effect, that silence
is acquiescence under what you have just said? In other words,
the consumer is notified, but you do not require his or her
affirmative consent, but if they take no action at all silence
is acquiescence?
Ms. Bernstein. Having given them the opportunity to opt
out, yes.
Senator Bryan. I appreciate that. Thank you very much to
our witnesses and thank you very much, Mr. Chairman.
The Chairman. Senator Burns.
Senator Burns. Thank you, Mr. Chairman.
I do not know what ground my colleagues have covered here,
but even though Senator Wyden and I have worked on a bill that
principally is an opt-out type of an approach, which I think is
the correct approach until somebody convinces me otherwise, I
am still concerned about enforcement. How do we know who the
bad actor is, or who takes unlawful information and either
markets it or it pops up somewhere else, and then there is no
paper trail or there is not anything to go back and see who
really was the first to misuse it? Because once the information
is out there in cyberspace, it just roams around out there and
it becomes the property of the guy that has got the biggest net
to catch it.
What kind of--what do you recommend as an enforcement
mechanism? How do we do that?
Ms. Bernstein. Well, one of the things that has worked
effectively in other areas we believe, Senator, is a third
party audit or a third party firm that will on a systematic
basis review what practices each of the sites are engaging in,
sample it, and find out whether or not the protections are
being provided.
You can also have consumers who are surfing the net. They
can also report, as they often do, to an enforcement mechanism
or, in the case of a law, to the FTC. We have a very, very good
way, I think, of collecting consumer complaints, and then a law
enforcement action can be brought. But that requires, of
course, what we have talked about previously, and that is
either a system where they have not done what they promised to
do in self-regulation or a legal structure that would permit
that kind of enforcement.
Senator Burns. Does that also pertain to the people who
collect information on consumers through any other mode other
than electronically? In other words, any place else than the
Internet? Every time I buy something that says:
congratulations, you bought this great new thing here, in order
to get your warranty you have to send in this card, but you are
going to answer some questions; what about those?
Ms. Bernstein. In the sense of if they tell you something
that is not true, represent something that is not true? That is
against the law.
Senator Burns. Even in the collection of this information
and what they are going to do with it?
Ms. Bernstein. If they tell you that they are not going to
do with it what they are going to do with it, then it could be
considered deceptive under the FTC Act.
Senator Burns. What if there is no statement at all?
Ms. Bernstein. Then it makes it very difficult for the FTC
to proceed, because no statement has been made and there is not
a specific requirement that it be made under existing law. That
is why the Commission recommended legislation on general
privacy two weeks ago.
Senator Burns. You see, I am very supportive of some
privacy legislation. I am very supportive of that. I just think
that the consumer has that right. It is one of the American
core values that we must protect, a person's own privacy. It
gets even more sensitive whenever we start talking about
financial arrangements and those kind of things, and also with
medical records and some other privacy things that I do not
think the public needs to know anything about.
But I am still concerned about whether we are placing
certain restrictions on those folks who are in the electronic
business or the Internet business and not placing the same
restrictions on the people who collect personal information
even at grocery stores--and they make no statement on how that
information is going to be used?
Ms. Bernstein. Well, there are two things. First of all,
there are some significant differences in the so-called e-
commerce marketplace, as you have already alluded to. It is
faster, it is quicker, they have access to more information,
and they can more quickly obtain that information, in a way
that has not happened before.
But most recently there has been increased public attention
on just what you raise, and that is, is there a need to make
sure that there is a level playing field across these various
media so that the same protections consumers expect in the
offline world would be provided in the online world and vice
versa?
Senator Burns. You see, I think I read a story, was it
yesterday--and I have got such a fantastic memory, but it is
short about the implementation of Senator Bryan's legislation
with regard to child privacy on the act that we passed through
here and which we were very supportive of. But yet they are
still having problems on implementation and enforcement.
That is the reason I ask those questions, because I think
we can pass this thing and say we have done a good thing and
then not revisit the situation later on. I think that would not
serve the industry or the consumer very well.
I thank the chairman.
The Chairman. Senator Cleland.
STATEMENT OF HON. MAX CLELAND,
U.S. SENATOR FROM GEORGIA
Senator Cleland. Thank you very much, Mr. Chairman.
Ms. Bernstein, Mr. Medine is it? I am still struggling with
the terminology. The terminology, I find, is fascinating about
the Internet: mouse, web bugs, cookies, and spam--all found in
every kitchen in America. What is your understanding of what a
web bug is, Ms. Bernstein?
Ms. Bernstein. My understanding of what a web bug is, it is
a very tiny image that can be placed on a computer and indeed
can be placed on a cookie itself and it cannot be detected
visibly at all. It also collects information, not exactly the
same way that a cookie does, which is a file, a little file of
personal information.
Do you want to add anything to that, guru?
Ms. Holz. No.
Ms. Bernstein. That is my understanding of what a web bug
is. They are both used in different ways.
Senator Cleland. Are you saying that a web bug can be put
on someone's personal computer when they use the Internet and a
cookie can be imposed on an Internet user without their
knowledge?
Ms. Bernstein. Yes.
Mr. Medine. Web bugs are typically found on web pages and
they are really hidden code on web pages that essentially sends
a message back to a third party, typically a network
advertiser, saying, does this consumer have a cookie--and
reading the cookie if the consumer has one on their file--and
if not, placing a cookie.
But what's unique about web bugs is you do not see them and
they may even appear on a page--unlike the pages that we showed
earlier, there may not even be an advertisement on that page.
You may not have any reason to suspect that a third party is in
any way monitoring your web browsing.
Senator Cleland. So as you browse you may leave cookies?
Mr. Medine. The web bug can place cookies or read cookies,
yes, even when you are unaware that that is going on.
Senator Cleland. That is amazing. Spam, what is spam?
Ms. Bernstein. Other than the pink meat that you get, spam
is unsolicited----
Mr. Medine. E-mail.
Ms. Bernstein [continuing]. E-mail, unsolicited. It comes
in over your e-mail.
Senator Burns. It is like junk mail.
Ms. Bernstein. Right, it is junk mail in every sense.
Senator Burns. In your mail box.
Senator Cleland. And the ultimate unwanted access is the
Love Bug, right?
Mr. Medine. Which is a virus.
Senator Cleland. A virus.
Ms. Bernstein. Right.
Senator Cleland. Mouse, web bugs, cookies, spam, and
virus--amazing terminology to apply to this new technology.
Let me just say, Mr. Chairman, I think bringing the privacy
rights of Internet users to the forefront of the Senate's
attention is, quite frankly, critical. I think most people when
they use the Internet think of it in many ways starting out,
much like I would, using a telephone. A telephone is a direct
line. You do not assume that it is a party line. You do not
assume that there is somebody out there monitoring your call.
You assume that what you say is in private between you and the
hearer.
I think most Americans would be shocked if they picked up a
telephone, dialed a number, and found out later that their
phone call was being monitored, their preferences were being
tracked with a cookie, and that ultimately if they hung up all
of a sudden they could get multiple phone calls back
unsolicited. I think that would be relatively shocking to the
average individual out there. But that is exactly, apparently,
what is happening to Internet users. Is that correct?
Ms. Bernstein. That is correct, and we agree that Americans
are shocked by it to the extent that there is survey data that
suggests that, when they know about it.
Senator Cleland. Because it seems to me that, much like the
privacy of a phone, if one goes to the Internet one goes to it
with a sense of privacy. It is you and the computer, and you
and the information, and usually not a whole bunch of people
standing around. It is pretty much a private moment, shall we
say. It is kind of deceptively private and personal. It is kind
of deceiving.
Now we find out that there is some deception out there. I
am not sure, quite frankly, what role we have to play, but we
are trying to find that out here.
Thomas L. Friedman, who wrote the book ``Lexis in the Olive
Tree: Understanding Globalization,'' says that maybe government
is more needed rather than less. He said that government should
be downsized, but it should be raised in quality, and said what
we have to worry about is not so much government tapping your
phone line or big brother, but little brother, somebody else
out there.
He says in the web world everybody is connected, but nobody
is in charge. And one wonders what the role of the FCC is and
what the roles of the Senate Commerce Committee and the Senate
are in installing some sense of being in charge, some sense of
rules, some sense of instituting or guaranteeing privacy.
I think privacy is the currency of the Internet. If that is
destroyed, I think people will not go to the Internet or be as
open, or as frank, or as consuming of the Internet and its
products as we would be comfortable in doing.
Is that your sense?
Ms. Bernstein. Yes, it is, Senator. In fact, you have hit
on something that many have written about also, that one of the
great benefits of the Internet and Internet commerce was the
anonymity, that you could do what you wanted to do at your own
pace and make your own choices. That can be destroyed by
practices that impact on the anonymity that you might have come
to and hopefully could expect.
Senator Cleland. Yes, I think there is a certain
expectation that when you use the Internet, that one is not so
much anonymous, but it is private. It is private, and it is
personal. The exchanges that take place there in effect belong
to you and you should have the ability of choice.
Now, that is where we come to opt-in and opt-out. I am not
sure I follow the bouncing ball here, but it seems to me the
underlying principle is that I do not want web bugs, I do not
want cookies, I do not want spam, I do not want anything
messing up my communications here unless I choose for that to
happen. If I choose, then so be it. I am still empowered with
that choice.
I think we are looking at something here that we have to
come to some decision on. The Internet and the web can
certainly be very empowering. It can facilitate commerce, and
it can facilitate the flow of information worldwide. The
Internet can help heal diseases and communicate to people, all
kinds of wondrous things. But if the medium itself is
compromised, shall we say, by these terms, I think we shoot
ourselves in the foot. We make the medium less than it can be.
Is that your sense, Ms. Bernstein?
Ms. Bernstein. It is indeed, and we know that consumer
confidence has already been somewhat impacted because of fears
of just what you suggest, Senator, that they are fearful that
their privacy will not be protected.
Senator Cleland. Fear is a terrible thing. Fear can drive
the stock market up or drive it down. Millions of people can
react in fear just by one or two, shall we say, horror stories.
We are not in the horror story business here, but the point
being we are trying to find that role here. We do not want to
kill the Internet, and we do not want to kill the goose that
lays the golden egg. I understand that information technology
is now the number one force driving the American economy, that
Internet business, e-commerce, is growing at 6 to 8 percent a
year.
This growth is, quite frankly, incredible. But I think one
of the things that can kill the goose that lays the golden egg
is an attrition of consumer confidence. You have that in the
old economy, too. If you lose confidence in a manufacturer or
product, all of a sudden overnight sales drop, and things
happen that are not good.
So we appreciate you working with us and your guidance and
advice in helping us work through these issues. We do not want
to be too active here where we interfere with people's commerce
and their communication, but, by the same token, I think it
does rest and reside on a certain level of confidence and
therefore privacy that is assumed and that ultimately I think
should be guaranteed if the Internet is going to go ahead and
grow.
Thank you, Mr. Chairman.
[The prepared statement of Senator Cleland follows:]
Prepared Statement of Hon. Max Cleland,
U.S. Senator from Georgia
Thank you, Mr. Chairman, for holding this Committee hearing on one
of the most important issues facing Americans today, at least for those
Americans who are not on the short end of the digital divide. We owe
Internet users our undivided attention in developing ways of ensuring
their privacy while not unduly overburdening the Dot Com companies or
place them at a competitive disadvantage with off-line businesses. I
believe that there is a solution that be crafted which respects the
advertiser's ability to collect consumer information on the Internet
and Americans' right to privacy.
By bringing the privacy rights of Internet users to the forefront
of the Senate's attention, we are setting a course in a positive
direction to alleviate the fears that many have concerning how their
private information is acquired, stored, shared and used by others. In
this fast-paced electronic age, information is being collected and
stored at the rate of billions of bits per second. The information that
users send over the Internet passes through dozens of different
computer systems on the way to its final destination. Each of these
systems may be managed by a different system operator, each with its
own capability of capturing and storing online communications. It is
little wonder that Internet users have concerns about their online
activities.
Network advertisers are developing relationships with consumers
that they don't know and, in many cases, these relationships are
unwanted by the consumer. Placing cookies and ``web bugs'' on one's PC
and tracking their movements in such an apparently underhanded manner
seems very wrong on its face. What kind of a technology is ``web bugs''
anyway? In my mind bugs are pests that you use a bug zapper to get rid
of. The alarming trend of using cookies and placing ``web pests'' on
peoples' PCs that is being practiced by more and more firms, some of
whom are represented here today, can't be a good thing if consumers are
unaware these actions are being taken.
While some might consider targeted ads directed at a person to be
helpful, many others consider them to be bothersome. For example, spam,
or unwanted e-mail solicitations, is one form of advertising unwanted
by just about everyone. What concerns me the most is the vast databases
that are being generated to aim ads based on ``inferential'' or
``psychographic'' data. The ever increasing use of cookies, web bugs,
and inferential data is only the beginning. With data collection
technology, such as it is, peoples' innovativeness with how to apply
this technology and the speed at which data can be processed, there is
no telling how or what data will be collected in the future. One thing
we can be certain of is that the information gathering industry will
not be the same tomorrow as it is today. It is disconcerting to think
how many current Internet users are unaware that their communications
are being monitored and their activities tracked.
Today, there are an estimated 17.8 million websites registered
worldwide and every day more are coming online. Each of these websites
has the potential of collecting data that many consider private and
many of them are actually collecting such information. I recognize that
there are firms out there who are helping to ensure that industry's
self-governing online privacy becomes a reality. One is the Better
Business Bureau. Since it began certifying sites, the Bureau has
certified just over 6,000 of the 17.8 million websites in existence
today. While some in industry may believe this is a good start at self-
regulating privacy concerns, I believe industry is falling short in its
attempt to show it is capable of self regulation in this field.
I am looking forward to the dialog that will take place this
morning and to hearing the distinguished witnesses address how the
legislation that has been offered, or should be offered, can
appropriately balance the consumer's right to privacy and the
advertiser's ability to collect and utilize personal information. I am
very interested in ensuring that a comprehensive, enforceable online
privacy policy is afforded to all Americans. It is our collective
responsibility to do this so the Internet can continue to grow at an
exponential rate, businesses are not burdened by overly burdensome
restrictions and consumers can be assured that their privacy rights
will be protected.
The Chairman. Senator Kerry.
STATEMENT OF HON. JOHN F. KERRY,
U.S. SENATOR FROM MASSACHUSETTS
Senator Kerry. Thank you, Mr. Chairman.
I regret coming in late because I know it has been an
interesting discussion, and there is nothing worse than trying
to pick up on it without having been part of the flow. So I was
just trying to get as quick an update as I could. I do not want
to, hopefully, be repetitive.
I have been spending more and more time in the last weeks
trying to reach out to the folks in the industry who are on the
cutting edge of changing things so rapidly and trying to get a
better sense of what the play is and what the possibilities are
within this privacy issue. I have come away from those
discussions perhaps more confirmed, Mr. Chairman, in my sense,
that we need to be careful about how fast we move.
I know there is bubbling up a sort of congressional sense
of outrage that wants to protect appropriately our citizens'
right of privacy, and I want to do that, too. But I become more
convinced that the more you dig into it, the more complicated
it becomes as to exactly what you can mandate effectively from
this vantage point at this time.
Let me be precise. On the access issue, for instance, it is
very difficult to provide the full measure of access that some
people are asking for and still maintain the integrity of the
recordkeeping on the other side that you want. How does
somebody get access to their record to change whatever it is
they want, and what is the guard against the input that they
might want to change it with, the information that they have?
You can run down the line here on various aspects of the
issue and you keep running into walls. Enforcement, I gather,
has been raised by a number of my colleagues as an issue. It is
almost a certainty that whatever we pass will be unenforceable
unless we are passing something that sets some very clear
standards and expectations that are meetable. Whether or not
they will be meetable will depend to a large degree on where
the technology goes and what the cooperative effort is going to
be within the industry itself.
I think there is a medium ground, and I have tried to
express that in the prior hearing that we had. But I think
that, on greater analysis, my colleagues are going to share
with me a sense that there may be a first step. Now, we are
here focused on the online profiling, I believe, which in a
sense it sort of underscores the predicament that we face.
The last hearing that we had was also focused on sort of
online and we are focused on the Internet. But privacy is
privacy is privacy. I mean, if privacy is a right and privacy
is something that attaches to every American, it attaches to
them online and offline. And, to the best of my knowledge, no
one in the U.S. Congress has put forward a full measure of what
has happened to Americans offline.
Am I correct? Is there not a very significant intrusiveness
that takes place in the marketplace offline?
Ms. Bernstein. There certainly is some. There are,
however--as you know, Senator, there have been some responses
to that. Organizations like the Direct Marketing Association
have put in place systems so that consumers can indicate that
they do not want to receive certain kinds of telephone calls
from sales persons or mail calls.
The Telemarketing Sales Act put some restrictions on what
messages can be limited by consumers on the telephone. So I
think it is not quite as bereft of any kind of protections for
consumers as you suggest. Could there be more? I am confident
that there could be.
Senator Kerry. That is a voluntary system.
Ms. Bernstein. The DMA is, but the----
Senator Kerry. So it is not mandated by Congress.
Ms. Bernstein [continuing]. Telemarketing Sales Act was
mandated by Congress.
Senator Kerry. But you can get very significant, through
private sources and otherwise, extraordinary amounts of
information regarding any fellow citizen. I mean, you can get
their criminal record. You can get what their credit card
expenditures have been for some particular months through
various sources. It is not a crime to do that.
You can do some remarkable profiling through purchases that
take place. For instance, if I walk into a store here in
Washington, swish my card through the credit machine, every
purchase that I have made is known to those people. They can do
whatever targeting they want.
So what we are doing here is we are really talking about
conceivably in the outcome, depending on what we do, picking
some winners and losers and affecting the marketplace as
against another component of the marketplace. I mean, if
privacy is the concern, privacy applies to everybody in every
context, does it not?
Ms. Bernstein. Yes, it does.
Senator Kerry. So why are we focused on one sector of the
marketplace versus others?
Ms. Bernstein. I think the focus has been on the online
marketplace particularly because it is new, it does have many
benefits for consumers that they would like to be able to use,
and at the same time there have been increasing concerns about
what happens to their information when they are using it. It is
new. Everyone wants it to flourish because of the benefits it
can bring, but it also has to have a balance of having people
feel confident or they will not use it.
Senator Kerry. I agree with the Chairman that there is a
special status with respect to medical information, and there
is a special status with respect to financial information.
Ms. Bernstein. Whether online or offline.
Senator Kerry. Correct, online or offline, and they ought
to probably be treated similarly. But what is the harm with
respect to this protection we are seeking to provide with
respect to the other aspects of the targeting and profiling?
What is the harm?
Ms. Bernstein. Well, one of the harms is that, at least in
what we have been discussing today, is that consumers have no
idea that this is going on.
Senator Kerry. Which, the profiling?
Ms. Bernstein. The profiling. They have no idea.
Senator Kerry. So my concept of privacy, of what we should
do at this point, is to mandate the level of notice and to
encourage the maximizing of anonymity. I have spent some time
lately trying to sort of test different sites and see where
privacy appears. I look for how fast it leaps out at me, and
how quickly can I see the word. I also look for what they are
going to do. And there is a difference, there is a variance, I
will concede that.
Clearly, we could legislate some standard that would
encourage people--or not encourage, that would mandate and that
would flow to your jurisdiction that as a fair trade practice
people must post right up front what the options are. That is
maximizing choice.
In the context of measuring against the harm that may be
done, is that not a balance?
Ms. Bernstein. The Commission has already recommended just
that notice and just that choice in connection with all
commercial website activity. So it would certainly go a long
way toward bringing about a much better balance than exists
today.
Senator Kerry. Well, let me go a step further. If citizens
are as concerned as you say they are, then the opt-in, opt-out
issue becomes more important. Some people would argue that the
initial opt-in is when you buy your computer, turn it on, and
go to a site. That is opting in.
Ms. Bernstein. It is correct that some people argue that.
Senator Kerry. Then, if on that site there is a prominent
display about how the information may or may not be handled,
they have a next threshold level at which they can exercise
again a choice of opt-in, opt-out, correct?
Ms. Bernstein. Under present circumstances, Senator?
Senator Kerry. No, assuming you had adequate notice that
was posted.
Ms. Bernstein. Right.
Senator Kerry. So then the consumer is making a choice,
correct? And the down side of harm is that it may be that they
had adequate posting of X, Y, or Z profiling process or they
may be targeted for some sale or something. If their financial
and health information is completely and totally protected,
would you not have gone an extraordinary distance here to sort
of set a standard as to how we view privacy without becoming
overly intrusive and overly regulated and overly structured in
a way that might inhibit the creativity of the marketplace?
Ms. Bernstein. I think everyone agrees that it would go a
long way to have those kinds of protections for financial and
medical information. There are other areas of sensitive
information, at least to some people, for example, their
religious preferences or organizations that they belong to,
that they may consider as highly confidential to them.
Senator Kerry. Is any of that protected in the offline
world?
Ms. Bernstein. I do not know that it is routinely
collected.
Senator Kerry. The answer is no.
Ms. Bernstein. I believe not.
Senator Kerry. Okay. So the bottom line comes to this
question of what definition of ``privacy'' are we prepared to
recommit ourselves to with respect to the American people,
online or offline, so that we are not somehow picking winners
and losers in the process. I will pursue that later, and I
thank the chair.
The Chairman. Thank you, Senator Kerry. I thank my friend.
We have been almost an hour and a half and we have another
panel. So I thank you, Ms. Bernstein, Mr. Medine, and guru.
Thank you very much.
The next panel is: Mr. Jules Polonetsky, who is the Chief
Privacy Officer of DoubleClick; Daniel Jaye, the Chief
Technology Officer of Engage Technologies; Mr. Marc Rotenberg,
who is the President of the Electronic Privacy Information
Center; and Mr. Richard Smith, an Internet consultant.
Mr. Polonetsky, we will begin with you. Welcome and thank
you for your patience.
STATEMENT OF JULES POLONETSKY, CHIEF PRIVACY OFFICER,
DOUBLECLICK
Mr. Polonetsky. Thank you, Mr. Chairman. Thank you,
Senators. Thank you for holding this hearing on the critical
issue of online profiling and Internet privacy. As Chief
Privacy Officer at DoubleClick, I report directly to the
company's Board of Directors to ensure that DoubleClick is
effectively implementing its privacy policies and procedures. I
act as a resource for Internet users. I work with advertisers
and publishers to oversee their privacy policies and I work to
educate the public about Internet privacy.
I appreciate the opportunity to testify today. In order for
the Internet to continue to flourish--in order for this
revolutionary medium to keep growing at such a rapid pace and
be the engine for the greatest economic expansion in U.S.
history--the Internet industry must make consumers comfortable
that their privacy is being protected online, and at the same
time publishers and ad servers must continue to customize and
personalize web content and advertising so that users can get
the information they want and websites can generate the
revenues necessary to stay in business and keep content on the
Internet free.
Currently, a vast majority of websites offer content free
of charge. From The New York Times to The Washington Post to
Encyclopedia Britannica, sites offering directions, weather
information, content is offered to consumers for free. Why?
Because of effective Internet advertising. By keeping the
Internet free, Internet advertisers help bridge the digital
divide for consumers. Internet advertising revenue also helps
smaller startup websites offer unique and diverse content and
compete with more established businesses.
As the consumer affairs commissioner in New York City for
Mayor Giuliani for the past two years, I saw firsthand the
consumer benefits of effective advertising. In markets where
merchants were competing successfully, consumers had many
choices and were easily able to find the products and services
they needed. In markets where advertising was limited or
ineffective and where it was difficult for merchants to reach
the right consumer at the right time, such as funeral services
or prescription medications, prices varied by as much as 40
percent or 50 percent from location to location. The result:
many consumers overpaying for services and products they
needed.
On the Internet, advertising is effective for consumers and
advertisers when ads reach the right consumer at the right
time. Internet advertising companies use information to attempt
to deliver the ads to consumers that the consumers are likely
to click on.
As Senator Kerry noted, this happens every day in the
offline world. Catalogue companies share their mailing lists
with each other. Magazines share subscription lists, and
political candidates use voting lists so they can send
persuasion or fundraising mail only to the voters likely to
respond. This is the heart of offline direct marketing and it
is critical to effective advertising on the web.
Now, we at DoubleClick understand and take very seriously
the privacy issues raised by the technological tools used for
effective web advertising. We also understand that the
different types of information used need to be treated very
differently. Not surprisingly, consumers understand that
certain information in the wrong hands can be harmful to them
and that some information, like marketing data, does not pose a
threat.
Research that we conducted showed that consumers are very
concerned about the collection of social security numbers, a
fear of identity theft. They are concerned about their credit
card numbers, information that could be used against them.
People have very practical concerns. They are worried about the
collection and sharing of sensitive credit information that
could be used to deny them mortgages, sensitive health
information that could be used to deny them insurance.
It is DoubleClick's policy not to use sensitive information
for profiling when we deliver an ad. We do not use health
information, we do not use sensitive financial information,
visits to adult sites, sexual information, information about
children. The example that the FTC presented and that, Senator
McCain, I think you referred to as relatively innocuous frankly
is the kind of ad serving that we do.
Consumers are much less concerned about transaction data
used for marketing purposes, but we do believe that they have a
right to know--even if it is not sensitive data--data about
basic transactions. Consumers have the right to know what kind
of data net advertisers are using and they have the right to
have control over that use. There are significant steps that
industry can and should take to give consumers more confidence
in and more control over their web experience. Primary among
them are notice and choice.
Consumers need and deserve real choice. They need to know
the type of data that is being collected about them and they
need to have the ability to opt out, to choose not to
participate if they want to. We recently finished one of the
largest Internet education campaigns in web history. We served
more than 100 million banner ads connecting consumers to
privacychoices.org, a website dedicated to consumer privacy
education, offering a two-clicks-and-you-are-out policy for
consumers who wanted to opt out of targeted advertising.
At DoubleClick, no website is allowed to contribute profile
information or to have ads delivered based on any cross-web
behavior unless their privacy policy links to DoubleClick to
give consumers notice about what is going on and a chance to
opt out.
We are also rewriting our privacy policy to make it
shorter, clearer, and easier for consumers to understand. We
employ an outside auditor, PriceWaterhouseCoopers, to do an
external audit periodically to ensure that we are living up to
the privacy commitments that we make to consumers, and we have
an independent consumer privacy advisory board to help us
continue to improve our privacy procedures and to respond to
the new issues that will continue to arise as new forms of e-
commerce develop.
Finally, as part of the network advertising initiative, we
are working with the other companies in our industry to develop
uniform rules for all third party advertisers to follow to
ensure that our activities are clear and understood by
consumers and to ensure that consumers have control over how we
use information.
We recognize that consumers must know that their privacy is
protected online for e-commerce to continue to flourish and we
welcome your ideas for additional steps that we can take to
benefit consumers.
Thank you.
[The prepared statement of Mr. Polonetsky follows:]
Prepared Statement of Jules Polonetsky, Chief Privacy Officer,
DoubleClick
Thank you for holding this hearing on the critical issue of online
profiling and Internet privacy. As Chief Privacy Officer at
DoubleClick, I report directly to the company's Board of Director's to
ensure that DoubleClick is effectively implementing its privacy
policies and procedures, act as a resource for internet users, work
with advertisers and publishers to oversee their privacy policies and
work to educate the public about internet privacy. I appreciate the
opportunity to testify today.
In order for the Internet to continue to flourish--in order for
this revolutionary medium to keep growing at such a rapid pace and be
the engine for the greatest economic expansion in U.S. history--the
Internet industry must make consumers comfortable that their privacy is
being protected on-line. And, at the same time, publishers and ad
servers must continue to customize and personalize web content and
advertising so that users can get the information they want and
websites can generate the revenues necessary to stay in business and
keep the Internet free.
Currently, a vast majority of Web sites offer content free of
charge. From The New York Times to The Washington Post to Encyclopedia
Britannica and sites offering directions and weather information,
content is offered to consumers for free. Why? Because of effective
Internet advertising. By keeping the Internet free, Internet
advertisers help bridge the digital divide for consumers. Internet
advertising revenue also helps smaller start up Web sites offer unique
and diverse content and compete with more established Web sites.
As the Consumer Affairs Commissioner in New York for Mayor Giuliani
for the past two years, I saw firsthand the consumer benefits of
effective advertising. In markets where merchants were competing
successfully, consumers had many choices and were easily able to find
the products and services they needed. In markets where advertising was
limited or ineffective and where it was difficult for merchants to
reach the right consumer at the right time--such as funeral services or
prescription medications--prices varied by as much as 40% from location
to location and many consumers overpaid for services and products they
needed.
On the Internet, advertising is effective for consumers and
advertisers when ads reach the right consumer at the right time.
Internet advertising companies use information to attempt to deliver
the ads to consumers that they are likely to click on.
This happens every day in the off-line world. Catalogue companies
share their mailing lists with each other. Magazines share subscription
lists. And political candidates use voting lists so they can send
persuasion or fundraising mail only to likely voters.
This is the heart of off-line direct marketing. And it is critical
to effective advertising on the Web.
Now, we at DoubleClick understand and take very seriously the
privacy issues raised by the technological tools used for effective Web
advertising. We also understand that different types of information
need to be treated differently.
Not surprisingly, consumers understand that certain information in
the wrong hands can be harmful to them and that some information--like
marketing data--does not pose a threat.
Research conducted for DoubleClick showed that consumers are very
concerned about the collection of social security numbers--in other
words, a fear of identity theft--credit card numbers and information
that can be used against them. People have very practical concerns--
they are worried about the collection and sharing of sensitive credit
information that can be used to deny them mortgages and sensitive
health information that can be used to deny them insurance.
It is DoubleClick's policy not to use sensitive information for
profiling when delivering an ad. We do not profile using health
information, detailed financial information, visits to adult sites or
sexual information, or information about children.
While consumers are much less concerned about transaction data used
for marketing purposes, we believe they have a right to know what type
of data is being used by network advertisers and have the right to have
control over that use.
There are significant steps that industry can and should take to
give consumers more confidence in and control over their web
experience. Primary among them are notice and choice. Consumers need
and deserve real choice. They need to know the type of data that is
being collected about them and have the ability to opt-out--to choose
not to participate--if they want to.
We recently finished one of the largest Internet education
campaigns in Web history . . . 100,000,000 banner ads connecting
consumers to www.privacychoices.org, a website dedicated to consumer
privacy education and offering a two-clicks-and-you're-out policy for
those who wish to opt-out of targeted advertising.
At DoubleClick, no Web site is allowed to contribute profile
information or receive ads based on cross web behavior unless their
privacy policy links to DoubleClick to give consumers notice and a
chance to opt-out.
We are also re-writing our privacy policy to make it shorter,
clearer and easier to understand.
We employ PriceWaterhouse Coopers to provide an outside audit to
ensure we are living up to the privacy commitments we make and we have
appointed an independent Consumer Privacy Advisory Board to help us
continue to improve our privacy procedures and respond to new issues
that will arise as new forms of e-commerce develop.
And finally, as part of the Network Advertising Initiative, we are
working with the other companies in our industry to develop uniform
rules for all third party advertisers to follow to ensure that our
activities are clear and understood by consumers and to ensure
consumers have control over how we use information.
We recognize that consumers must know that their privacy is
protected online for e-commerce to continue to flourish and we welcome
your ideas for additional steps that we can take to benefit consumers.
Thank you.
The Chairman. Thank you very much.
Mr. Jaye, welcome.
STATEMENT OF DANIEL JAYE, CHIEF TECHNOLOGY OFFICER, ENGAGE
TECHNOLOGIES
Mr. Jaye. Thank you. Thank you, Mr. Chairman. My name is
Daniel Jaye. I appreciate the opportunity to appear before you
today. I am the Chief Technology Officer and co-founder of
Engage, Inc., of Andover, Massachusetts. When I joined with
CMGI Chairman and CEO David Weatherall to create Engage in
1995, we were guided by the fundamental proposition that
effective, tailored online advertising was vital to the
Internet's future, but could ultimately be effective only if
consumers found online targeted advertising a valued customized
information service and not an unwelcome intrusion. This is
only more clear today.
If the Internet is going to bridge--and not widen--the
digital divide, advertising support is essential. Today,
however, three out of four Internet ads remain unsold or
undersold, and the great majority of websites remain
unprofitable. The traditional advertisers we need will commit
to the web only if they can achieve the effectiveness
attainable offline and something more as well. That is where
online profiling comes in.
Using various business models and technologies, online
network advertisers enable website visitors to receive news,
information, and ads customized in real time to their
demonstrated interests. At Engage, we have developed a
distinctive anonymous profiling model that enables online
marketers to deliver the relevant ads to the right audience. In
this model, while we do provide notice and choice, we do not
know a consumer's name, address, social security number, or any
other personally identifiable information.
We do not maintain information about the specific websites
a browser visits. We do not collect any sensitive or
controversial data, such as personal medical or financial data,
ethnic origin, religion, political interests, or review of
adult content. And we do not merge anonymous profiling data
with personally identifiable data, no matter what the source.
Instead, we simply derive an apparent interest level score
by looking to the aggregate amount of time a browser has spent
on different types of content, very similar to the
demonstration we saw earlier. We do not look at who they are or
where in particular they have been on the web. Our patent-
pending, dual-blind technology creates a firewall that prevents
our customers from gaining access to our interest profiles or
determining a visitor's real world identity.
Industry-wide as well, elegantly simple technological tools
are emerging for consumers to ensure their privacy. We are
particularly excited about an outgrowth of the Platform for
Privacy Preferences project, P3P, that is specifically focused
on cookies. Engage has authored and is working with other
industry leaders on this trust labels technology that would
recognize automatically whether a website's use of cookies
meets third party seal organization standards and the user's
own standards.
Moreover, any third party that attempts to set a cookie but
does not meet these standards will trigger a warning on the
computer screen, instantaneously allowing the consumers to
block the business from collecting data. Unless and until it
reforms its practices to meet the standards of privacy seal
organizations, the bad actor will actually be locked out of the
marketplace. This more than any regulation will drive
widespread, indeed global, compliance with seal programs.
In addition, market forces are driving the online industry
to raise the bar for protection of consumer privacy through
effective industry standards, through increasingly vigorous
seal of approval programs, through contractual commitments that
extend the reach of industry standards to our business
partners, and through stepped-up consumer and business
education.
Through the network advertising initiative, we are ensuring
that our network advertiser segment of the marketplace embraces
each of these mechanisms and expands upon prevailing industry
standards in a clear, public, and enforceable way. You should
be hearing soon about the particulars of the significant
standards and practices to which our sector has committed.
The growing marketplace premium on privacy protection makes
the commitment to self-regulation of our business particularly
credible. We welcome the spotlight on privacy. Engage feels
confident that its own technology, business models, and
commitment to consumer privacy will continue to meet or exceed
the highest of any industry standards or government mandates.
But the early adoption of a regulatory framework or, worse
yet, a patchwork of regimes could undermine these surging
market incentives to develop and deploy technological advances
and privacy protection. Instead of setting a floor that turns
into a ceiling as well, policymakers would, I believe, be well
served to test the dynamism of technological innovation and the
power of the market to deliver on this promise before moving
forward.
Thank you.
[The prepared statement of Mr. Jaye follows:]
Prepared Statement of Daniel Jaye, Chief Technology Officer,
Engage Technologies
Thank you, Mr. Chairman. I appreciate the opportunity to testify
before you today on these issues of importance to your Committee, to
Internet users, and to the future of our Internet economy.
My name is Daniel Jaye. I am the Chief Technology Officer and Co-
Founder of Engage, Inc. of Andover, Massachusetts. Engage is a leading
provider of technology and services that allow website operators and
advertisers to tailor their commercial and editorial content in
innovative ways likely to be of the greatest interest to a visiting
Internet user--all without tracking, or ever learning, an individual's
identity.
Since co-founding our company in 1995, I have been engaged in the
design and development of privacy-sensitive online marketing
solutions--including inventing the Internet's first anonymous profiling
technology, participating as a founding member of the initial so-called
``P3P'' specification and as author of the related ``TrustLabels''
specification (developments I'd like to highlight shortly). I have also
actively participated in a number of significant industry online
privacy standards initiatives, including the Network Advertising
Initiative (NAI). And I have recently served as a member of the Federal
Trade Commission (FTC) Advisory Committee on Online Access and
Security, and a panelist in the FTC/NTIA Online Profiling Workshop in
November 1999.
I would like to address three topics today:
First, the fundamental role served, and the basic models
used, by online network advertisers;
Second, the technological tools and developments that are
bolstering the power of industry--and indeed the power of
consumers themselves--to promote privacy-sensitive online
practices; and,
Third, the potent market forces that are compelling online
businesses to provide consumers real assurance that they can
surf the web without unwittingly sacrificing their personal
privacy.
I might note that I offer these comments not in an effort to
demonstrate that there could never be a place for legislation in this
area, nor out of any concern about the direct impact of proposed
privacy legislation on our company's practices. Engage feels confident
that its own technology, business models, and longstanding commitment
to consumer privacy would continue to meet or exceed the highest of any
industry standards or mandates. Yet, I offer these comments because I
respectfully believe that it is essential that any legislative
deliberations fully appreciate the vital role, the dynamic technology,
and the palpable marketplace forces that shape the online advertising
business.
Keeping The Internet Free For All Consumers Through Effective Online
Advertising
Let me briefly explain, then, how ``online profiling'' offers a
tool critical to underwriting the Internet's emergence as a remarkable
toll-free bridge spanning an otherwise widening societal divide in
access to information and commerce. Early online entrepreneurs learned
quickly that sustaining a rich array of information and services on the
Internet, readily accessible to all consumers, would require a model
based on advertising support--and free of subscription fees. And, based
on this prevailing model, the Internet has flourished as a remarkably
vibrant and innovative source of freely accessible information,
entertainment and commerce.
Yet if advertising is truly to provide a viable, long-term
foundation for the Internet economy resting upon it, website operators
must harness the medium's unique marketing capabilities to allow
advertisers to deliver relevant ads to the right audience. Today,
however, three out of four Internet ads remain unsold or undersold.
And, not coincidentally, the great majority of websites remain non-
profitable. The traditional advertisers that we must attract to the web
will come in requisite numbers only if they can achieve the
measurability and effectiveness that they can achieve offline--and
something more, as well. Profiling technology enables this advertising
and content to be more effectively targeted to consumers' interests,
thus offering a vital means for fulfilling the Internet's rich
potential--for consumers, advertisers, and website operators alike.
Different online companies employ different business models and
technologies to offer customized news, information and ads on topics of
demonstrated specific interest, even when a visitor might be viewing
more general interest web pages. And, the types of information
collected and used for online profiling can vary among personally
identifiable information (PII), non-personally identifiable information
(non-PII), or a combination of the two.
PII is data used to identify, contact, or locate a person,
such as name, address, telephone number or e-mail address.
Non-PII is data that does not identify a particular person
and is typically compiled from anonymous clickstream
information collected as a browser moves among different
websites (or a single website).
The collection of online data relies upon the use of ``cookies,''
which are simply small files of information that most websites place on
a user's browser--to provide, in Engage's case, a unique anonymous
identifier or, importantly, a message that the browser is set to opt-
out from collection of any data about its users.
Harnessing Technology To Make Online Advertising Effective And Privacy-
Sensitive
When I joined with CMGI Chairman & CEO David Wetherell to create
Engage in 1995, we were guided by the fundamental proposition that
effective, tailored online advertising was vital to the Internet's
future--but could ultimately be effective only if consumers found
online targeted advertising a valued, customized information service
and not an unwelcome intrusion. From the outset, then, we developed an
innovative technology to enable online marketers to understand the
interests of website visitors based strictly upon anonymous, non-
personally identifiable information.
Relying only on the apparent interests, broad demographics, and
general location of a visitor reflected in interest profiles, Web site
publishers, advertisers, and merchants can customize web pages and
offer content, ads, promotions, products and services tailored to the
visitor in real-time--and, at the same time, protect the consumer's
privacy by not collecting personal (or otherwise sensitive) information
of any kind. In fact, in our anonymous model:
We do not know a consumer's name, address, social security
number or any other personally identifiable information;
We do not maintain information about specific web pages a
browser visits or how long a visitor stays;
We do not collect any sensitive or controversial data, such
as personal medical or financial data, ethnic origin, religion,
political interest or review of adult content; and,
We do not merge anonymous profiling data with personally
identifiable data, no matter the source.
Instead, our anonymous profiles consist of a score signifying the
apparent level of a user's interests in various categories. We simply
look to the aggregate amount of time a browser has spent on different
types of content--not who they are, or where in particular they have
been on the Web. Our conviction from the start has been that it should
never be possible for Engage or anyone else to determine (or even
``triangulate'') a visitor's real world identity based on our
abstracted data.
And we employ additional technological tools and practices to
ensure this anonymity. We use firewalls--technological barriers to
protect a system--to secure the (already) non-personally identifiable
information we collect through a patent-pending technology we call
``dual-blind'' identification: this way individual websites we work
with do not have access to our interest profiles or know what other
sites a user may have visited. There is no user interface through which
anyone else can gain access to an individual profile. And, even with
these technological protections in place, and only non-personally
identifiable data at issue, we also provide consumers effective choice
regarding whether to participate. We offer clear information about our
data collection practices and an opportunity to opt-out of our
anonymous information gathering.
In short, Engage's business model not only accommodates, but is in
fact borne of, consumer's interest in protecting their privacy
interest.
Privacy-Driven Technological Innovation Is Further Empowering Industry
And Consumers Themselves To Raise The Bar
Continued technological innovation promises our online industry--
and the web visitors themselves--sophisticated yet simple tools to
support consumer privacy interests. I can report first-hand that the
online industry has indeed brought to bear in the interest of consumer
privacy the same zeal for technological break-throughs that have
characterized--and fueled--the Internet itself. The result: a
remarkable progression of emerging solutions that will offer consumers
previously unimagined forms of notice, choice and protection of their
own personal privacy demands.
Emerging tools offer not only instantaneous and automatic notice
and choice, but more than that, they also would empower consumers
essentially to set for themselves just what measure of privacy they
demand--and to avoid any sites that fail to meet their personal
standards. The Platform for Privacy Project (P3P) at the World Wide Web
Consortium (W3C) would enable a web server to communicate automatically
how it collects and shares user data so users can define what privacy
standards they prefer for that particular site or in general. Engage
was a co-author of the P3P Protocol Specification.
Beyond this, we are very excited about a specific application of
P3P in the context of ``TrustLabels'' for cookies. To directly respond
to the leading concerns over third party data collection and
transparency, Engage has authored and is working with other industry
leaders on a specification for TrustLabels, which would allow web
servers to provide notice to consumers concerned about certain uses of
cookies and would allow consumers the ability to accept or reject a
site's data practices. This technology critically serves the goal of
universal compliance with privacy standards. It permits consumers to
compel online businesses to be privacy-sensitive because those
businesses that attempt to set a cookie and do not meet consumers'
privacy demands will cause a warning alert to be displayed on the
computer screen of the user, allowing a choice (probably ``NO'') to be
made solely by the consumer regarding whether to permit the business to
collect data. The business will be unable to collect the data it seeks,
unless and until it reforms its practices to meet the standards of
privacy seal organizations. The bad actor will actually be locked out
of the marketplace. This, more than any regulation, will drive
universal compliance with seal programs. And, on the Internet, such
technology-based enforcement does not stop at national borders.
Certainly this is the sort of technological innovation that no one
would wish to discourage with a premature regulatory framework that
could stunt this continuing evolution--or, worse yet, a patchwork of
such regimes across jurisdictions.
Extending Privacy-Sensitive Practices Through Industry Self-Regulation
Along with this commitment to developing robust technological tools
to empower consumers, online industry leaders have relied on a
complementary set of additional tools to raise the bar industry-wide
for the protection of consumer privacy:
First, adopting effective standards for industry collection
and use of consumer data;
Second, giving those standards teeth through enforceable and
increasingly vigorous seal of approval programs;
Third, extending the reach of those standards by
incorporating them into contracts with other online businesses
not already subject to such standards; and,
Finally but critically, actively educating consumers and
business customers about our business and the available means
for effectively safeguarding privacy on the Web.
In the few short years over which the Internet has blossomed, the
online industry has--through rapidly growing use of these tools--made
tremendous strides in voluntary, but self-regulated adoption of ``the
right way'' to do business. And through the Network Advertising
Initiative, we are ensuring that our network advertiser segment of the
marketplace embraces and expands upon prevailing standards--in a clear,
public, and enforceable way.
You will hear in the very near future, I believe, in greater detail
about how our NAI standards will effectively incorporate all of the key
self-regulatory tools I just described--substantive standards,
independent third party certification and enforcement, binding
commitments on our customers to follow the same standards, and a
campaign to educate the public and our website customers alike.
The Power of Marketplace Demands For Privacy-Sensitive Practices
I will confess that, for Engage, the standards and practices
contemplated by industry largely codify the standards we have set for
ourselves from the outset. But by no means does that suggest that this
self-regulatory initiative, and the recurring spotlight on our
industry's business practices, is not making a difference. To the
contrary, as a whole, we are working to set a bar and, in certain
respects, raise the commonly prevailing bar. More than that, we are
fully unleashing an already significant and growing set of marketplace
forces--the force of privacy-sensitivity as a competitive advantage. It
is a force that we welcome--indeed one we have long harnessed. It is a
force that public policy must take care not to squelch. And it is a
force that makes the commitment to self-regulation in our business all
the more credible.
Our customers know that consumer comfort and security is critical
to use of the Internet. In this competitive climate, those businesses
serving consumers online ultimately will embrace only those
technologies and practices that can provide tailored and effective
online advertising without compromising consumer privacy. This is a
powerful bottom-line force, as ongoing marketplace developments bear
witness.
Conclusion
The potent combination of technological innovation, industry
standards, contractual requirements extending those standards,
enforceable privacy seal programs, consumer and industry privacy
education, and FTC enforcement offers a highly reliable and uniquely
effective response to online privacy concerns. These initiatives
bolster what are already formidable marketplace checks on online
businesses' protection of consumer privacy. The needs of our customers
to attract--and not repel--consumers will ensure that we get the job
done.
But so too is it critical to ensure that we do not needlessly
undermine the effectiveness of online advertising by freezing the
development of new technological tools to meet consumer and business
needs. Instead of setting a floor that turns into a ceiling as well,
the power of the market and the dynamism of technological innovation
promise continued remarkable developments to protect privacy interests.
As I suggested at the outset, the viability of e-commerce, of our
advertising-supported Internet, and thus of all the Internet's
tremendous economic and societal benefits depends on it.
Thank you.
The Chairman. Thank you very much.
Mr. Rotenberg.
STATEMENT OF MARC ROTENBERG, DIRECTOR, ELECTRONIC PRIVACY
INFORMATION CENTER
Mr. Rotenberg. Thank you very much, Mr. Chairman, members
of the Committee. It is a pleasure to be here today. It was
actually at a similar hearing a year ago that I described for
you a company named DoubleClick, the Internet's largest
advertising network, and another company named Abacus Direct,
the country's largest database catalogue firm, and I explained
following the announcement of a recent merger that the joining
together of the online information in the Abacus Direct
database and the surfing records that were being maintained by
DoubleClick would raise profound issues for Internet privacy,
that users would strongly object to this type of profiling of
their Internet activity, and that you would see a public
response.
Indeed, that is what happened over the past year. The
public responded, the FTC responded, State attorney generals
responded, because people understood that in their use of the
Internet--in the desire to obtain information online and
receive the benefits of electronic commerce it did not seem
fair or right that they should have to sacrifice their--
privacy.
Now, the online advertising industry will say: We are
providing great benefits. We are providing free content. We are
making it possible for people to get access to information and
systems. But I think it is important to keep two points in
mind.
First, advertising has always supported the delivery of
editorial content. Whether it is a radio broadcast, a TV spot,
magazine ad, or a billboard, there have always been ways for
advertisers to market to consumers to support the delivery of
information. What is different about the Internet, and it is
different, is that this is the first time that it has been
possible for advertisers to profile the people who receive
information, to build detailed dossiers about their interests,
their preferences, their likes, and their dislikes. In this
respect the Internet world is different from the offline world.
There is a different type of privacy problem made possible by
the creation of a digital network.
Now, a second point to keep in mind is that Congress has in
the past confronted this issue of how we deal with the creation
of personal profiles. This is not the first time. In fact, more
than 30 years ago when people looked at the practices in the
credit reporting industry and said, look at this detailed
information that is being put together about how people live,
whether they are married, what they earn, what time they show
up at work, there has to be some control on the collection and
use of this information.
So Congress 30 years ago passed privacy legislation to
control the collection and use of credit record information, to
make sure that improper information was not collected and that
the information that was collected was not used improperly.
Similar issues were raised about the potential of Big
Brother databases in the Federal Government. In the 1960's,
Federal agencies were bringing in automation and people
realized that it would be possible to create very detailed
profiles of American citizens. So, over time a legislative
framework called the Privacy Act was put in place which gives
every citizen in America the right to limit the collection and
use of information about them and, critically, to see the
information which is collected.
My suggestion to you today is that what we are facing with
Internet profiling is in fact not a new problem. It is a
familiar problem. It is the detailed collection of information,
the creation of profiles, enabled by technology. Now, of course
it is a wonderful technology and we really do not need to
dispute the benefits of the Internet. The question is, are we
going to have to trade our privacy, lose control of this
information, to receive the benefits of the Internet.
I think over the last five years as the FTC and the
sponsors of legislation, this Committee, privacy groups--my
own, Junkbusters and others--we have realized that there is
simply not a need to make this trade. We do not need to choose
privacy or the benefits of the Internet. We really should have
both.
Pulling it all together, I think the key point here is that
when I came to you a year ago and said that this type of
profiling is going to create problems, I also suggested that
there were ways to do online marketing, online targeting, that
would be good for business, good for consumers, and would not
create these types of privacy problems. So what we needed, and
what we still need, is the baseline privacy legislation that
establishes an opt-in requirement, that gives people the right
to access those profiles, and in some cases the right to have
their personal information deleted if they no longer have a
relationship with a company or they do not want to have a
future relationship with a company.
Those baseline standards will encourage the development of
very good online business practices, very good privacy
technology. They will not stand in the way of innovation and
they will give people the benefits of the Internet and provide
privacy protection.
So I thank you very much for the chance to be here, and I
will be pleased to answer your questions.
[The prepared statement of Mr. Rotenberg follows:]
Prepared Statement of Marc Rotenberg, Director,
Electronic Privacy Information Center
Summary
Privacy organizations that favor legislation to protect privacy
have also been the leaders in the effort to establish good technology
to protect privacy. Our view is that good privacy technologies will
depend very much on the regulatory environment. Laws such as export
controls that limit the availability of encryption or the requirements
of the Communications Assistance for Law Enforcement Act, now before a
federal appeals court, will discourage the development of good
techniques to protect privacy. On the other hand, laws that implement
Fair Information Practices, such as the Privacy Act of 1974, will have
a positive impact on the development of technology. Privacy legislation
is appropriate for the Internet because it will have a positive impact
on the development of technologies to protect online privacy.
In the matter of Doubleclick, we first brought the Committee's
attention to this problem at a similar hearing a year ago. We warned
that self-regulation would fail to protect privacy and that there would
be a public backlash against the company's plan to profile Internet
users. We think the lesson is clear that legislation is necessary. Even
good models for online advertising can quickly change without baseline
privacy rules.
Going forward, we think the key is the development of techniques
that implement common-sense Fair Information Practices and that
minimize or eliminate the collection of Personally Identifiable
information. Techniques for profiling that are not based on the
identity of an actual user may be acceptable. But any system of
profiling that could be linked to a user, even if that is not intended
at the beginning should be subject to legal safeguards. The experience
with Doubleclick has made this clear.
In terms of P3P, we do not view this as a technology that will
promote privacy. It builds on the very weak ``notice and choice''
approach that is increasingly asking consumers to trade their privacy
for the benefits on electronic commerce. It is not fair to force
consumers to make this choice. Good technologies that aim to protect
consumer privacy will not be built on this model.
We need privacy legislation to establish baseline standards for
electronic commerce. We also need to look closely, with input from
technical experts and experts in privacy, at how best to develop
technologies that protect online privacy. We need a much broader right
of access in the online world than currently exists in the offline
world precisely because the online world enables such far-reaching
profiling. Finally, we need to think more deeply about the true nature
of profiling in the online world. The establishment of persistent
profiles, beyond the control or scrutiny of the individuals affected,
can stigmatize and reduce opportunity for some even as they create
benefits for others.
Testimony
My name is Marc Rotenberg, and I am Executive Director of the
Electronic Privacy Information Center in Washington, DC. I am grateful
for the opportunity to appear before the Committee this morning and
also for your efforts in developing good privacy legislation that
responds to growing public concern. Last year I testified before you on
the growing risks to Internet privacy and described a firm named
Doubleclick that had announced a merger with Abacus Direct. I warned in
my testimony that Doubleclick proposal to profile Internet users showed
the problems with the self-regulatory approach to privacy protection
and that it would lead to a vast privacy backlash.
This morning I will focus my comments specifically on one of the
central questions in the ongoing effort to protect privacy online--what
is the relationship between privacy legislation and privacy technology?
With legislation pending before the Committee, and many companies
developing privacy technologies, I am sure you are trying to understand
the relationship between privacy legislation and privacy technology.
Are they alternatives? Should we have both? What happens with
technology if we continue to go forward without legislation?
Privacy Advocates Have Long Encouraged the Development of Technology to
Protect Privacy
To answer these questions, I need to say a few words about the
establishment of EPIC. The Electronic Privacy Information Center, which
has long favored the adoption of legislation to protect Internet users,
has also been on the front lines to ensure that Internet users would
have access to the best technology to protect privacy. Several years
ago there was a widespread belief in government that it would be
necessary to limit the availability of strong technology, such as
encryption, that would protect personal privacy. We strongly opposed
this view and said that these technologies should be widely available
to the general public. We argued that privacy technology was good for
consumers, good for business, and ultimately good for national
security. We prepared a letter to the President by experts, opposing
the Clipper proposal to establish the escrowed encryption standard.
That letter was later endorsed by 50,000 users of the Internet who
agreed that good technology was critical to good privacy. The
administration eventually changed its views and today the United States
policy on encryption favors the development of good tools to protect
personal privacy, though I should add that it is still the case that
electronic mail is not routinely encrypted, though I think it should
be.
Since the Clipper campaign, we have also urged the development and
adoption of the very best technical means to protect personal privacy.
Our website contains a popular page--Practical Privacy Tools, which was
featured in the New York Times just last week. The page includes
techniques for encryption, anonymity, cookie management, and more.
Members of the EPIC staff have even trained human-rights advocates
and journalists in different parts of the world how to use encryption
to protect their private communications from police forces and
governments that would send a person to jail for what he might write in
a private message. We supported the widespread use of anonymous re-
mailers, PGP, robust encryption, and other privacy tools, when many
industry groups waited quietly in the wings for the policy debate to
play out.
Although lobbyists like to characterize privacy advocates as
favoring ``heavy-handed Government regulation'' in fact we were far
ahead of industry on proposing technical solutions to privacy
protection. We have been pressing for good technical solutions to
protect privacy before the vast majority of Internet-based companies
were even established.
And when groups in industry or government have gone forward with
technical standards that threaten individual privacy--the Clipper chip,
the Intel Processor Serial Number, the FBI wiretap standards, the
Microsoft Global Universal Identifier--we launched national campaigns,
in association with such groups as Junkbusters, the ACLU and others to
bring public attention to the growing risks to privacy.
Privacy Legislation is Critical to Privacy Technology
So why do we favor legislation? The answer is that our experience
over the last ten years shows that you will get better technologies to
protect personal privacy where there a legal framework in place that
establishes baseline privacy standards. The Clipper proposal came about
in the United States but not in Europe or Canada. One of the reasons is
that European and Canadian privacy laws and European and Canadian
privacy agencies prevented the adoption of a technical standard that
would have enabled such widespread surveillance of privacy
communications.
Doubleclick pushed forward with its profiling scheme in the United
States but not in Europe because European law would have required to
Doubleclick to follow a set of privacy rules once it started collecting
personal data. Doubleclick decided it didn't want to bother complying
with privacy rules so it pushed forward in the United States.
Many of the Internet protests that are taking place in the United
States result from the failure to develop good privacy standards. Some
might say that this is because the US is a leader in technology and
first to experience the social consequences when companies go too far.
But in fact, in many critical sectors--online banking, Internet use,
cell phone use--the US is not the leader but is still facing enormous
public concerns about the loss of privacy. The reason is simply that
whereas other countries have made some effort to update their privacy
laws to keep pace with new technology, the US stubbornly refuses to do
so. And in the United States where privacy legislation is in place, you
simply do not see the type of invasive profiling that companies like
Doubleclick have pursued on the Internet.
The message here is simple: privacy laws encourage good business
practices and good privacy technologies. Where those laws exist, you
can have innovation and privacy protection. Where the laws do not
exist, you may still have innovation, but I doubt you will have privacy
protection.
The Profiling Problem is Not New
Although the Internet and Doubleclick appear to raise new problems,
in many ways Congress has confronted similar problems in the past and
developed appropriate legislative solutions.
More than thirty years ago there was a proposal to establish a
centralized databank in the United States called the National Data
Center that would have provided detailed profiles on American citizens.
The purpose was benign. It was believed that such a databank would be
very useful to social scientists and others, but the implications were
severe. People understood that the collection of these permanent
profiles, made possible by computerized automation, would pose a threat
to the privacy and liberty of American citizens. The proposal for the
National Data Center was withdrawn and over time a comprehensive legal
framework--the Privacy Act of 1974--was established to safeguards the
rights of American citizens. The Privacy Act imposed on all federal
agencies essential privacy rights and responsibilities--``Fair
Information Practices''--that would limit would federal agencies could
do with personal information and gave every American the right to see
the information about them that was collected.
Significantly, the Privacy Act did not slow the use of computers.
It simply made the people who were designing those systems more aware
of their obligations to protect the privacy interests of the people
whose information was collected. In other words, the Privacy Act helped
ensure that as automation was introduced in the federal government,
privacy was built-in at the outset.
Now I want to be clear at this point, that I am not defending all
data collection practices by the federal government. I think there are
any number of programs where data collection is too intrusive. Nor do I
think the Privacy Act is beyond criticism. Recent amendments
appropriately strengthened the penalty provisions to help ensure that
there would be sufficient incentives to pursue enforcement, and recent
court opinions have asked, appropriately in my view, whether the
Privacy Act should apply to the White House.
But the critical point is clear: law is necessary to limit
profiling, such law does not discourage innovations, and the US Privacy
Act provides a clear example of how such laws can operate successfully.
Lessons of Doubleclick
To understand Doubleclick, I think it is important to think about
how advertising has operated traditionally. Whether in the print world
with magazine ads and billboards or the communications world with radio
spots and TV ads, advertisers large and small have been able to reach
their audience without collecting any personal information. This is
true when 30 million people watch the same beer commercial on a
television football game or when 30 people see an ad for a used kitchen
table in the classified section of a morning newspaper. Advertisers
communicate information to an audience without trying to create
detailed profiles.
Advertisers have always been able to tailor ads to specific
markets. With the Internet it is even easier to do. The subject matter
can be more focused, the information more timely. Advertisers also get
almost instantaneous feedback on which ads are working and which are
not. Follow an auction on one of the auction sites and you will see
just how well the Internet enables targeted advertising between buyer
and seller and still protects privacy.
All of these factors suggest that the Internet could be a very
effective way for marketers to reach customers with a minimal privacy
intrusion. But Doubleclick, and in fairness, several of its
competitors, pushed the envelope and decided that reaching customers,
regardless of the privacy consequences, was the way to go. Not content
with the most effective and efficient form of advertising ever made
possible, these companies began plans to profile net surfers, to link
anonymous clickstream data with detailed and personally identifiable
purchase records. They called it ``personalization'' but the process is
``profiling'' and the method involves the secretive collection of
personal information about consumers.
The schemes were deeply flawed, both as a matter of policy and
technology. Doubleclick essentially ignored all of the generally
accepted privacy rules. People could not see what information would be
collected or determine how it would be used. Doubleclick couldn't even
comply with their own privacy policy. As we pointed out in our
complaint to the Federal Trade Commission, the privacy policy at the
Doubleclick website was constantly being revised. First, Doubleclick's
privacy policy assured users who received targeted ads from Doubleclick
that they would remain ``completely anonymous.'' Then Doubleclick
dropped the reference to anonymity and said the information was not
``personally identifiable.'' More recently, following the merger with
Abacus Direct, Doubleclick said that if it joined the two databases it
would further revise its privacy statement to reflect its ``modified
data collection and data use practices.''
There was no way any consumer could make a meaningful decision
about whether to disclose personal information to Doubleclick.
Doubleclick could essentially do with the information whatever they
wished. They might as well have scrapped their privacy policy and put
up three words ``subject to change.''
The technology was just as bad. Even Doubleclick's business
partners were not aware of how personal information was being
collected. Kozmo dropped Doubleclick when they realized that videotape
rental records were being transferred by the advertising network, most
likely in violation of the Video Privacy Protection Act. Web sites
offering healthcare advice learned to their chagrin that they were
passing on medical information on their visitors through the
Doubleclick network. Even the opt-out scheme proposed by Doubleclick
had problems. Customers who wanted privacy would be required to store a
Doubleclick cookie on their computer. Not a very smart idea when
consumers, trying to protect their privacy, are routinely deleting
cookies.
By the time Doubleclick dropped the plan, the company was facing
investigation from the Federal Trade Commission, two state attorneys
general, and a host of private litigants. Doubleclick's problems were
hardly caused by the campaigning of a few privacy advocates; virtually
anyone who thought about the long-term implications of profile-based
advertising saw the problem.
Doubleclick CEO Kevin O'Connor was right to admit a mistake and
should be commended for responding, albeit belatedly, to growing public
concern about privacy in the online world. The question now is what
lessons will be learned. Is this simply a matter of ``issue
management,'' or is there an opportunity for a genuine exploration of
how to develop business models for the Internet that are profitable and
also respect consumer privacy? My hope is that the industry will take
the second course. But this will mean taking seriously the need to
develop strong and effective privacy measures.
If net advertisers intend to collect personal information on
Internet users, they should follow the most stringent Fair Information
Practices. That's not just about giving individuals ``notice and
choice,'' it's about allowing individuals to know what the company
knows about them, and to object to the use of the information and even
to have it permanently deleted if they wish. It's about being more open
and accountable in how personal information will be used. Access to a
privacy policy is never as good as actually being able to see how
someone else will use your personal data.
Better of course would be for innovative firms to take advantage of
the extraordinary flexibility of the Internet and develop advertising
models that do not rely on the collection of personally identifiable
information. Several advertising firms currently do this and others
should consider it as well. There is every reason to believe that
advertising models that respect consumer privacy can be made to work in
an environment as dynamic as the Internet.
Support for privacy legislation that would establish baseline
standards across the industry would also be a good move. Self-
regulation has its advantages, but in the world of privacy it simply
protects bad actors. A better approach would establish simple, uniform,
predictable rules for business and consumers. A legal principle in
support of anonymity will do a lot to spur the development of robust
technologies of privacy.
One argument that simply does not fly is that the surreptitious
profiling of customers' private activities--what websites they visit,
what articles they read, what pictures they watch--is necessary to
support the Internet. That's an argument without bounds and one the Net
advertisers should drop quickly if there is going to be a real
discussion about how to protect privacy online. The Internet is growing
rapidly in countries that do not permit these practices. In fact
Internet penetration is higher in several countries that have stronger
privacy rules than the United States.
Consumers are serious about the need for privacy protection on the
Internet, and they do not see a need to trade their privacy for their
ability to use the Net.
The Danger of Notice and Choice
Too often, the privacy problem is viewed as requiring the offering
of notice and choice to consumers. But this is not the approach that
the United States has typically taken to ensure privacy protection in
other sectors, even those where there is rapidly changing technology.
The privacy of cable subscriber records is protected because of a
provision in the Cable Act. The privacy of video rental records is
protected by the Video Privacy Protection. The privacy of telephone
calling records is protected by a series of laws and regulations. But
``choice'' is what consumers face where there is no baseline privacy
protection.
You have probably already heard about something called ``P3P'' and
you are no doubt going to hear more about this in the future. This is a
technical proposal developed by the World Wide Web consortium to
facilitate the collection of personal information on the Internet. Many
in industry believe that this standard will help solve the privacy
problem because it will facilitate choice about privacy practices. But
the real choice offered is not how to protect privacy, but how much
privacy to give up. The FTC Chairman made the point very well that the
reason we need privacy laws today is that consumers are too often asked
to give up their privacy for some benefit.
We need strong technical measures that give people greater control
over the collection and use of personal information, and that limit
where possible the collection and use of personal data. Consumers
should not be forced to choose between the protection of privacy and
the benefits of electronic commerce.
Recommendations
First, we need privacy legislation to establish baseline standards
for electronic commerce. Until there is legislation, you will see
public protests grow. But in those sectors where there is good
legislation, you will hear fewer complaints, except to see that the
laws are in fact enforced. Even where companies are doing the right
thing today, there is no assurance that they will continue to do so
tomorrow. Remember that Doubleclick began with the exact same approach
to Internet advertising that some today will hold up as a model. But
that model collapsed because there were no baseline privacy rights in
place to hold it up.
Second, we need to look closely--with far more input from technical
experts and experts in privacy--at how best to develop technologies
that protect online privacy. Too many of these standard-setting
discussions are dominated by the industry groups that have opposed
privacy legislation and would much prefer technical standards that
encourage people to trade privacy rather than to retain privacy.
Privacy experts believe that we can develop good technical standards
for privacy protection built on a legal framework that protects the
interests of consumers and still encourages innovation. We do not think
that users of the Internet should face a bewildering range of choices
to protect their reasonable expectation of privacy in the collection
and use of their personal information.
We need a much broader right of access in the online world than
currently exists in the offline world precisely because the online
world enables such far-reaching profiling of private behavior in a way
that is simply not possible in the physical world. The FTC's recent
report on this subject failed to make clear this essential point.
Any company that creates a persistent profile on a known user, or
that could be linked to a known user, should be required to make known
to that user all of the information that is acquired and how it is used
in decisions affecting that person's life. The profile should always be
only ``one-click'' away--there is no reason on the Internet that
companies should force users to go through elaborate procedures or pay
fees to obtain this information about themselves. Access will promote
transparency and accountability. It is vital to consumer trust and
confidence.
It would also be appropriate in many cases to give individuals the
right to compel a company to destroy a file that has been created
improperly or used in a way that has caused some harm to the
individual. Data could still be preserved in an aggregate form, but
individuals should be able to tell a company that they no longer have
permission to make use of the personal information that they have
obtained.
Finally, we need to think more deeply about the true nature of
profiling in the online world. Profiling raises significant questions
about identity, grouping, and what information people receive and what
information they do not. Of course, such lines are drawn all the time,
but it is the establishment of persistent profiles, beyond the control
or scrutiny of the individuals affected, that can stigmatize and reduce
opportunity for some even as they create benefits for others. Privacy
law will help make companies more accountable and reduce the risk of
unfair or inaccurate decisionmaking.
Conclusion
We are not simply talking today about Internet privacy. More and
more of our lives--entertainment, private communications, banking,
reading, buying products, getting the news--all of this is taking place
online. We are really talking about the future of privacy in the
twenty-first century and whether there will be good standards in place
to protect personal information or whether companies will be free to
build secret, elaborate profiles that will determine where we go and
what we see in this new world.
Technology will clearly play a role in privacy protection.
Technologies that protect privacy will enable online transactions
without requiring the disclosure of actual identity as much as
possible. Technologies that protect privacy will minimize or eliminate
the collection of personally identifiable information.
But technology is not enough. Legislation that enforces common-
sense Fair Information Practices is necessary to protect the interests
of Internet users and it will also play a critical role in the
development of these new technologies. It will protect privacy where
privacy technologies have not been deployed. It will properly place
burdens on companies that chose not to use good techniques to protect
privacy. And it will support the development of technologies that will
genuinely protect privacy.
We are living in a time when we can still exercise choice over the
future of the Internet. I don't mean simply the choice of a single
person trying to comprehend a complicated privacy policy, but the
choice of a country to safeguard its basic freedoms even as it enjoys
the benefits of new technology. Legislation is the way we express this
choice and legislation is the path toward technologies that will
safeguard privacy interests in the future.
References
Phil Agre and Marc Rotenberg, eds., Technology and Privacy: The New
Landscape (MIT Press 1997)
EPIC Doubleclick page
[www.epic.org/doubletrouble/]
EPIC, Online Guide to Practical Privacy Tools
[http://www.epic.org/privacy/tools.html]
Oscar H. Gandy, Jr., Exploring Identity and Identification in
Cyberspace, Notre Dame Journal of Law (forthcoming)
Junkbusters Doubleclick page
[www.junkbusters.com/doubleclick.html]
Peter G. Neumann, Computer Related Risks (Addison Wesley 1995)
Marc Rotenberg, Testimony and Statement for the Record on The Online
Privacy Protection Act of 1999, S. 809, Before the Subcommittee on
Communications of the Senate Committee on Commerce, Science and
Transportation, 106th Cong., 1st Sess. (July 27, 1999), reprinted in
Congressional Digest, February 2000
``Weblining,'' Businessweek, March 26, 2000
[http://www.businessweek.com/2000/00--14/b3675017.htm]
``Kozmo Delivers `Consumer Racism?', MSNBC, April 12
[http://www.zdnet.com/zdnn/stories/news/0,4586,2534749,00.html]
Attachments
1. LIn the Matter of Doubleclick,, Complaint and Request for
injunction, Request for Investigation and Other Relief, Electronic
Privacy Information Center (EPIC), before the Federal Trade Commission,
February 10, 2000
[http://www.epic.org/privacy/internet/ftc/DCLK--complaint.pdf]
2. ``Privacy on the Internet,'' New York Times, February 22, 2000
(editorial)
Attachment 1
Before the
Federal Trade Commission
Washington, DC 20580
In the Matter of )
)
DoubleClick Inc. )
)
---------------------------------------------------
Complaint and Request for Injunction, Request
for Investigation and for Other Relief
INTRODUCTION
1. This complaint concerns the information collection practices of
DoubleClick Inc. and its business partners. As is set forth in detail
below, DoubleClick Inc. has engaged, and is engaging, in unfair and
deceptive trade practices by tracking the online activities of Internet
users and combining that tracking data with detailed personally-
identifiable information contained in a massive, national marketing
database. DoubleClick Inc. engages in these activities without the
knowledge or consent of the affected consumers, and in contravention of
public assurances that the information it collects on the Internet
would remain anonymous. The public interest requires the Commission to
investigate these practices and to enjoin DoubleClick Inc. from
violating the Federal Trade Commission Act, as alleged herein.
PARTIES
2. The Electronic Privacy Information Center (``EPIC'') is a public
interest research organization in Washington, DC. EPIC is a project of
the Fund for Constitutional Government (``FCG''). FCG is a non-profit
charitable organization established in 1974 to protect civil liberties
and constitutional rights. EPIC's activities include the review of
governmental and private sector policies and practices to determine
their possible impacts on individual privacy interests. Among its other
activities, EPIC has prepared reports and presented Congressional and
administrative agency testimony on Internet and privacy issues.
3. DoubleClick Inc. (``DoubleClick'') was organized as a Delaware
corporation on January 23, 1996. DoubleClick's principal offices are
located at 41 Madison Avenue, 32nd Floor, New York, New York 10010. At
all times material to this complaint, DoubleClick's course of business,
including the acts and practices alleged herein, has been and is in or
affecting commerce, as ``commerce'' is defined in Section 4 of the FTC
Act, 15 U.S.C. Sec. 44.
4. DoubleClick's business partners include more than 1,000 companies
that have agreed to display DoubleClick advertising on the Web sites
they operate and to enable the placement of ``cookies'' on the
computers of Internet users who visit their Web sites. At all times
material to this complaint, such companies' course of business,
including the acts and practices alleged herein, has been and is in or
affecting commerce, as ``commerce'' is defined in Section 4 of the FTC
Act, 15 U.S.C. Sec. 44.
THE IMPORTANCE OF PRIVACY PROTECTION
5. The right of privacy is a personal and fundamental right in the law
of the United States. The privacy of an individual is directly affected
by the collection, use and dissemination of personal information. The
opportunities for an individual to secure employment, insurance and
credit, to obtain medical services, and the rights of due process may
be endangered by the misuse of certain personal information.
6. U.S. privacy law has by tradition protected the privacy of consumers
in the offering of new commercial services enabled by new technologies.
For example, the Cable Act of 1984 protects the privacy of cable
subscriber records created in connection with interactive television
services. The Electronic Communications Privacy Act of 1986 protects
the privacy of electronic mail transmitted over the Internet. The Video
Privacy Protection Act of 1988 protects the privacy of rental records
for video recordings of commercial programs made available to the
public for home viewing.
7. Many Americans are today ``concerned'' or ``very concerned'' about
the loss of privacy, particularly with regard to commercial
transactions that take place over the Internet. One recent poll has
indicated that the ``loss of personal privacy'' is the number one
concern facing the United States in the twenty-first century.
8. The Federal Trade Commission today plays a critical role in
protecting consumer privacy, particularly with respect to the offering
of commercial services over the Internet, and the resulting collection
and use of personal information.
STATEMENT OF FACTS
DoubleClick's Tracking of Online Activities
9. DoubleClick is a leading provider of Internet-based advertising. The
company places advertising messages on Web sites that are part of the
``DoubleClick Network,'' which consists of highly-trafficked Web sites
grouped together by DoubleClick in defined categories of interest.
Participating sites include AltaVista, The Dilbert Zone, Macromedia,
U.S. News Online, PBS Online, Multex Investor Network, Travelocity and
Major League Baseball.
10. DoubleClick tracks the individual Internet users who receive ads at
Web sites in the DoubleClick Network. When a user is first ``served''
an ad, DoubleClick assigns the user a unique number and records that
number in the ``cookie'' file of the user's computer. When the user
subsequently visits a Web site on which DoubleClick serves ads,
DoubleClick reads and records that unique number. DoubleClick has
acknowledged that ``Web sites usually place certain information
(`cookies') on a user's hard drive usually without the user's knowledge
or consent.'' \1\
---------------------------------------------------------------------------
\1\ DoubleClick Inc. Form 10-K/A (Amendment No. 2) for Calendar
Year Ended December 31, 1998.
11. Using the unique numbers contained in cookies, DoubleClick's
``DART'' technology enables advertisers to target and deliver ads to
Web users based on pre-selected criteria. As a user visits Web sites
that utilize DoubleClick's technology, DART collects information
regarding the user and his or her viewing activities and ad responses.
According to DoubleClick, ``[t]he sophisticated tracking and reporting
functionality incorporated into DART provides advertisers with accurate
measurements of ad performance based on selected criteria.'' \2\ In
early 1999, the company described the technology as follows:
---------------------------------------------------------------------------
\2\ Id.
DART's dynamic matching, targeting and delivery functions
enable Web advertisers to target their advertising based on a
variety of factors, including user interests, time of day, day
of week, organization name and size, domain type (i.e.,
commercial, government, education, network), operating system,
server type and version, and keywords. In addition, DoubleClick
offers the ability to match geographic location of the user's
server and organization revenue, if known, through third-party
databases. . . . Further, in order to deliver the
advertisements on the pages that are likely to result in the
best response, DART improves its predictive capabilities by
continuously collecting anonymous information regarding the
---------------------------------------------------------------------------
user's viewing activities and ad responses.
Among other capabilities, DART technology allows advertisers ``to track
a user to the advertiser's own Web site to determine what actions a
user takes following a clickthrough.''
12. Through the use of cookies and DART technology, DoubleClick's
collection of consumer information is extensive. In December 1998, the
company received over 5.3 billion requests for the delivery of ads
generated by approximately 6,400 Web sites. DoubleClick estimates that
more than 48 million users worldwide visited Web sites within the
DoubleClick Network during December 1998. According to Media Metrix,
45.8% of Internet users in the United States visited Web sites within
the DoubleClick Network during the same month. During the fourth
quarter of 1998, DoubleClick placed approximately 18,000 Internet
advertisements for over 2,300 advertisers. In calendar year 1998,
DoubleClick's DART technology delivered approximately 34 billion
advertising impressions worldwide.
13. DoubleClick reportedly has compiled approximately 100 million
Internet user profiles to date.
DoubleClick's Prior Assurances of Anonymity
14. DoubleClick has publicly represented that any information it
collected about Internet users and their online activities was, and
would remain, anonymous. Thus, the ``Privacy Policy'' displayed at the
DoubleClick Web site in 1997 (attached hereto as Exhibit A) provided:
DoubleClick does not know the name, e-mail address, phone
number, or home address of anybody who visits a site in the
DoubleClick Network. All users who receive an ad targeted by
DoubleClick's technology remain completely anonymous. Since we
do not have any information concerning names or addresses, we
do not sell or rent any such information to third parties.
Because of our efforts to keep users anonymous, the information
DoubleClick has is useful only across the DoubleClick Network,
and only in the context of ad selection.
The ``Privacy Policy'' displayed at the DoubleClick Web site in 1997
did not state that it was ``subject to change,'' or otherwise indicate
that the assurance of anonymity was in any way conditional.\3\
---------------------------------------------------------------------------
\3\ The attached print-outs of material displayed at the
DoubleClick Web site in previous years were obtained from cached copies
of Web pages that EPIC accessed through the Google search engine at
http://www.google.com/
Likewise, the ``Privacy Policy'' displayed at the DoubleClick Web site
in 1998 (attached hereto as Exhibit B), when the company served some 34
---------------------------------------------------------------------------
billion advertising impressions, provided:
All users who receive an ad targeted by DoubleClick's
technology remain completely anonymous. We do not sell or rent
any information to third parties. Because of our efforts to
keep users anonymous, the information DoubleClick has is useful
only across sites using the DoubleClick technology and only in
the context of ad selection.
The ``Privacy Policy'' displayed at the DoubleClick Web site in 1998
did not state that it was ``subject to change,'' or otherwise indicate
that the assurance of anonymity was in any way conditional.
15. DoubleClick's business partners have similarly represented that
DoubleClick cookies generated at their Web sites were anonymous and
that no personally-identifiable information would be collected by
DoubleClick or its business partners as a result of the placement of
DoubleClick cookies.
DoubleClick's Acquisition of Ababus Direct
16. On June 13, 1999, DoubleClick entered into an agreement to acquire
Abacus Direct Corporation (``Abacus''), a leading provider of
specialized consumer information and analysis for the direct marketing
industry.
17. Abacus created and directs the Abacus Alliance, a cooperative
arrangement through which more than 1,050 direct marketers contribute
their customers' purchasing histories to Abacus for inclusion in a
comprehensive database. As of December 31, 1998, the Abacus database
contained over 88 million detailed buyer profiles compiled from records
of over 2 billion catalog purchasing transactions. Abacus claims that
the Abacus Alliance members include over 75% of the largest consumer
merchandise catalogs in the United States. The database is continually
enhanced as members contribute current sales transaction information
and as additional companies join the Abacus Alliance.
18. Since at least as early as 1998, the Abacus database has contained
information identifying and tracking the activities of Internet users.
On November 2, 1998, Abacus formed a strategic alliance with Catalog
City, Inc., an on-line catalog Web site offering on-line shopping
services to catalog shoppers, to jointly promote each others services
and share certain ``e-commerce data.'' That information includes
consumer e-mail addresses and phone numbers, online transactions and
``click data.''
DoubleClick's Intention to Combine ``Personally-Identifiable
Information'' and ``Non-Personally-Identifiable Information''
19. Subsequent to entering into the agreement to acquire Abacus,
DoubleClick began to distance itself from its earlier assurances that
users would ``remain completely anonymous.'' A revised ``Privacy
Policy'' posted on the DoubleClick Web site in or around June 1999
(attached hereto as Exhibit C) stated:
In the course of delivering an ad to you, DoubleClick does not
collect any personally-identifiable information about you, such
as your name, address, phone number or e-mail address.
DoubleClick does, however, collect certain non-personally-
identifiable information about you, such as the server your
computer is logged onto or your browser type (for example,
Netscape or Internet Explorer). The information collected by
DoubleClick is used for the purpose of targeting ads and
measuring ad effectiveness on behalf of DoubleClick's
advertisers and Web publishers who specifically request it. . .
.
In addition, in connection solely with the delivery of ads via
DoubleClick technology to one particular Web publisher's Web
site, DoubleClick combines the non-personally-identifiable data
collected by DoubleClick from a user's computer with the log-in
name and demographic data about users collected by the Web
publisher and furnished to DoubleClick for the purpose of ad
targeting.
There are some cases when a user voluntarily provides personal
information in response to an ad (a survey or purchase form,
for example). In these situations, DoubleClick (or a third
party engaged by DoubleClick) collects the information on
behalf of the advertiser and/or Web site. This information is
used by the advertiser and/or Web site so that you can receive
the goods, services or information that you requested. Where
indicated in some requests, DoubleClick may use this
information in aggregate form to get a more precise profile of
the type of individuals viewing ads or visiting the Web sites.
20. Under the heading of ``Future Plans,'' DoubleClick stated as
follows in its revised ``Privacy Policy'' posted on the DoubleClick Web
site in or around June 1999:
On June 14, 1999, DoubleClick and Abacus Direct Corporation
announced their plan to merge in the third quarter of 1999.
Abacus currently maintains a database consisting of personally-
identifiable information used primarily for off-line direct
marketing. DoubleClick has no rights or plans to use Abacus'
database information prior to the completion of the merger.
Upon completion of the merger, should DoubleClick ever match
the non-personally-identifiable information collected by
DoubleClick with Abacus' database information, DoubleClick will
revise this Privacy Statement to accurately reflect its
modified data collection and data use policies and ensure that
you have adequate notice of any changes and a choice to
participate.
There is no indication that DoubleClick's business partners, who
operate the Web sites at which Internet users convey personally-
identifying cookies to DoubleClick, made similar revisions to the
privacy statements posted at their Web sites.
21. On November 23, 1999, DoubleClick completed its acquisition of
Abacus. For the first time, DoubleClick stated that ``personally-
identifiable information'' (including ``the user's name, address,
retail, catalog and online purchase history, and demographic data'')
would be combined with ``non-personally-identifiable information
collected by DoubleClick from Web sites on the DoubleClick Network.''
Specifically, a revised ``Privacy Policy'' currently (as of February 9,
2000) posted on the DoubleClick Web site (attached hereto as Exhibit D)
states as follows:
On November 23, 1999, DoubleClick Inc. completed its merger
with Abacus Direct Corporation. Abacus, now a division of
DoubleClick, will continue to operate Abacus Direct, the direct
mail element of the Abacus Alliance. In addition, Abacus has
begun building Abacus Online, the Internet element of the
Abacus Alliance.
The Abacus Online portion of the Abacus Alliance will enable
U.S. consumers on the Internet to receive advertising messages
tailored to their individual interests. As with all DoubleClick
products and services, Abacus Online is fully committed to
offering online consumers notice about the collection and use
of personal information about them, and the choice not to
participate. Abacus Online will maintain a database consisting
of personally-identifiable information about those Internet
users who have received notice that their personal information
will be used for online marketing purposes and associated with
information about them available from other sources, and who
have been offered the choice not to receive these tailored
messages. The notice and opportunity to choose will appear on
those Web sites that contribute user information to the Abacus
Alliance, usually when the user is given the opportunity to
provide personally identifiable information (e.g., on a user
registration page, or on an order form).
Abacus, on behalf of Internet retailers and advertisers, will
use statistical modeling techniques to identify those online
consumers in the Abacus Online database who would most likely
be interested in a particular product or service. All
advertising messages delivered to online consumers identified
by Abacus Online will be delivered by DoubleClick's patented
DART technology.
Strict efforts will be made to ensure that all information in
the Abacus Online database is collected in a manner that gives
users clear notice and choice. Personally-identifiable
information in the Abacus Online database will not be sold or
disclosed to any merchant, advertiser or Web publisher.
Name and address information volunteered by a user on an Abacus
Alliance Web site is associated by Abacus through the use of a
match code and the DoubleClick cookie with other information
about that individual. Information in the Abacus Online
database includes the user's name, address, retail, catalog and
online purchase history, and demographic data. The database
also includes the user's non-personally-identifiable
information collected by Web sites and other businesses with
which DoubleClick does business. Unless specifically disclosed
to the contrary in a Web site's privacy policy, most non-
personally-identifiable information collected by DoubleClick
from Web sites on the DoubleClick Network is included in the
Abacus Online database. However, the Abacus Online database
will not associate any personally-identifiable medical,
financial, or sexual preference information with an individual.
Neither will it associate information from children.
The Inadequacy of DoubleClick's ``Opt-Out'' Procedure
22. The most recent version of DoubleClick's ``Privacy Policy''
purports to offer users the ability to ``opt-out'' of the information
sharing activities described above. It states, in pertinent part:
While some third parties offer programs to manually delete your
cookies, DoubleClick goes one step further by offering you a
``blank'' or ``opt-out cookie'' to prevent any data from being
associated with your browser or you individually. If you do not
want the benefits of cookies, there is a simple procedure that
allows you to deny or accept this feature. By denying
DoubleClick's cookies, ads delivered to you by DoubleClick can
only be targeted based on the non-personally-identifiable
information that is available from the Internet environment,
including information about your browser type and Internet
service provider. By denying the DoubleClick cookie, we are
unable to recognize your browser from one visit to the next,
and you may therefore notice that you receive the same ad
multiple times.
23. The vast majority of Internet users who receive cookies from
DoubleClick never visit the DoubleClick Web site and therefore never
learn of the ``opt-out'' procedures described by the company.
DoubleClick cookies are placed on users' computers when users visit
third-party Web sites that display ads placed by DoubleClick. Users are
rarely given notice by such third-party Web sites that they need to
visit the DoubleClick Web site in order to understand DoubleClick's
data collection activities or learn about any available ``opt-out''
procedures.
24. A large percentage of DoubleClick cookies are placed on the
computers of users who visit the AltaVista Web site. Approximately
18.7% of DoubleClick's revenues for the nine months ended September 30,
1999, resulted from advertisements delivered on or through the
AltaVista Web site. Approximately 41.2% of DoubleClick's systems
revenues for the nine months ended September 30, 1999, resulted from
AltaVista billings.\4\
---------------------------------------------------------------------------
\4\ DoubleClick Inc. Form 10-Q for the Quarterly Period Ended
September 30, 1999
25. Visitors to the AltaVista Web site are not provided notice that
their use of the AltaVista site will result in the placement of
DoubleClick cookies on their computers. The AltaVista ``Privacy
Policy'' displayed on February 9, 2000 (attached hereto as Exhibit E)
---------------------------------------------------------------------------
provides, in pertinent part:
AltaVista uses one or more third party companies to serve
advertisements at our site. These companies may use cookies to
ensure that you do not see the same advertisements too often,
but they also may collect information about you when you view
or click an advertisement at our site. Cookies that are
received with advertisements are read and placed by one of our
advertising companies, and AltaVista does not have access to
them, nor can we control how they are used.
The AltaVista ``Privacy Policy'' does not contain any reference to
DoubleClick.
Inaccurate Information Posted by DoubleClick's Partners
26. Some third-party Web sites that generate DoubleClick cookies do
inform users of their relationship with DoubleClick and that
DoubleClick places cookies on the computers of users who visit such
third-party sites. Some of those Web sites continue to assure users
that they will remain anonymous. For instance, the ``Privacy Stuff ''
page at the Dilbert TV Web site (attached hereto as Exhibit F)
displayed the following information on February 9, 2000:
United Media contracts with DoubleClick to sell and manage the
advertisements that you see on this site. The advertisements
help us bring you the United Media site without charge.
DoubleClick uses ``cookies'' to improve the quality of your
visit to the Dilbert TV Web site. . . .
DoubleClick uses cookies to make sure that you do not see the
same advertisements repeatedly and when possible, shows
advertising that is relevant to you based on what you have seen
previously. Cookies are anonymous. DoubleClick does not know
the name, e-mail address, phone number, or home address of
anybody who visits the United Media site or any other site in
the DoubleClick Network. All users receiving an ad from
DoubleClick through the United Media site therefore remain
entirely anonymous to DoubleClick; DoubleClick does not have
any information to sell or rent to other parties.
VIOLATIONS OF SECTION 5 OF THE FTC ACT
27. Section 5(a) of the FTC Act, 15 U.S.C. Sec. 45(a), prohibits unfair
or deceptive acts or practices in or affecting commerce.
DoubleClick's Activities Constitute Deceptive Trade Practices
28. DoubleClick has publicly represented that any information it
collected about Internet users and their online activities was, and
would remain, anonymous.
29. In truth and in fact, DoubleClick intends to combine data it has
consistently described as ``non-personally-identifiable information''
with users' names, addresses, retail, catalog and online purchase
histories, and other personally-identifiable information contained in
the Abacus database. Therefore, DoubleClick's representations
concerning the anonymity of information it collected and collects about
Internet users were, and are, deceptive practices.
DoubleClick's Activities Constitute Unfair Trade Practices
30. DoubleClick's collection of information about Internet users,
through the placement of cookies on users' computers and the linkage of
cookie-generated data with information contained in the Abacus
database, is performed without the knowledge or consent of the great
majority of Internet users who receive DoubleClick cookies. Users who
receive DoubleClick cookies on their computers do not knowingly access
the DoubleClick Web site. Many of DoubleClick's partners, who operate
the Web sites which generate DoubleClick cookies, provide either no
information or inaccurate information about the placement of such
cookies and the manner in which data about users will be collected or
used. As a result, the great majority of users who receive DoubleClick
cookies neither know that their activities are being monitored, nor are
aware of any ``opt-out'' procedures that might be available.
31. DoubleClick's collection of information about Internet users,
through the placement of cookies on users' computers and the linkage of
cookie-generated data with information contained in the Abacus
database, without the knowledge or consent of Internet users, is likely
to cause substantial injury to consumers which is not reasonably
avoidable by consumers and not outweighed by countervailing benefits to
consumers or competition, and therefore is an unfair practice.
32. DoubleClick has publicly represented that any information it
collected about Internet users and their online activities was, and
would remain, anonymous.
33. DoubleClick's plan to combine ``non-personally-identifiable
information'' with users' names, addresses, retail, catalog and online
purchase histories, and other personally-identifiable information
contained in the Abacus database, in violation of its representations
to the contrary, is likely to cause substantial injury to consumers
which is not reasonably avoidable by consumers and not outweighed by
countervailing benefits to consumers or competition, and therefore is
an unfair practice.
Consumer Injury
34. DoubleClick's conduct, as set forth above, has injured consumers
throughout the United States by invading their privacy; using
information obtained through the placement of DoubleClick cookies in
ways and for purposes other than those consented to or relied upon by
such consumers; causing them to believe, falsely, that their online
activities would remain anonymous; and undermining their ability to
avail themselves of the privacy protections promised by online
companies.
35. Absent injunctive relief by the Commission, DoubleClick is likely
to continue to injure consumers and harm the public interest.
36. Absent injunctive relief by the Commission in this matter, other
companies will be encouraged to collect personally-identifiable
information from consumers in an unfair and deceptive manner.
37. Absent injunctive relief by the Commission in this matter, the
privacy interests of consumers engaging in online commerce and other
Internet activities will be significantly diminished.
REQUEST FOR RELIEF
WHEREFORE, EPIC requests that the Commission:
A. Initiate an investigation into the information collection and
advertising practices of DoubleClick and the Web sites on which
DoubleClick places advertisements and/or generates cookies on the
computers of Internet users;
B. Order DoubleClick to destroy all records it created concerning
Internet users during any period of time in which DoubleClick or any of
its business partners were assuring the anonymity of the information
DoubleClick collected;
C. Order DoubleClick to obtain the express consent of any Internet user
about whom DoubleClick intends to create a personally-identifiable
record, and to develop such means as are necessary to ensure that the
user has access to the complete contents of the record;
D. Order DoubleClick to pay a civil penalty equal to fifty percent
(50%) of the revenues it obtained as a result of the practices
described herein, or such other civil penalty as may be appropriate;
E. Permanently enjoin DoubleClick from violating the FTC Act, as
alleged herein; and
F. Provide such other relief as the Commission finds necessary to
redress injury to consumers resulting from DoubleClick's violations of
the FTC Act.
Respectfully Submitted,
Marc Rotenberg David L. Sobel
Executive Director General Counsel
______
Attachment 2
Privacy on the Internet
February 22, 2000, New York Times
As the Internet matures, preserving user privacy and anonymity is
becoming a significant problem. Technology now makes it possible for
online businesses and advertisers to turn the Internet into a realm
where activities and habits are monitored and recorded, largely without
consumer knowledge or consent. Unless businesses can protect privacy,
the erosion of trust could seriously harm e-commerce as well as cause
the public to become wary about using the Internet for education,
research and other important non-commercial functions.
In the offline world, a big part of personal privacy is simply the
freedom to remain a face in the crowd. No one tracks a shopper as he
visits various stores in a mall or keeps notes on what products he
looks at. But in cyberspace, that shopper's behavior--which Web sites
he visits, and which ads he clicks on--can all be instantly recorded
and compiled, albeit through computer-based identifiers rather than by
name. Most consumers have little idea that unseen advertising networks
on the Internet track their movements across multiple Web sites. Most
do not know that Web sites can collect and sell data about them. But
consumer concerns are rising, and businesses are getting worried about
a privacy backlash.
This month the Electronic Privacy Information Center, an advocacy
group, filed a complaint against DoubleClick with the Federal Trade
Commission, alleging unfair trade practices in its tracking of the
online activities of millions of Internet users. DoubleClick, the
leading Internet advertising company, places ads for its clients on
about 1,500 Web sites--including many of the most heavily used sites
such as AltaVista--that are part of the DoubleClick network. When a
computer user views an ad on a network site, DoubleClick places a
``cookie'' file on the user's computer hard drive that carries a
special identifying number. The cookie allows DoubleClick to monitor
the user's computer--though without being able to identify the user by
name or address--whenever he visits a network site, and note the
content he is viewing to deliver a targeted ad that is customized to a
user's interests.
Last year DoubleClick acquired Abacus Direct, a company that has a
database of millions of names, addresses and other personal information
collected by the nation's largest direct-mail catalogues. Now
DoubleClick is building an online version of Abacus, and will be able
to match personally identifiable information on purchasers collected by
the online Abacus with DoubleClick's data on those individuals'
subsequent Web activities.
DoubleClick says it will give users the opportunity to opt out of
this matching. But privacy advocates fear that this kind of data
collection will become widespread in cyberspace, and that personal
information--from browsing habits to the research one might do on the
Web--could potentially be released to employers, insurers and others.
Industry's answer to these worries is self-regulation and the creation
of privacy policies. Unfortunately, even good policies are largely
unenforceable. A new study by the California HealthCare Foundation of
21 major health-related Web sites found that many violated their own
stated privacy policies, and shared personal information collected from
visitors without their permission.
One solution is to give users easier ways to block the collection
of information. DoubleClick, responding to public criticism, has begun
a campaign to tell users how to opt out of tracking. The World Wide Web
Consortium, the group that designs standards for the Web, is creating a
new way for Web sites to transmit the site's privacy policy
automatically, and allow users to signal only the information they are
willing to share.
Also, several Internet privacy bills have been introduced in
Congress. Businesses are concerned that government regulations could
hinder the Internet's dynamism. Many users may want to receive ads
aimed at their interests. But all users should get a meaningful choice
about how personal data are collected and used. Maintaining privacy
will be integral to the Internet's future, if only because consumers
need to feel safe enough to participate.
The Chairman. Thank you very much.
Mr. Smith, welcome.
STATEMENT OF RICHARD SMITH, INTERNET CONSULTANT
Mr. Smith. Thank you for the invitation here to speak today
before this Committee. My background is technical. I have been
in the computer business for approximately 30 years and have
also run my own businesses for about the last 20 years.
Since September of this past year, I have taken a
sabbatical and begun looking at the issues of Internet privacy
and security. What I would like to do today is talk a little
bit and expand upon the excellent presentation that was made by
Jodie of the FTC here of some of the technology that is going
on behind the scenes here.
In my written testimony, I have--I want to start off here
with exhibit A here, as I call it, which illustrates one of the
issues of how ad targeting is done today. This is from the
AltaVista search engine. If you have used the search engine,
you probably noticed after a while that the banner ads that you
see at the search engine are related to what you are searching
for. This is not an accident, because companies can purchase
keywords and whatever keyword you type in you get a relevant
ad. So for example, here I have typed in ``sports cars'' and I
get a Toyota ad. I type in ``vacation homes'' and I get an ad
for move.com.
This practice has been going on for 3 or 4 years and is
really, I would say, not necessarily a privacy-unfriendly
technology. But we get down into some other interesting issues
here. I found this one accidentally. I typed in ``growing pot''
and I got an anti-drug ad. This actually comes from the White
House, so even the government is involved in buying these
keywords.
We are doing some medical conditions here. I typed in
``AIDS'' and get a pitch for an anti-HIV drug. ``Compulsive
gambling,'' I get a banner ad for an online casino. I think
that is a little mess-up there.
Given the political nature of this today, I thought I would
also try ``Al Gore'' and ``George Bush'' here. It looked like
they are owned--pardon me--the keywords are owned by women.com.
The idea here is that this illustrates sort of the birth of
online profiling, is that the Internet ad companies noticed
that you could begin discerning a lot about people by how they
search. This is, as Daniel has talked about, one of the ways
that information is put into our profiles, by watching
everything we search for. As a matter of fact, at the AltaVista
search engine, Engage today is using this kind of information.
I want to go on to the topic of web bugs because that came
up a little bit earlier. It is a technology. Basically the idea
is you have a web page and you put an invisible image on the
page, if you are a network advertiser or a marketing company,
to monitor who comes to web pages. They act like banner ads in
the sense that they provide back the same information, but they
obviously, they are totally hidden. They are only one by one
pixel in size.
The problem that I have with them is I think they have very
much undermined the trust in the Internet because they are very
much a tracking device. Some sites that have web bugs on them
today are I think we would all agree very sensitive in nature.
For example, Procrit, it is a drug from Johnson and Johnson,
has approximately five web bugs on the website from
DoubleClick. The home page is one of the pages bugged, as well
as each of the conditions, the page on AIDS, the page on kidney
diseases, and the page on cancer.
So we can see in this case here that DoubleClick has been
hired to do monitoring of users at that site. So I am kind of
interested about this idea that network advertisers do not get
into monitoring sensitive issues.
Another technology, or it is not really a technology, but a
problem that we have with network advertisers, is that of what
I term as data spills. The idea behind a data spill is that if
you type in data on a web form and it goes into the website--
for example, an example I found was at Intuit you would type in
information about your financial information to see if you
could get a mortgage. That information was accidentally leaked
off to DoubleClick through the use of banner ads.
This is a bug, this is a problem or a mistake that the
Intuit website made, but that does illustrate that this data
that is being sent in to the ad networks sometimes is very
personal in nature. In a two-month period, for example, I found
approximately ten data leaks to DoubleClick--things like my
name, address, and e-mail address.
Another issue that I would like to get into real quickly
here is the issue of notice. The industry talks about one of
the things that we need here is notice and the idea that
websites would link to the privacy policies of network
advertisers so they could learn about the online profiling.
Well, over the weekend I did a quick check here with the
AltaVista search engine and found, for example, with the case
of DoubleClick, although they have 12,000 websites that they
provide banner ads to, only about 130 of those sites had links
to their privacy policy. So if you wanted to opt out at
DoubleClick, there are very little ways to understand about
that.
The same thing was true with Engage and its family of
companies. AltaVista shows less than a hundred links to their
privacy policies.
Finally, I would like to end up my testimony with just a
quick remark to give folks an idea how different the Internet
is than any other media in terms of tracking. On my computer I
monitor all traffic that goes in and out of the computer on the
Internet. Over the past 6 months I have had 250,000
transactions, that is web pages and images and java script
applets that have been downloaded. Of those, 27,000 URL's went
back to DoubleClick. So they got back 27,000 URL's of web pages
that I was at.
So we are dealing with a very different medium than
anything else in the offline world. For example, my credit card
company, my bank, and my telephone company do not know about
anywhere--do not get that amount of information about me each
and every day. That works out to about 150 transactions a day.
Thank you very much.
[The prepared statement of Mr. Smith follows:]
Prepared Statement of Richard Smith, Internet Consultant
Introduction
To begin with, I would like to first thank the Chairman and the
Senate Committee on Commerce, Science, and Transportation for this
opportunity to testify today on the issue of online profiling and its
impact on consumer privacy. It is indeed an honor to be here.
My own background is that I have spent almost 30 years in the
computer software business both as a software engineer as well as a
business owner. I retired last September as the President of Phar Lap
Software, Inc., a company I co-founded 14 years ago. Since leaving Phar
Lap, I have worked as a consultant specializing in Internet security
and privacy issues.
The issue of online profiling is very controversial. The reason is
quite simple to understand. Most consumers are very bothered by the
fact that companies are monitoring their Web surfing habits. In
addition, consumers are almost never informed about these monitoring
activities and have never been asked if it is okay. To many people who
learn about online profiling for the first time, their first impression
is that it is something right out of Orwell's 1984.
In my testimony today, I will be focusing on two major areas. To
begin with, I will talk about how data is collected by Internet ad
companies for use in online profiles. To date, I do not think that ad
companies have been totally straight with consumers with their data
collection practices. The second area I want to talk about today is the
lack of proper notice to consumers about online profiling. I will be
using real-life examples of some of things that I have seen in my own
use of the Internet.
Along the way, I want to also suggest an alternative to online
profiling which is content-based targeting for banner ads. Content-
based targeting is typically employed in the off-line world
(newspapers, TV, and magazines). It is much more privacy friendly than
online profiling because it requires no tracking of individual users as
they surf the Internet. The most banner ads shown today are already
using content-based targeting because it is easy to understand and
favored by advertisers.
How Data Is Collected For Online Profiles
To begin the discussion of data collection practices of Internet ad
companies, the best place to start looking is at Internet search engine
sites. Everyone seems to have their own favorite search engine and mine
happens to be AltaVista. It also turns out that the AltaVista site has
business relationships with DoubleClick and Engage who both are also
testifying here today.
Most people probably have noticed at one time or another that the
banner ads that they see on a search results page are related to what
they are searching for. This is no accident. AltaVista employs
DoubleClick to show banner ads at the site. One of the services that
DoubleClick provides for advertisers is the ability to ``purchase''
keywords at the site. When a company owns a particular keyword or
phrase, their banner ads will appear of the search results page for the
keyword or phrase. Keywords are typically purchased on a month-by-month
basis. They can be purchased either on an exclusive basis or can be
shared with other companies.
Exhibit A illustrates how some common keywords such as ``sports
cars'' and ``vacation homes'' will show relevant banner ads at
AltaVista. A version of Exhibit A is also available at my Web site that
shows in real-time what banner ads are being shown for common keywords.
This demonstration is available at:
http://www.tiac.net/users/smiths/commerce/avads.htm
Advertisers like keyword targeted ads because it is more likely
that people seeing their ads will be interested in their products.
DoubleClick and AltaVista also like keyword targeted ads because they
can charge a premium for them. This premium is typically 2 to 3 times
more than standard ads at AltaVista.
But what about the consumer? How do they feel about keyword-
targeted ads? The answers are a bit more difficult to come by. When
many consumers notice keyword-targeted ads for the first time they get
a bit uncomfortable. They realize that someone is watching them as they
search the Internet with AltaVista. Most folks do not like to be
watched and one of the first association that comes to mind is 1984. On
the other hand, I think most people will agree that if they are going
to see banner ads at Web sites, they might as well be relevant to their
interests.
AltaVista did not help matters much, because until January of this
year, they did not disclose to users that banner ads can be targeted to
search phrases. They also have made mixed efforts in informing users
about their relationship with DoubleClick. However, a savvy Web user
today who reads the AltaVista privacy policy will learn both about
keyword-targeted ads and DoubleClick.
So do keyword-targeted ads present a privacy problem for users? I
personally do not think so. In the Yellows Pages, we see ads for car
dealerships in the automobile section. The same is true with the search
results page for ``cars'' at AltaVista. I believe that this type of
content-based targeting is valuable to both advertisers and consumers.
It is an example of good Internet marketing.
However, there still are the concerns of consumers that they are
being watched when they see keyword-targeted ads. How can these
concerns be addressed? The first part of the solution is to provide
adequate notice to consumers about the practice. For example, some of
the search engine companies are now disclosing this practice in their
privacy policies. The real answer for consumers is to make it clear
that that their search strings are never saved in a database. Except
for keeping aggregate statistics on the popularity of keywords,
people's search strings should be discarded. More about this issue
shortly.
But how does DoubleClick know what ad to display for a search
keyword in the first place? Very simply, AltaVista gives DoubleClick,
everyone's search strings. The hand-off is done right on the search
results page. A banner ad is displayed as a image, and the URL of image
is specially constructed by AltaVista to include the search string.
Here is what one of these banner ad image tags looks like for the
search string ``sports cars'':
You will notice that the search string is embedded as the ``kw''
parameter in the image URL.
So DoubleClick is being sent everyone's search strings at
AltaVista. Pretty obviously you can learn a lot about a person by
observing what they are searching for on the Internet. The ad network
companies have realized this also and invented the idea of online
profiling. The basic concept is for the ad server computers of the ad
companies to track over time what an individual is searching for and to
provide relevant ads to according to their search history. These
personalized banner ads can be shown whenever someone searches for a
keyword that has not been purchased by an advertiser. These same
personalized ads can also be shown at other Web sites in the same ad
network.
However it is pretty cumbersome for an ad network to remember every
little search string that someone has used. Such a list does not lend
itself to quickly selecting an ad for a user. In general, an ad server
must decide on what ad a user sees in about 1/100 of a second. So in
order to meet this time constraint, Internet ad companies instead build
profiles of people. A profile is a table that rates a person on their
level of interest in particular subjects. A profile might contain up to
a thousand different subjects areas. These subjects areas might include
things like sports (golf, tennis, football, etc.), travel (US, Canada,
Europe, etc.) and food (cooking, gardening, etc.). A person is then
scored for each of these subject areas. A score is a percentage. Zero
percentage meaning no interesting, while one hundred percentage means
extremely interested. These scores are updated in real-time from search
strings and other data.
Advertisers can then target groups of users by instructing an
Internet ad network to show their ads to people who have certain
characteristics in their profiles. For example, a ski resort may want
to have their ads to be shown only to people who appear by their
profiles to have a strong interest in skiing. The targeting might also
be indirect. A car company might target ads for their luxury models at
people who show an interest in European travel, while their middle-of-
the-road models might be pitched to people who show an interest in
American travel.
An online profile is created for a user the first time they are
shown a banner ad from a particular Internet ad network. All of the
scores in the profile are set to zero. The profile is stored at the ad
server computers. It is updated in real-time according to the following
information that is received by Internet ad networks:
What search strings an individual searches for
What Web pages an individual visits
What banner ads an individual clicks on
A user can be tracked by an Internet ad company on any Web page
that a banner ad appears that is served by the company.
In addition to their profile, a user is also assigned a unique
customer ID number. This ID number is stored with the profile to
identify who the profile belongs to. The ID number is also sent back to
the user's computer as a cookie and stored on the hard drive of the
computer. Then as the user surfs the Web and is shown more banner ads,
this customer ID number is sent back to the Internet ad network with
each and every request for a banner ad. The cookie is the mechanism
that allows Internet ad networks to track people over time.
Cookies are anonymous in the sense that they do not say who a
person is. However, personal information can be associated with a
cookie and stored with a profile if a user provides this information to
an Internet ad company. This is typically done using some sort of
online contest or sweepstake where users are required to provide their
names, addresses, and phone numbers. As an example, DoubleClick
operates a Web site called NetDeals (http://www.netdeals.com) for this
purpose.
In addition, using a technique called ``cookie synchronization'',
it is possible for one Web site to provide an Internet ad network with
personal and demographic data about users. Again this information can
be associated with a cookie and stored in an online profile.
Excite@Home is apparently using this technique to provide registration
data to its sister company, MatchLogic, an Internet ad company.
On paper, the economic benefits of online profiling seem self-
evident. In theory, a profiled banner ad should have an increased
response rate because it is being better targeted. Advertisers can
purchase a smaller number of ad impressions in order to get the same
results. Ad networks can charge more money per ad impression because
the higher perceived value. Consumers are suppose to benefit because
they will see less ads about products that they no interest in.
However in practice, the value of online profiling is yet to be
proven. The industry has not released any studies that show response
rates are significantly higher for profiled ads. In addition, the
response rates need to go up more than the costs of profiling. These
costs include the premium paid for ads themselves plus the time it
takes to figure out what profile works best for a particular ad. This
second point is very important. It is unclear if advertisers can use
all of the data that Internet ad companies can provide them. This point
was made recently in a New York Times article by Saul Hansell:
``So Far, Big Brother Isn't Big Business''
http://www.nytimes.com/library/financial/personal/
050700personal-privacy.html
May 7, 2000
``The few advertisers that have tried these systems have not
yet given up on them. But most say the response to their ads
does not go up enough to be worth the extra cost and bother. It
seems easier for them to buy cheap shotguns, in effect, than
expensive laser-guided rifles.''
Regardless if online profiling systems make economic sense or not,
from a privacy standpoint, they present some real dangers. These
systems are monitoring people as they surf Internet. What data is being
collected and what is being saved away is not made very clear. All of
the uses of this data is not disclosed and may change over time. Also
in spite of claims by Internet ad companies that the profiles are
anonymous almost all of these companies maintain separate databases
with personal data that can be combine with the anonymous profiles at
anytime using cookie synchronization.
However the real danger that I see with online profiling is that
Internet ad companies have set up extensive monitoring systems to
provide data for profiling. It is almost like they have put hidden
microphones in our homes and our offices and they listening to what we
do all day long. Pretty obviously if you deploy hidden microphones, you
are going to pick up information which is personal in nature. And this
is exactly what I have found on my own computer. The data collection
systems that the Internet ad companies are currently running are
getting personal and sensitive information that almost everyone will
agree is none of the business of these companies. The problem here is
one of collateral damage
Data Spills
The first problem that I have seen at many Web sites is the problem
of data spills. A data spill is where information that is typed into a
form at a Web site is accidentally sent off to an Internet ad company.
Data spills are caused by poor Web site design Because I do logging of
my Internet traffic from my computer, I can detect data spills. In a
two-month period, I found close to 10 data spills of personal data to
DoubleClick. These data spills include things like my name, home
address, Email address, and birth date. Web sites that were sending off
this data to DoubleClick included well-known sites like AltaVista, Real
Networks, HealthCentral, Quicken, and Travelocity.
My Web site includes a write-up that describes how data spills
occur in the first place and how they can be prevented. The URL of the
write-up is available at:
http://www.tiac.net/users/smiths/privacy/banads.htm
In the write-up, I talk mostly about DoubleClick. They are going to
be receiving the most information from data spills given that they are
largest provider of banner ads. However, the problem can occur with any
banner ad network and all companies are receiving this kind of personal
data from Internet users. A recent example of data spill really
illustrates the point. I found that on my computer the sign-up page for
the contest Web site, Jackpot.com, gave away my Email address to three
different companies all at the same time. The companies receiving my
Email address were Flycast, YesMail, and Sabela. The Jackpot.com
privacy policy states they never share personal data, but they seem to
have a tough time keeping this promise. My enquiry to the company about
the issue was answered with a denial that there was any problem. The
customer support person simply repeated the claims of the privacy
policy.
In general, Jackpot.com is the exception rather than the rule.
Other Web sites have been more response and fixed the problems right
away when I have brought them to their attention. In addition, in some
discussions I have had with the Internet ad companies, they have made
it clear that they do not want this of type of unsolicited personal
information from users. However, from their perspective it is a problem
they cannot directly solve because the issues are with the Web sites
running the banner ads and not at the ad servers.
In the near term, I am hoping to see Internet ad companies publicly
commit to not use this unsolicited personal data from data spills. The
best place to do this I think is in their privacy policies. The idea
here is to acknowledge the problem that Web sites may accidentally give
away personal data, but the Internet ad networks will discard it and
not make use it.
Over the long term, there is a simple technology solution to the
problem that can be implemented by Web browser companies. This solution
involves eliminating referring URLs for being sent in situations where
a data spill is likely to occur. Referring URLs can contain the
personal data in a data spill.
Web Bugs
Besides banner ads, Internet Ad companies also track users with
something I've nicknamed ``Web Bugs.'' A Web Bug is an invisible image
on a Web page that sends back the cookie of an Internet ad company to
their servers. The main purpose of a Web Bug is to track what pages
users are going to the Internet. Given that images are invisible on the
page, the averagel user has no way of knowing that they are being
tracked in this manner. In addition, to my knowledge, no Web site or
Internet ad company has every disclosed the use of Web Bugs in their
privacy policies.
Pretty obviously, people in the Internet ad business do not call
these invisible images ``Web Bugs'. Instead they use names like ``clear
GIFs'', ``1-by-1 pixels'', ``tracker GIFs'', and sensors. Since no one
has come up with a consistent name for them, I will continue to use the
term ``Web Bugs''.
Even though there has not been very much public discussion about
Web Bugs, they seemed to be employed by most Internet marketing
companies. In my discussions with these companies, I have been told
that they are used for these purposes:
The see who has come to a Web site after viewing a banner ad
To transfer both personal and non-personal information from
a Web site to an Internet ad company
To provide data to an online profile
To count ad impressions and page hits
More technical information on Web Bugs can be found at my Web site
at this URL:
http://www.tiac.net/users/smiths/privacy/wbfaq.htm
In addition, I have set up search page that will locate Web pages
that employ Web Bugs. The page operates by giving special search string
to AltaVista that has located the hidden images. The URL of the search
page is:
http://www.tiac.net/users/smiths/privacy/wbfind.htm
The page will locate Web Bugs that have been placed around the
Internet from more than 20 different Internet marketing companies
Although Internet ad companies represent that they do not do
profiling of sensitive areas such as children, medical, financial, and
sexual issues, most of them will use Web Bugs on pages that deal with
these areas. Here are a few illustrations of Web pages that employ Web
bugs that I believe most people will find troubling:
Kids Zone of Santa.com (http://www.santa.com/santa/kidszone/
index.htm)
Procrit.com (http://www.procrit.com)
Rodale Press (http://www.sexamansguide.com/a/home/
order.rhtml)
Metropolitan Life
(http://metlife.com/Salescareers/Apply/Docs/
online_interview.html)
The Procrit Web site is the most interesting use of Web Bugs on the
list. Procrit is product of Ortho Biotech which is a subsidiary of
Johnson and Johnson. The drug is used to fight anemia in patients with
a number of different conditions including AIDS, cancer, and kidney
disease. Hidden image files from DoubleClick are strategically placed
on the Procrit Web site in order to distinguish if someone is at the
site because they are interested in treatments because of AIDS vs.
cancer vs. kidney disease. Needless to say, I believe that most
visitors to the Procrit site would be very surprised to learn they are
being monitored in this way. However, unless someone understands HTML
source code and knows where to look, they would never see the Web Bugs
at the site.
Web Bugs appeared to be employed by all of the Internet ad
companies. AltaVista has found more 30,000 placed by DoubleClick and
about 1,000 placed by Engage. Be Free, another Internet marketing
company, has more a half of a million according to AltaVista.
Personally I am surprised that Web Bugs are ever used. When
discovered, they undermine people's trust in Web sites. Some sites I
know have stopped using Web Bugs when they received enquires from the
press and consumers about their presences on the sites. Two such sites
were Nabisco Kids and the United States Air Force. Web Bugs are also
playing a role in a number of the privacy lawsuits that have been filed
against Web site and Internet ad companies.
The problem that I see with Web Bugs is that supply information on
the sly to Internet ad companies that can be used in personal profiles.
Given that this tracking is being done with no notice or consent, I
find use of Web Bugs very problematic.
Notice and Banner Ad Networks
I want to shift gears for a second and talk about the problem of
notice with online profiling. Most consumers are unlikely to be aware
that they are being tracked as they surf the Web. I suspect that most
consumers would be surprised that their computers are sending back
information to Internet ad companies about what articles and Web pages
they are reading online. They would probably also be more even dismayed
to learn that some of this information actually is being used for
profiling purposes. Most consumers are in the frame of mind that Web is
just like other media such as television or newspapers. Reading an
article in a newspaper is obviously anonymous unless a person chooses
to tell someone else about what they have read. However, reading the
same article in the online world can be very different. Two or three
different companies may know what article someone has read, how long
the article took to read it, and where the person went on the Web when
they were done.
Over the last 3 or 4 years, the industry has settle on the use of
Web site privacy policies to inform consumers about what data is being
collected by a Web site and what is done with the data. Today almost
all popular Internet sites have privacy policies in places. In most
areas these privacy policies do an acceptable job of inform a consumer
what they can expect with information. One very notable exception is
the use of online profiling at their sites.
In addition, all of the major Internet ad companies also have
privacy policies that describe how banner ad networks work, what data
is being collected by these networks, and the details of online
profiling. Also, most of the Internet ad companies offer an ``OPT-OUT''
to allow consumers the ability to turn off tracking and profiling.
However, there is one major flaw with the privacy policies of
Internet ad companies. Consumers have almost no way of ever seeing
these privacy policies. The problem here is the Internet ad companies
are hidden in the background at Web sites and consumers by and large do
not know anything about the companies. Web sites, in the own privacy
policies, have not helped the situation very much for consumer.
Although a Web site privacy policy may talk some about the Internet ad
company they use, Web sites almost never link to the privacy policy of
ad networks. For example, the AltaVista search engine finds less than
150 links to DoubleClick's privacy policy. Yet, DoubleClick has more
than 12,000 Web sites that they provide banner ads for. A similar
situation exists for Engage, less than 100 links are found to the
Engage privacy policy, yet Engage and its sister companies provide
banner ads for more than 6,000 sites.
There clearly is a problem here of Internet ad companies providing
proper notice about online profiling.
Conclusion
The bottom line for me on online profiling is that Internet ad
companies are getting too much data about us. Their ad networks
function as tracking systems the gather data about us from search
strings, banners ads on Web pages we visit, data spills, and Web Bugs.
Clearly the data collection systems of the Internet ad companies are
gathering more information about us than is necessary to show banner
ads.
I know that many people involved in regulation issues around
Internet advertising support the concept of OPT-OUT from online
profiling. At the present time, I feel extremely uncomfortable with
OPT-OUT for the following reasons:
It is nearly impossible for consumers to learn about how
they can OPT-OUT to online profiling because of lack of almost
any kind of reasonable notice about online profiling.
Invisible Web Bugs can provide data to the online profiles
and consumers have no method of knowing that they are being
tracked.
Data spills are providing personal data about users to
Internet ad companies and the industry has taken no public
steps to stop the problem
Many of Internet ad companies have divisions or sister
companies that maintain databases of personally identified data
that can be combined with the anonymous profiles at any time.
I want to conclude my testimony with one quick statistic from my
own travels around the Internet. As I mentioned earlier, I run software
on computer that logs all of my transactions on the Internet. The last
6 months, I had about 250,000 Web transactions total. More than 10% of
these transactions were with DoubleClick. This works out to about 150
transactions per day. This means that DoubeClick is receiving 150 URLs
of Web pages I am visiting each and everyday. In the offline world, I
cannot think of one company that it is getting this amount of data
about me. Not my phone company, not my bank, and not my credit card
company.
Thank you again for this opportunity to address the Senate Commerce
Committee.
The Chairman. Thank you very much, Mr. Smith.
Mr. Polonetsky, you know that we discussed DoubleClick's
``permission'' in order that one can opt out at the last
hearing. Now you are going to simplify that, according to your
testimony.
Mr. Polonetsky. Yes, the proposed simplified policy that we
have given to your staff, and we welcome your reaction, is a
one-page clear, effective explanation of what the privacy
policy is. I think that, in an effort to give all the possible
information that anybody might want, our earlier privacy policy
was, as you pointed out, long and detailed and complex.
The Chairman. Why was it like that to start with?
Mr. Polonetsky. I think we felt that we ought to give all
the information that anybody would want in all the detail
should anybody want to have all that detail. I think what we
need to do is put a cover page that has the simple, basic
information, with an opportunity to get more detail if you want
to click on a link and get that information.
The Chairman. Well, I guess I will ask you and Mr. Jaye:
According to Mr. Smith, the AltaVista search engine finds, as
he said, less than 150 links to your privacy policy and yet you
have 12,000 websites that you provide banner ads for. In your
case, Mr. Jaye, less than 100 links were found to Engage's
privacy policy, yet Engage and its sister companies provide
banner ads for more than 6,000 sites.
What is your response to that, Mr. Jaye?
Mr. Jaye. Unfortunately, Mr. Smith and I have an e-mail
dialog and I should have gotten back to him when he mentioned
that to me, because unfortunately the search string that he
used at AltaVista was not necessarily the right search string.
We actually provide a deep link directly to our opt-out page
from sites that link to us. So if he was searching for our
privacy page it would not show up.
We have 3,000 sites, for example, in the Flycast network,
which is a company we acquired earlier this year, and we have
gone through a certification process as we have brought them
online and we have all those sites compliant. We have actually
kicked out sites that are not compliant. So I think that we
just need to probably spend a little bit more time on going
over a couple of the details there.
In some cases also, when we deal with a third party in our
business we are working with networks and what happens is that
the site discloses that they are working with Engage and the
third party, but the link may actually be to a slightly
different form of the web page to let them know, for example,
this site is part of the Flycast network, which is working with
Engage.
So I think that we can probably put that to rest, at least
in our case.
The Chairman. Mr. Polonetsky.
Mr. Polonetsky. If I can respond to that as well, Senator.
In February, DoubleClick announced that every new contract that
we signed with a client would have in that contract language
requiring that that U.S. web publisher had a clear and
effective policy with a link to DoubleClick, and every single
one of our new contracts has had that.
I have been going through the 1,000 or 1,200 sites that are
in the DoubleClick network, taking a look at their privacy
policies and requiring that they change that and link to us. So
I think the numbers for us are substantially more than Mr.
Smith laid out as well. Frankly, it is our firm policy that
anybody that we will do business with, anybody frankly who has
information that is being contributed to a profile, certainly
has a link to our policy or I do not sign off on that site's
participation.
The Chairman. Mr. Jaye, should consumers have access to the
profiles that network advertisers keep about them when they are
linked to personally identifiable information?
Mr. Jaye. When they are linked to personally identifiable
information, yes.
The Chairman. Mr. Rotenberg.
Mr. Rotenberg. Yes, Senator. I think without the ability to
see the information that is being collected, the privacy
policies do not really mean very much because they are very
general, they are very confusing, and you really cannot make an
informed decision. I think one of the points also in Jodie
Bernstein's presentation with respect to cookies, even if you
try to exercise choice, which is what she described with the
browser software, you will see a screen that gives a web
domain, an expiration date, and then a value field that is just
a string of characters. It has no meaning to you.
For that reason, you have to see what information is being
collected about you and how it is being used.
The Chairman. Mr. Polonetsky.
Mr. Polonetsky. I think it ought to depend on the type of
information. I think if we are talking about sensitive
information, the kind of information consumers would be
concerned could be used against them or could cause harm, there
ought to be a higher level of protection. But I think that
basic information, such as the kind of information that is used
in the offline world for marketers to make decisions about what
offers to send, the standard there for non-sensitive
information could be opt-out as long as it was clear, as long
as the consumer knew what the rules were when they were at the
site.
The Chairman. What type of information should I have access
to?
Mr. Polonetsky. You should have access I think to a
reasonable amount of information to the extent that the site
has that information easily available.
The Chairman. Who should decide that?
Mr. Polonetsky. Well, we served on the FTC Committee on
Online Access and Security, as did Engage and some of the
others at the table, and I think there is not a one-size-fits-
all answer. There is some information that is probably easily
available and we certainly, if we use personal information,
will make that kind of information available.
Other information may be difficult. If I walk into a
Macy's, whether it is an online version of Macy's or offline,
and I say, I have shopped here once a year, could you please
give me a record of everything I have ever bought--the question
is what is the tradeoff? Are there certain kinds of information
where consumers really need and really should have access? Are
people making decisions about credit, about mortgages,
information that is going to affect their lives substantially?
If it is non-sensitive marketing information, I think the
standard of access might be different.
The Chairman. Mr. Smith.
Mr. Smith. Well, yes, it is a complicated problem of
providing access, and there are also some privacy downfalls to
it in the sense that if you allow somebody else to get
information there are problems. But I would really love to
know, for example, of those 27,000 transactions that
DoubleClick got about me in the last 6 months which are very
personal in nature, which ones they are saving and which ones
they are not.
The Chairman. Finally, the issue of the moment seems to be
that the FTC and the online advertisers are in serious
negotiations. I would like to know the confidence level of the
witnesses in the ability of the parties to come to agreement,
and would that then negate any requirement for legislation?
Mr. Polonetsky.
Mr. Polonetsky. I am not the person at the table for our
company, but I can tell you that we are optimistic that they
are progressing in a positive way. I think we all agree that
strong standards of notice and choice that are adopted by all
in our industry will provide a real strong level of protection
for consumers. So we think that a system of self-regulation
could be very effective.
The Chairman. Mr. Rotenberg?
Mr. Rotenberg. Mr. Chairman, I think even if there were
agreement between the industry and the FTC on practices in this
area, it would not be sufficient to protect privacy. I say this
for several reasons. First of all, we have followed very
closely the self-regulatory efforts in other areas involving
such groups as TRUSTe and BBB Online, and I think the sense at
this point is that those are not providing adequate protection
in the online world.
The second point, as a matter of process, I have been
personally disappointed that the FTC has not involved the
privacy community in this proceeding. I think we have a right
to participate. We were, after all, the group that initiated
the complaint at the Federal Trade Commission. We identified
the flaws in those privacy policies, and we think if the FTC
proposal is going to be responsive it has to address the issues
we raised.
The Chairman. Mr. Jaye.
Mr. Jaye. As was reported evidently this morning in the
Wall Street Journal, I guess I am optimistic about our
likelihood of reaching agreement, and I stand by that comment.
I think that the industry has been working very hard--I am one
of the people at the table from my company--to try to come to
agreement on a baseline set of standards that will meet the
legitimate consumer concerns about data protection and privacy
with regard to network advertisers.
I think that there has been a very good faith dialog going
on and I hope that we will be able to come to an agreement.
Whether or not there is a legislative backdrop or not is
somewhat independent, because I think in the end self-
regulatory programs in this area will be more effective for
jurisdiction issues and many other issues.
The Chairman. Mr. Smith.
Mr. Smith. Well, I have not been privy to any of the
negotiations also, as Marc has pointed out. I am also a
programmer, so I am not sure that I can comment so much on the
legal issues here.
But overall, I think one of the concerns I think raised in
the earlier testimony, what if somebody just does not want to
participate and then we have that problem? That could just see
a breakup of those kinds of regulations.
The Chairman. Senator Wyden. I thank the witnesses.
Senator Wyden. Thank you, Mr. Chairman.
Mr. Polonetsky, I am interested in knowing when DoubleClick
collects information from a website how detailed the
information is about a consumer's activities there? For
example, if I visit a bookstore site, do you have full
information about the titles I browse through as well as what I
purchased?
Mr. Polonetsky. The answer is not at all. What DoubleClick
does is we deliver an ad when somebody is at perhaps a site
where books are being sold. So the information we have is that
we delivered a sports ad to this cookie ID when it was at this
sports site.
Senator Wyden. What about recording search terms that I
type in?
Mr. Polonetsky. When one goes to a search engine and types
in a keyword that one is searching for, the page that is
generated--let us assume one goes to a page and types in
``golf''--the search page that is generated is going to be a
golf page. So the information that DoubleClick gets is: serve a
sports ad here, serve a golf ad here, because the search term
is going to provide a golf page, so put in golf. That is the
kind of information that we would have in terms of paying an
advertiser and paying the website for the ad that was served
and the ad that was delivered.
Senator Wyden. How many users at this point do you have
profiles on?
Mr. Polonetsky. We actually do not currently serve ads
based on profiles. I know that that is a misconception that
many have. We currently serve ads based on some of the visible
demographics of the browser at the site, geographic
information----
Senator Wyden. What kind of numbers are we talking about
there?
Mr. Polonetsky. So those are not profiles at all. We are,
however, developing such a product, as some others are doing,
and will have one in the near future. But we are not currently
working with profiles. We will probably have say 40 or 50
million when we do, because we serve ads at many sites. But we
currently are not serving ads across the web based on profiles.
We are serving ads based on somebody is going to a sports site,
we know we have showed three ads to this unique cookie ID on
other sites; let us serve this sort of ad into that site.
Senator Wyden. Now, Mr. Rotenberg, most of the users never
visit the website of the online profiler that is collecting
information. So we are wrestling with this question of notice
and choice and how to deal with the collection of profile
information there. Would host websites serve as intermediaries
between the consumer and the profiler? How would you see that
working? For those of us who want to make sure that those kinds
of FTC principles apply to profiling, how would you address
this question of notice and choice specifically?
Mr. Rotenberg. Senator, I think the whole process has to be
much more transparent. One of the very interesting things about
Jodie Bernstein's presentation, when she described what was
taking place with the cookie tracking online you saw boxes go
up. I think she used the phrase ``US Advertising,'' maybe that
was the ad network, ``US Advertising is now gathering
information for this purpose, US Advertising is now linking
information for this purpose.''
I actually believe that those are the types of notices that
consumers who are online should be able to see as the
information flows. In other words, you have to literally
understand as you move from one website to the next what
information about you has been obtained and how it will then be
used.
Now, at that point you can make a decision and you can say:
Well, I do not want to be a part of an advertising network that
collects information about me in this way or uses it in this
way. There should be a box there that says: I am not going to
be a part of this.
But as long as we have these very complicated arrangements
where people cannot really evaluate what is going on, frankly,
it would not matter whether you had to go to the advertiser's
website, a consortium's website, or the website that you
visited originally to express a preference, because you would
not understand what the preference was you were expressing.
Senator Wyden. In your view, how critical is the
distinction between personally identifiable information and the
non-identifiable data that is collected by profilers?
Mr. Rotenberg. Well, I used to think it was about the
brightest line that there could be. But I have actually changed
my view on this, because I understand now that it is possible
to take a profile that is not linked to a known user and
subsequently link it to a known user. In fact, that is exactly
what happened with DoubleClick. And I am a little surprised to
hear them say that they are not creating profiles. Now, they
have tens of millions of unique cookie ID's. Maybe that is the
phrase we should be using. Currently today, tens of millions of
unique cookie ID's, and those are the ID's that make it
possible when Richard Smith surfs the web for an advertiser to
know that three ads have gone out to that unique cookie ID
which Richard Smith is standing behind and therefore we have to
put a different ad.
Now, if that unique cookie ID can be linked to Richard
Smith, even though it may not currently be linked to Richard
Smith, then I think we need some legislation in place to
control that practice.
Senator Wyden. Let me do this, because I have one other
important question I want to ask about litigation. But Mr.
Polonetsky, do you want to respond to Mr. Rotenberg's point,
because I think that the reason I asked the question about what
you all were doing specific to individuals is that is of course
what the American people want to know. You all are sort of the
most visible company in this area and Mr. Rotenberg just
described a way with the use of the cookie ID that a fair
amount of personal information was in effect being collected or
certainly utilized.
Mr. Polonetsky. Sure, let me clarify if I can. First of
all, we are not using any personal information at all. What we
are doing is when a browser comes to a site that browser is
assigned a unique ID. If DoubleClick is serving an ad on that
site, DoubleClick knows that this Nike ad was served to this
unique ID.
We also know that most folks, if they have not responded to
an ad after two or three times, do not keep showing the same ad
over and over and over again. So what we will keep a record of
is this ad was shown one time, two times, three times, so then
do not show this same ad again, show a different ad the next
time that unique ID shows up at a site where DoubleClick is
serving ads.
So I do not know that that would be considered profiling. I
think that would be frequency capping, making sure the same ad
is not shown over and over. I would say that a profile is
keeping track of all the different sites that a unique ID was
at and then building a record saying, well, this is a cookie
that spends a lot of time on sport sites, on news sites, so let
us show them a certain kind of an ad when that anonymous ID
shows up again at a different site.
Senator Wyden. Mr. Rotenberg is smiling and that indicates
to me that he is probably concerned about the ramifications of
that on individuals.
Since time is short, I want to ask just one other question.
It is really for you, Mr. Jaye, and you, Mr. Polonetsky. That
is, with folks in the industry facing lawsuits with respect to
the practice of online profiling, do the two of you, Mr. Jaye
and Mr. Polonetsky, believe that by defining the appropriate
scope of profiling behavior that that might head off some of
the disputes that seem to be headed for a lawyer's full
employment program here?
Mr. Jaye.
Mr. Jaye. At Engage we feel comfortable that since we
started the company we have had privacy--finding the balance
between the consumer's right for privacy and the marketer's
need for effectiveness--in the form of anonymity. We feel very
comfortable in our position with regard to those types of
risks.
Certainly there is still the possibility of some sort of
action that would be perhaps without merit, waste our time,
waste the government's time. But at the same point, we are
concerned about moving quickly. For example, just to take a
point, this issue about web bugs. I think web bugs are a very
legitimate concern because they are not visible to the
consumer. But one very important use of this technology is not
for any type of profiling, but simply for the ability of
reporting to an advertiser the percentage of visitors who saw
an ad who actually subsequently made a purchase, not at an
individual level at all, but the ability to basically tell the
advertiser did they spend their money wisely.
If we cannot provide that level of reporting, the ad
spending on the Internet is not going to be sustained. So it is
very important to proceed very carefully to make sure we draw
the lines so that we do not inadvertently carve out the ability
for the advertising to be supported while at the same time
addressing the very legitimate concerns about invisible
tracking.
Senator Wyden. Mr. Polonetsky.
Mr. Polonetsky. I agree. I think that education, definition
of the terms, transparency so consumers are aware of what is
taking place is the key. Much of the research I think that is
out there academically and certainly much of the work that we
have done at DoubleClick has indicated that as people are
aware--as they understand the technology, as they understand
what control they have over any information and how it is
used--they become increasingly comfortable with their surfing
on the web and what is taking place.
So one of the reasons why I think we talk about notice and
choice is it is an easy way to show a consumer what is going on
at a site. It is one of the reasons why we ran our online ad
campaign and I think it is probably key in terms of self-
regulation--making sure that consumers understand what we do as
the greater American public starts spending more and more time
shopping and using the benefits of the web--that people
understand how it works and how they have control over what
happens on the web.
Senator Wyden. The central problem, of course, is that
millions of people, as Mr. Rotenberg has talked about----
The Chairman. Senator Wyden.
Senator Wyden. And I will wrap up with this, Mr. Chairman.
The central point is that----
The Chairman. I am not trying to cut you off. If you would
like to at least let Senator Kerry go and then we will come
back to you.
Senator Wyden. I will wrap up right now.
The Chairman. Thank you. Thank you. No, please.
Senator Wyden. This was just my last point. I happen to
share your view on education and it is clear. But what Mr.
Rotenberg said that is central to this is that millions of
people are not at this point empowered with enough information
to make these choices, and that is why I am hoping that we will
be able to get some legislation that defines the appropriate
scope of profiling behavior.
I thank you, Mr. Chairman.
The Chairman. I thank Senator Wyden and I again appreciate
his deep involvement in this very important issue.
Senator Kerry.
Senator Kerry. Thank you, Mr. Chairman.
Mr. Smith, could you repeat for me. You mentioned something
about 27,000 transactions. That is more than a bank. I did not
quite get the whole thing.
Mr. Smith. Right, yes. I log each time a web page is
fetched or an image is fetched on my computer and sent out to
companies on the Internet. In 6 months I had 250,000, a quarter
million of these transactions--web pages that I went to and
images that I saw. More than 10 percent of those went to
DoubleClick.
With that, each transaction was for like a banner ad. There
would also be the URL of the web page that I was at. So if I
was at Quicken, they would get what page I was on at Quicken.
Senator Kerry [presiding]. But you said something to the
effect that that represented a lot more information than any
bank has on you, or something.
Mr. Smith. Yes.
Senator Kerry. But that is not the kind of information that
a bank collects or needs or that you give a bank. I mean, the
bank has your social security number.
Mr. Smith. Correct.
Senator Kerry. And the bank has an address.
Mr. Smith. I was talking about quantity here, not
necessarily quality.
Senator Kerry. Well, but your quantity was for a specific
purpose. You are not the average person shopping in some way.
You were out there really analyzing this.
Mr. Smith. Well, I might be using it a little bit more, but
I suspect for a regular person it might be 100 transactions, 50
to 100 transactions in a day.
Senator Kerry. But what I am trying to understand is the
information that they gleaned from that was essentially non-
personal, am I correct?
Mr. Smith. No, that is not correct.
Senator Kerry. What was the personal nature?
Mr. Smith. Well, I will just go through some of the list
here: my name, my home address, my e-mail address, what plane
flight my daughter was taking to Philadelphia from Boston,
these sorts of things; on buy.com, the movie that I was
renting.
Senator Kerry. Let me stop you there, because I was trying
to figure out what kind of information it was. Now I want to go
from there to Mr. Jaye.
I specifically want to flow out of this. I think that is
the heart of what we are trying to get at here. Mr. Jaye, you
listed the way Engage approaches this and what you can
guarantee and a list of things that you do not do. Would you
repeat that list?
Mr. Jaye. Certainly. We do not know a consumer's name,
address, social security number, or any other personally
identifiable information. We do not maintain information about
specific web pages a browser visits, which is probably the one
that is most relevant to this issue. We do not collect any
sensitive or controversial data, such as personal medical or
financial data, ethnic origin, religion, political interests,
or review of adult content, and we do not merge anonymous
profiling data with personally identifiable data no matter the
source.
I think just a comment. I think the issue here has to do
with the specific information about the web pages because of
the data spillage issue in particular I think that Richard
Smith is bringing on. That is precisely the reason why we took
a data minimalization approach at Engage to make sure we did
not maintain that information.
Senator Kerry. So essentially you have software that has
the capacity to provide a guarantee of anonymity.
Mr. Jaye. We have made every attempt that we could. Just
once again in full disclosure, the way the web works is data
may be received, but there is a difference between when data is
received and actually processing that data and storing that
data. We do not process that spilled data, and one of the
reasons why we discard it is so that it cannot be subsequently
processed.
Senator Kerry. When you say discard, practically speaking
how does that happen? What happens to it?
Mr. Jaye. From a technical perspective, it never gets
written out into magnetic storage and where it is maintained in
memory for the milliseconds or the seconds while the data
around it is being processed is quickly overwritten with other
data.
Senator Kerry. So, for all intents and purposes, it has
disappeared, or could somebody draw it out?
Mr. Jaye. It has for all intents and purposes disappeared.
Senator Kerry. Now, Mr. Rotenberg, what is the matter with
that?
Mr. Rotenberg. I actually think it is pretty good. I think
it is the type of network advertising that a year ago I
explained could work for business and work for consumers. The
problem, though, is that consumers online do not have a choice
about whether to get their advertising between one firm and
another.
Senator Kerry. Correct. Now, if we were to mandate that the
notice be up front and personal as to what the expectations
are, what is going to happen to somebody, what is being
offered, is there any consumer responsibility here? Is there
any caveat emptor, any degree to which an informed consumer
takes place on page one if it is adequately noticed?
Mr. Rotenberg. I think consumers have some responsibility,
but I think in fairness, considering the rapid growth of these
various business models and the various types of advertising
schemes, we are going to be doing this dozens or hundreds of
times for consumers every time someone figured out a new way to
collect and use personal information, which is why I think--and
I do not think Mr. Jaye would necessarily disagree with me--
that a simple set of fair information practices of the type
that have been adopted in previous legislation--we have done
this, by the way, with a lot of technology. We have done it
with cable subscriber records, video rental records, e-mail.
We have put in place basic fair information practices and
then companies like Mr. Jaye's do very well because they have
good business models and they protect privacy.
Senator Kerry. That is essentially what I am talking about.
That is a notice approach fundamentally, with a requirement as
to standards that are adhered to, correct?
Mr. Rotenberg. And access; notice and access.
Senator Kerry. Well, come to the access thing for a minute.
I want to come back to the other for a second. But when you say
adequate access, of course people should have access. We want
to have some structure there. To what degree can you get
detailed? Exactly how is access going to be implemented,
specifically with respect to what sort of corrective measures
are available to somebody? Once they have access, what
information ought to be changed or can a person change if they
do not like it?
Mr. Rotenberg. Well, it is a problem, but I think it is
also a problem that has been handled in the past. It has
certainly been handled fairly well in the credit reporting
world. People who disseminate information say: To the best of
our understanding, this information is accurate, and the credit
subject seems to disagree with what we know about this person.
So what that statute says is: Okay, give that person a
right to include in the record his own interpretation about
what the bill was not paid. Then the person who receives the
file can see what the credit reporting agency is saying and
what the credit subject is saying and make a determination
about how to interpret it.
But we have not even approached that type of resolution to
I think the question that you are asking, because we are still
not sure about whether people should have the right to access
these profiles. I think we have to take that as a starting
point and then figure out how we would resolve these important
questions that you have asked.
Senator Kerry. Now, what is the distinction between the
profile as it has been described, that is achieved by a cookie
or by ten million cookies and the profile that somebody might
have created on themselves by repeated visits to Macy's,
Neiman-Marcus, and whatever numbers of stores, and they then
are getting X number of catalogues coming to their house on a
regular basis?
Mr. Rotenberg. Well, I think they are different in at least
two respects. One, it really is the nature of this interactive
digital environment that you can collect a lot more information
about individuals. That is why these----
Senator Kerry. Let us stop for a minute.
Mr. Rotenberg. Yes.
Senator Kerry. If we have proceeded--I am not saying
laissez faire. I have said we have got to have a standard and
we have got to put something in place. Let us assume we put in
place a very clear notice requirement with the principles of
choice and access and security as subtexts of that notice. This
is what we are trying to achieve as a full measure of people's
ability to participate in the following way. They are the
principles that have already been adopted fundamentally by the
industry and others, but there is not a clarity to them
necessarily.
Let us say that that is the structure you have here. But
you are giving to companies like Engage and others out there
the creative capacity to provide the technologies and the
competitive abilities to offer people ways of satisfying their
desire to have this adequate privacy. Would you not possibly
excite a greater response and in fact a speedier response
conceivably by approaching that for a little while here to see
how this develops?
Mr. Rotenberg. I think the critical question at this point
is what direction is this self-regulatory experiment taking us.
Senator Kerry. But I have gone beyond the self-regulatory
in that, because if we have gotten very specific as to the
level of notice. Let me say that I have particularly become
sensitive to this in the last months. I have tried to find
different people's privacy and some you can see it on the home
page, boom, you hit it, and it is lower down, it is not exactly
leaping out at you, but you can find the word ``privacy'' or
some protective disclosure. On others you have got to go
multiple clicks away, and in some cases it is quite complicated
because then you have got to type in a relatively long and
complex address to go find it and get the full privacy level.
So it is clearly a discrepancy between companies as to what
they are prepared to offer people in terms of disclosure. There
is no question about that. But if we were more clear about that
requirement of disclosure and there is a clear understanding
that it is an unfair trade practice not to provide that up
front choice to people adequately. You then have empowered the
FTC in terms of enforcement to the degree they can and you have
left it to people like Engage and others to hopefully come back
with a series of competitive measures that offer people what
they want.
Do you see something lacking in that?
Mr. Rotenberg. Well, Senator, I think the problem--and I
certainly understand what the proposal would--I think I
understand what the proposal would accomplish. But I think the
problem is that even if we have a simplified notice and a clear
notice where people can make better informed choices, we will
still end up forcing consumers to choose between their privacy
and the benefit that the website is offering.
I believe that there are solutions that will allow us to
avoid those choices, so that advertisers can reach customers,
so that web merchants can effectively deliver their products,
without requiring consumers on the Internet to make a choice
that invariably involves giving up some degree of privacy.
Senator Kerry. I think you have got to be more explicit on
that, because I have a hard time envisioning it. I mean, I
assume you would agree that there is a major problem if
advertising cannot support the Internet, correct?
Mr. Rotenberg. No.
Senator Kerry. I mean, the dream has been that the Internet
is going to be free, fundamentally supported by advertising.
But the verdict is out on that. I mean, I understand the number
of--Mr. Smith, is not the number of clicks that are currently
recorded as spending meaningful time or making a purchase is
lower, it is about 1 percent, is it not?
Mr. Smith. Right, it has been dropping. But also the number
of banner ad impressions has been going up much faster. So it
is not necessarily an indication of a problem, just that the
number of ad impressions has gone way up. And the companies who
are showing banner ads, revenues are rising very rapidly. So
more money is coming in on advertising.
Senator Kerry. And I think if I am correct, the current
prognosis is that the advertising revenues are going to go from
something like $6.7 billion up to $20 billion in the next
couple years. But that depends on the continuing capacity of
people to be able to market effectively.
Mr. Smith. Right.
Senator Kerry. If all of a sudden that is taken away
somehow because this balance of what you are saying, the choice
between adequate protection and capacity to be able to
effectively figure out who you are reaching is not in balance,
you could wind up with people choosing sort of what they think
is going to be good for them to protect themselves, but in
effect it is going to deny people the capacity to know how to
advertise or how to target.
Mr. Smith. One thing, now. The jury is also still out on
whether online profiling is effective technology for ads. I do
not think that has been proven at all. The New York Times had
an article about a month ago on this exact subject.
Senator Kerry. Well, I think the point is, the point being
made by Mr. Jaye, while he is speaking for a specific company
and technology and it may be that others can do it as well or
whatever, but the point is that they have the ability to
provide a lack of profiling, a specific guaranteed lack of
personal profiling and use of personal information, but still
permit an adequate balance with respect to the advertising
needs. Am I correct?
Mr. Jaye. Yes, that is correct.
Senator Kerry. It seems to me that if that exists, if it is
there in technology and it is really an effective component of
the notice that is right up front, that if somebody is, in
fact, that is their sine qua non of participating in the
Internet, they can get it. And if that notice is required
adequately up front, then have we not provided the protection?
Mr. Smith. None of us have seen our profile, so I am not
sure how we can say. We are going by the word of the companies
on what they say they are doing and they are not doing. I hear
from DoubleClick that they stay away from medical issues, yet
they put web bugs on anti-AIDS drugs. So I do not know what to
think.
Senator Kerry. I mean, there is a distinct difference
between typing in a search word ``AIDS'' and getting back some
drug advertisement or something versus some medical record of
yours with respect to a test or a visit or something else.
Those are two different worlds.
Mr. Smith. Right, but in between here is----
Senator Kerry. Do not confuse it as a medical. That is not
a medical.
Mr. Smith. But what I am talking about is an invisible
image at the Procrit.com website that sends back a message to
DoubleClick saying you are now here and, oh, by the way, you
are interested in cancer treatment. So I do not see that--yes,
it is not medical records, but it is not just viewing a banner
ad, either.
Mr. Polonetsky. If I could jump in----
Senator Kerry. Yes, Mr. Polonetsky.
Mr. Polonetsky. And perhaps explain a little bit about what
these tags do. The sites want to know how many unique users
have visited their site and they also want to know which of the
ads they have run have brought unique users. Johnson & Johnson,
which is the operator of Procrit, might be running an ad on
AOL, might be running an ad on Yahoo, might be running an ad on
a DoubleClick Network site, and wants to know how many people
are coming, how many anonymous unique users are coming to the
Procrit site from each of the sites where ads were displayed.
They use this spotlight tag, as we call it, or, as Mr.
Smith calls it, a web bug, to simply anonymously keep a record
of how many users are coming to the site and did they come from
the ad that Johnson & Johnson ran on AOL or Yahoo. Innocuous.
The information does not belong to DoubleClick. We are
providing this service on behalf of the Johnson & Johnson
Procrit site. We do not use it for a profile.
Senator Kerry. How do you answer the question posed by Mr.
Smith as to whether or not he can have some kind of personal
guarantee that that is in fact all you are doing, so that he
will know that is the full profile?
Mr. Polonetsky. He has got a number of guarantees. Number
one, we employ an outside third party auditor, so the
commitments that we make are audited by PriceWaterhouse-
Coopers, so that we can guarantee that we do what we say we do.
My role as Chief Privacy Officer, as a former consumer affairs
commissioner, is to report directly to our Board and be the
inside watchdog ensuring that we live up to the commitments we
make.
Frankly, our clients would be very unhappy if we took
information about how many users were coming to their site, and
how their site was doing, and which parts of their site were
getting more hits, and which ads were bringing people to their
site, and used it for anything else. So we legally are bound to
make sure that any information, anonymous information that we
are getting from a tag, is used specifically for that purpose:
given back to the advertisers so they know how they can manage
their content.
Senator Kerry. Mr. Rotenberg, if that kind of guarantee can
be put in place and you have the capacity through the software
being provided by Engage or others to be able to give people
that option, what is the compelling rationale for something
more mandated and intrusive?
Mr. Rotenberg. Just to be clear, Senator, when you or I
surf the Internet and banner ads are placed, we are not
choosing between Engage and DoubleClick as the company that is
going to serve ads to us.
Senator Kerry. You are saying anybody can do that.
Mr. Rotenberg. Exactly. Anybody can be doing this in the
background. And while I agree with you that I think Engage is
doing some good things certainly, I do not think privacy
legislation is going to undermine what Engage is doing. If
anything, it may spur the development of half a dozen companies
like Engage, all looking for better privacy solutions.
Senator Kerry. What is the technological response to the
fact that once it is out there on the web, so to speak, anybody
can grab it and try to use it and pull it down? What is the
response to that, either Mr. Jaye or Mr. Smith?
Mr. Jaye. Well, first of all, it is not anyone. They
require certain network connections that make certain types of
transfers possible. But in particular, the commonly used
technology is this thing called third party cookies, that is
cookies that are set and sent back to a website other than the
website the consumer is specifically visiting.
That does not mean that anyone can; only the sites that are
working with each other. So for example, there usually has to
be a specific relationship between the website and the third
party in order for the third party to gain that data.
In terms of the technical aspects of it, that is one of the
reasons why two and a half years ago I initially started
working on this trust label standard at the ITF, which was a
standard to focus on how do you take that cryptic pop-up box
telling you that a cookie was being set and to tell you what it
meant, what it was going to be used for, and more specifically
make it so that the riskiest behavior to consumer privacy,
which is third party cookies, would have a hard and fast
requirement that those cookies would have to pass muster, they
would have to be digitally signed by seal authority before they
would be allowed through or else robust notice and choice would
be provided to the consumer.
So I actually do disagree at the moment with the people on
my left and right with regard to technical solutions addressing
the legislative need, because I think that type of technology
solution goes farther than any legislation could go in ensuring
that we do not have bad actors who are beyond our reach.
Mr. Polonetsky. Senator Kerry, if I could just correct the
record for a second as well. There was the data spillage issue
that was raised earlier and some of those were DoubleClick
examples. There was a technological issue and that is the
reality that there are some sites that accidentally--they
should not, but accidentally--have information sent to anyone
they link to if there is a form on that page.
Now, we certainly informed our clients that they ought to
take a close look and make sure they are not accidently finding
unintended information. But we have also implemented a
technological fix to this problem, in addition to saying please
do not send us anything that we should not have, we do not want
it, we do not use it, it does not go in a profile, but do not
even send something that someone will get nervous about. We
have set up a process where our ad servers truncate anything
after the question mark.
So if we are accidentally sent information from a website
that we do not want, it does not even get recorded because our
technology automatically chops that off so it does not get to
us.
Senator Kerry. Well, query whether you would all be better
off if we were to be more mandatory in being sort of
prophylactic about the capacity of that kind of accident to
occur. In other words, if we make it unlawful for people to
transfer and use, or to use conceivably, that kind of third
party transferred information, would that have an excessively
intrusive impact, based on the fact that you are saying that
this would be accidental and therefore no company would set out
to do it and therefore no one should be impeded by our saying
that is an unlawful act?
Mr. Polonetsky. Well, I think this is probably the best
example of how self-regulation works. Here was a technological
flaw which we all appreciate Richard Smith for helping point
out and identifying, and all the companies who are in the
industry--and frankly, this is not solely an ad server problem.
If I have a website and I have got a form because I am selling
something or registering and I have links to other sites that I
have got partnerships with or that I am linking to because it
is useful information, I can accidentally at this website be
sending that information in any direction.
So this is a technology problem with the way some websites
are set up. When it was identified, all the responsible sites
quickly took a look and made sure they were not doing it.
Frankly, those of us who are at the receiving end, who are
being accused of getting this information and using it or
having it, very quickly said to our clients: Do not
accidentally do this, and here is how we are going to make sure
it does not get to us.
So I think legislation probably cannot even anticipate some
of the other practical problems. This is a perfect example of
industry becoming aware of a flaw in the infrastructure of the
technology of the web and then quickly fixing it so that it
does not happen.
Senator Kerry. Should it be technologically feasible or
even should it be a matter of public policy that if somebody
did not want pop-up ads at all that that should be an up-front
part of notice and they should be able to opt out of those
immediately?
Mr. Polonetsky. It has been our policy at DoubleClick since
1997 to have an opt-out link, even when----
Senator Kerry. But it isn't easy to opt out. I mean, let us
be candid. There are lots of people in the country who would
like to opt out of a lot of things on the net and it is very
hard to do even for people that know how to use the net.
Mr. Polonetsky. I think it is our job to make it frankly
easier. The Internet is 1,700 days old; our company has been
public for two years. I think this huge growth in sites having
privacy policies from 14 percent two years ago to 90 percent--I
agree, now those policies need to be complete. But I think we
are making real rapid progress and in an industry that is still
in its infancy, and frankly, consumers will use the Internet
that we are first imagining.
So I argue that if industry is moving in the right
direction, is eagerly working with the FTC, working with each
other, to put the appropriate protections in place, I think you
are seeing the ideal of how responsive self-regulation should
and can work.
Senator Kerry. What do you think, Mr. Rotenberg?
Mr. Rotenberg. Well, I think it is fine to encourage
industry to address privacy concerns, and in that respect some
progress has been made. But at the end of the day, I think you
really have to focus on the central question, which is, is
consumer privacy being protected? That is about more than
assurances. It is about what is really happening, whether
people can exercise opt-out, what the purpose, frankly, of
choice is in this very important policy world.
So certainly as a privacy advocate I do not want to
criticize industry groups for trying to address this issue. But
also as a privacy advocate, I have to say to you my sense is
that the gap between the amount of privacy protection that
people expect and the amount that they are receiving online
continues to grow, and it is going to grow further. That is why
we need legislation, to give people control over their personal
information.
It may mean that more companies like Engage are going to do
well in that world, because it will be a world where privacy
will be important.
Senator Kerry. Did one of you want to respond to that or
you are comfortable on it?
[No response.]
Senator Kerry. Well, there is no question in my judgment,
as I have said at the outset, that we need to establish the
standard here. The question is how far do we go and how
quickly, and I think it is the balance that we need to find.
You said, Mr. Rotenberg, that it is a different kind of
privacy problem on the Internet. I just wanted to explore that
with you for a minute. Obviously, because it is electronic,
because it is global, because it is fast, there is a perception
issue there. But tell me how in your judgment? Is it the
distribution network that makes it so different and raises the
specter of threat?
Mr. Rotenberg. It is the ability to track and monitor what
you do. If you go into a book store, pick up a book, put it
back down, find another one you like----
Senator Kerry. Right, nobody knows what book you looked at.
Mr. Rotenberg [continuing]. Pay for it by cash--there is a
tremendous amount of anonymity in the physical world, and so
much of what we do--driving in our car, walking on a street,
riding the Metro, cash-based transactions, this is all
anonymous by and large.
In the online world, there are a great deal of incentives,
understandable incentives, to collect information about what
people do. You cannot do it offline, but you can do it online.
That is what created the problem here. It is because this
information could be collected and that there was no way to
protect privacy when, for understandable reasons, I may well
have done the same thing at DoubleClick or Engage in terms of
building these profiles.
That is why I think Congress needs to take some action in
this area. It is different.
Senator Kerry. Well, it is more intense, but as to the
browsing and as to the collection of that information, again it
is possible to create a standard by which people are offered
the opportunity to have that be anonymous, is it not?
Mr. Rotenberg. Anything that we can do to promote anonymity
online--and you have mentioned this several times, Senator--I
think should be encouraged. I think a lot of people who are
familiar with the history of the Internet--and I do not just
mean the last few years of the World Wide Web and electronic
commerce, but know the history of how this network of
interconnected databases could allow people to freely collect
information--look at data, post news, read news, without
disclosing identity--understand that anonymity has always been
a very big part of online privacy.
It is that interest that is now being threatened. Now, as I
have said before, I think advertising can be made to work, can
be made to work very well. I said it in my testimony, in many
ways the Internet offers a wonderful platform for giving
information to consumers. But I think we have to draw some
lines, and one line to draw is when we are collecting
information about individuals.
Senator Kerry. There is, I assume you would agree, a
distinction between--well, I think we have been over that. I do
not think we need to beat that over.
On the third-party cookies, is there a specific--should
that require a specific remedy legislatively directed, or is
that something that under some privacy policy you think it
could be contained?
Mr. Rotenberg. I think if we have a general rule on the
collection and use of personal information online that will be
easiest for businesses, because they do not have to sort of go
back and forth, where are we; and it will be easiest for
consumers because they will know what the expectations are. I
am just concerned if we try to draw too many lines particularly
related to certain technologies or certain business practices
that we are familiar with today----
Senator Kerry. So it is better to have a broader standard
that applies, which is basically the way I think we are
heading.
Mr. Rotenberg. Yes.
Senator Kerry. Understood.
Well, I appreciate it. It is a very interesting subject
with a lot of complexities, but it is very important that we
try to get it right. I am very grateful to you for your input,
all of you here today.
The record will remain open for two weeks. If anyone wants
to update their statements, they can do so. Likewise,
colleagues can submit questions in writing.
At this time the hearing is adjourned.
[Whereupon, at 12:40 p.m., the Committee was adjourned.]
A P P E N D I X
Prepared Statement of Mr. Steve Markowitz, Chairman and CEO,
MyPoints.com, Inc.
Mr. Chairman and Members of the Committee, I am Steve Markowitz,
Chairman and Chief Executive Officer of MyPoints.com. I am pleased to
have the opportunity to submit testimony about my own and my company's
sentiments concerning the important issue of online profiling and
privacy and I thank you for the forum to explain MyPoints' consumer
privacy program, which, I maintain, could form the basis of an industry
standard.
MyPoints.com is the Internet's most popular promotional site, and
the Internet's fifth most popular shopping site. More than eight
million consumers have voluntarily joined our online membership
program--MyPoints--and given us express permission to contact
them via e-mail with targeted advertising offers on behalf of our
clients. We reward consumers to interact with our advertisers, and our
advertisers rely on us to provide them with an integrated suite of
cost-effective, permission-based e-marketing tools.
The MyPoints Program was developed as a ``True Opt-in''
Internet service, and express permission lies at the heart of our
business model. Put simply, MyPoints has one of the Internet's
strongest privacy pledges--guaranteeing to each member that his or her
personal information will not be released to any third party without
his or her express permission. MyPoints members are fully aware and
have expressly approved of our information practices.
We feel so strongly about our True Opt-in marketing approach that
we have trademarked the term ``True Opt-in.'' However, while extremely
well positioned in the competitive and volatile e-marketplace,
MyPoints.com--like any company in the Internet marketing services
space--is not completely insulated from the privacy concerns rumbling
through Internet message boards, the national media and now, the halls
of Congress. Impact on the industry at large can have an impact on
every player in the industry--even players on the right side of the
privacy debate. In fact, the only way to fully protect every company in
this important and fast-growing industry is for a strong move by the
federal government to regulate this space, and help allay consumer
concerns once and for all. Self-regulation is nice in theory, but with
heavy vested interests in a less than-fully consumer focused privacy
policy, change will be, I fear, too slow to offset consumer concern
over Internet privacy issues. Swift and sure movement by the government
is the best answer.
Let me begin by explaining MyPoints' stand on privacy, and then I
will address how the industry and government need to cooperate to frame
effective legislation. The MyPoints privacy policy makes certain
absolute guarantees to our Members. First and foremost is our pledge
never to release personally identifiable information to any third party
without the Member's express consent. Thus, any person who enrolls in
our program does so voluntarily with the knowledge that their
personally identifiable information is safe in our hands. This key
concept is the foundation of our relationship with our Members, a
relationship based upon trust. We send all communications to the Member
on behalf of our advertisers--we do not reveal our list of e-mail
addresses to anyone. Members are then rewarded simply for reading and
responding to the messages they receive by e-mail and on our website.
On the Internet today, consumer privacy has become an oxymoron.
Businesses have the ability to track consumers as they move about the
virtual world, noting what they like, what they don't like, how long
they spend at one site or another, what they buy and how much they
spend.
For many businesses, the name of the game in Web marketing is
data--personal data that sophisticated advertisers use to target ever
more specific offers. For the consumer there is a bright side as well
as a dark side. The bright side offers ever-more-relevant advertising
and opportunities to extract more value from one's time online. The
dark side shows itself when companies most consumers don't know exist
compile deep profiles on them and manipulate personal data on behalf of
advertisers most consumers never asked to hear from.
It is necessary for government and industry groups to consider both
sides carefully as they inevitably make their way towards more
stringent regulations regarding true consumer privacy on the Internet.
However, a threshold issue has already split the Internet marketing
industry into two camps--the question of who should regulate whom. Most
Internet industry groups call vociferously for self-regulation. The
standard refrain is that government meddling will lead ineluctably to
inefficiencies in a fast-moving marketplace. Yet, it is precisely the
speed at which the Internet is developing that demands a more active
role by the government in protecting consumer privacy online.
There are more than 10 million commercial Web sites in the United
States alone, and the number grows by scores every day. Unfortunately,
according to the recent survey by the Federal Trade Commission (FTC),
only 20% of Web-based businesses currently comply with FTC standards of
fair information practices. There is also significant confusion over
what ``Internet privacy'' really means. Ask five Web site managers to
describe when a user has ``opted in'' and you are likely to get five
very different answers. The Internet marketing industry in general has
proven to be a fairly lax self-regulator. Like any big city on the
information highway there is a Main Street and there are back alleys,
and many ``back alley'' companies have been less than genuine in their
dealings with consumers, especially with respect to the protection of
personal information.
This leaves an important and immediate role for government to play
in protecting consumer privacy by setting fair and simple guidelines
and actively enforcing them. Banner bar networks are one example of
where regulations would be an improvement. Many have been known to
surreptitiously collect user information, and although they do give
users the opportunity to opt out, this presents a barrier to the
average user who simply does not know how to go about it. On the e-
mailer's side, many use an ``opt out'' standard as well, which presents
additional barriers to the unwary consumer. These and other dubious
means to get the user to supply information and supposedly ``agree'' to
its use are what have caused user alarms to sound. A clear-cut,
government-enforced policy would eliminate this issue, in no way
impeding the conduct and growth of legitimate Internet businesses.
Regulation is not something for the industry to fear. A major move
by the government to take charge of this matter will do much to allay
consumer concerns (real and imagined) about Internet security, which
will in turn drive the continued embrace of the Internet. Companies
that will prevail in today's Internet marketplace will do so precisely
because of the relationships they have with their users. Trust is the
key to building that relationship. The problem is not the collection
and manipulation of data per se, but collection and manipulation of
data without express permission based on full disclosure of a Web
marketer's data practices. Consumers are smart. Let them make the call
from there.
Many online marketers will ask, why should this be? In the offline
world, after all, the rule was ``opt out.'' Consumers were fair game
for marketers so long as they didn't specifically ask to be exempted
from the marketing process. But on the Internet, the rules are
dramatically different. Marketers unprecedented power to deliver
messages less expensively, faster, and far more effectively than ever
before. And it is precisely because of the unique advantages of the
medium that marketers must make a trade--the ability to utilize the
medium in exchange for a higher degree of respect for the consumer's
roll in creating it. The Internet is a channel for the consumer, by the
consumer.
Thank you Mr. Chairman for allowing me to express my views on the
online profiling and privacy issue and share MyPoints.com's commitment
to protecting online consumer privacy.
______
Additional Testimony of Richard Smith, Internet Consultant
During the Senate Commerce Committee Hearings on June 13, 2000,
Daniel Jaye of Engage and myself disagreed on the issue of the number
of Web sites which link to the Engage privacy policy. After the
hearings, I did some further investigations of the issue to see why Mr.
Jaye's and my numbers were so different. What I found is that the
AltaVista search engine was able to locate more than 1,100 Web sites
that contain links to the Flycast privacy policy. Flycast is an ad
serving company that Engage acquired earlier this year. Clicking on one
of these Flycast links actually takes a person to the Engage privacy
policy and opt-out page. I believe that for the consumer this is a
confusing situation about who Flycast is versus who Engage is. However,
I now do agree with Mr. Jaye that Engage has worked with member Web
sites of its ad networks to have these sites link to the Engage privacy
policy.