FTC Expected to Issue Report Examining ‘Comprehensive’ Tracking of Internet Users

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

The Federal Trade Commission this year plans to issue a report addressing the ability of companies such as internet service providers to engage in “comprehensive” tracking of web users, an official told BNA Feb. 12.

The upcoming report is expected to be informed by a commission workshop held in December 2012 (11 PVLR 1751, 12/10/12).

“I think the report we issue this year will be a little different from the past reports on online tracking, which focused mostly on data collection by ad networks,” Maneesha Mithal, an associate director in the FTC's Bureau of Consumer Protection, told BNA.

In recent years, the commission has closely examined privacy concerns surrounding so-called advertising networks that track consumer activity across popular websites. The practice, known as behavioral advertising, involves the collection of data such as Google searches to build consumer profiles that can facilitate targeted marketing.

In response to pressure from the FTC and Congress, the industry has formed a self-regulatory organization known as the Digital Advertising Alliance. The DAA is involved in discussions to develop a “do-not-track” mechanism that would make it easier for consumers to avoid having their online activities followed by marketers.

ISPs Raise 'Heightened' Concerns

The FTC is turning the spotlight on large platforms, such as ISPs, operating systems, and browsers, which have the potential to engage in tracking that is more “comprehensive” in nature, raising “heightened” privacy concerns, according to the agency.

The commission examined the matter during a Dec. 6, 2012, workshop and briefly addressed it in a broad privacy report issued in March 2012 (11 PVLR 590, 4/2/12). The document said that ISPs, for example, serve as a major gateway to the internet--with access to vast amounts of unencrypted personal data--and are thus in a position to develop “highly detailed” and comprehensive profiles of their customers in a manner that may be “completely invisible.”

A key policy question before the commission is whether ISPs and other companies that have the ability to engage in comprehensive tracking should be required to obtain prior opt-in consent from consumers before doing so. By contrast, under DAA rules, marketers are generally permitted to tailor their ads using data collected from Google and other websites, so long as consumers are notified about the practice and given the chance to opt out.

“[W]hile companies such as Google and Facebook are expanding their reach rapidly, they currently are not so widespread that they could track a consumer's every movement across the Internet,” the FTC said in its 2012 privacy report. “Accordingly, although tracking by these entities warrants consumer choice, the Commission does not believe that such tracking currently raises the same level of privacy concerns as those entities that can comprehensively track all or virtually [all] of a consumer's online activity.”

Data Brokers Also Under Scrutiny

Meanwhile, the commission also hopes to issue a report this year examining privacy concerns related to the so-called data broker industry, which collects, compiles, and sells consumer information to third parties, Mithal said.

In December 2012, the FTC issued orders requiring nine data brokers to provide the agency with information about how they collect and use consumer data (11 PVLR 1845, 12/24/12).

“[C]onsumers are often unaware of the existence of data brokers as well as the purposes for which they collect and use consumers' data,” the commission said in a statement announcing the inquiry. “This lack of transparency also means that even when data brokers offer consumers the ability to access their data, or provide other tools, many consumers do not know how to exercise this right. There are no current laws requiring data brokers to maintain the privacy of consumer data unless they use that data for credit, employment, insurance, housing, or other similar purposes.”

The FTC's 2012 report recommended that Congress enact legislation to provide consumers with access to information about them held by a data broker. The agency also called on data brokers that compile information for marketing purposes to explore the idea of creating a centralized website where they could identify themselves to consumers and provide information on their policies.

On Dec. 13, 2012, Reps. Edward J. Markey (D-Mass.) and Joe Barton (R-Texas), co-chairmen of the bipartisan House Privacy Caucus and members of the House Energy and Commerce Committee, held a congressional briefing where they questioned representatives from the data broker industry about their information collection and use practices (11 PVLR 1810, 12/17/12).

Markey and Barton, along with other House lawmakers, in July 2012 sent inquiries to data brokers seeking information about their privacy practices (11 PVLR 1207, 7/30/12; 11 PVLR 1680, 11/19/12). In October 2012, Senate Commerce, Science, and Transportation Committee Chairman John D. Rockefeller IV (D-W.Va.) sent a similar letter (11 PVLR 1522, 10/15/12).

By Alexei Alexis  

The FTC's March 2012 privacy report is available at http://ftc.gov/os/2012/03/120326privacyreport.pdf.