"Do Not Track" – Update

Some Background Notes on Do Not Track – in  Advance of the Future of Privacy Panel and the Energy and Commerce Hearing

Today’s Wall Street Journal article by Julia Angwin focuses on the upcoming “Do Not Track” events taking place this week, including the FPF program on Wednesday, and provides some background on recent developments.  To further brief those of you attending in person or by phone, we thought it would be useful to provide an overview that captures the incredible flurry of advances in this area.  Although there are improvements that are still critically needed, there has been tremendous progress in this area and a host of innovations are just beginning to emerge.  We hope the attention from the FTC, the Hill, the media, and the advocacy community will encourage the next steps needed to advance meaningful consumer controls and will support responsible advertising data uses.

Industry Efforts

Every behavioral targeting company already offers web surfers the option to opt-out of the tracking cookie used to tailor advertising across web sites.  This opt-out relies on the web surfer clicking to accept an opt-out cookie which is generic and ensures a profile isn’t built based on the web sites that are visited.  The Network Advertising Initiative and now the joint coalition of industry groups now known as the Digital Advertising Association provide a central location where web surfers can go to opt-out of most ad networks.  Shortly, companies involved with behavioral advertising will be providing an icon alongside targeted ads, leading users to www.aboutads.info, the DAA’s central opt-out location.  However, the opt-out cookie is deleted when users clear their cookies, tossing them unknowingly back into the ad targeting pool.

When Google launched its behavioral advertising network, it created a browser plug-in that users could download to “protect” their opt-out cookie from deletion.  Chris Soghoian created TACO, a Firefox plug-in which would opt-out a user out of most ad networks by collecting the needed opt-out cookies and protecting them.  Lotame began offering users TACO, in addition to the standard cookie opt-out. Online privacy company Abine has purchased TACO and incorporated it into a free suite of comprehensive consumer privacy tools.  The NAI now offers a download that will protect the opt-out cookies set by its members. Better Advertising is providing a program and process for managing and ensuring opt-outs and overall behavioral policy compliance for the Digital Advertising Association and its Ghostery browser download offers users transparency and detailed controls over cookies plus other tracking methods. TRUSTe offers enhanced an enhanced opt-outs via its program and PrivacyChoice offers an option that can be implemented via a toolbar bookmarklet.  PreferenceCentral offers a centralized opt-out manager tool which also allows users to centrally manage multiple profiles that are created by ad networks.

Advocacy Efforts

In November 2007, a number of advocacy groups led by the World Privacy Forum propose that the FTC create a do not track list by requiring any advertising entity that sets a persistent identifier to provide the domain names of their servers to the FTC.  Consumers would then download this list and use browser plug-ins to ensure those domains did not track them.

Progress

In 2010, the Center for Democracy and Technology and the Future of Privacy Forum held a number of meetings with companies, trade groups, browser companies and advocates focused on improving the opt-out process.  Ideas discussed include plug-ins and the use of an opt-out header that could replace the opt-out cookie.

Policymakers

In 2010, policymakers began expressing support for the general concept of a Do Not track mechanism.  The FTC is expected to advance support for Do Not track in its upcoming privacy report, while the Department of Commerce takes a broader approach in calling for a general Fair Information Practices privacy law.

On Wednesday, FPF convenes a panel of key stakeholders to examine what the different concepts of “Do Not Track”actually are and to discuss questions such as:

                Does government need to play a role or can industry and technology address the concerns?

                Is an Opt-Out or Do Not Track header a feasible replacement for the opt-out cookie?

                Are browser plug-ins or other opt-out managers a potential solution?

                Are there options that continue to enable ad supported content, but give users more control?

At the panel, audience marketing platform provider Lotame Solutions will discuss the improved transparency and consumer choice options afforded by the host of new privacy management tools being introduced by industry groups and independent players, and the risks for consumers and businesses in trying to construct a government-sponsored “Do Not Track” mechanism.  Mozilla  will address future plans for privacy in the Firefox browser.  Technologists, experts and advocates including CDT, Consumer Action, ITIF, Chris Soghoian and Arvind Narayanan will discuss technical and legal paths forward.

Most importantly, kick-off speaker Danny Weitzner of the Department of Commerce/NTIA will help us focus on the bigger picture privacy issues that need to be the lead focus for those who want to see progress in the upcoming year!

 In person seating at the event is filled, but email [email protected] for dial in details.

On Thursday the Energy and Commerce Committee will hold a hearing on Do Not Track and is expected to hear from witnesses including FTC Consumer Chief David Vladeck, TimeWarner Cable, Symantec, Prof Eben Moglen, Susan Grant, Dan Castro of ITIF and others.

FPF Do Not Track Resource Page

http://fpf.org/2010/11/17/do-not-track-resources/

Jules Polonetsky/ChristopherWolf views

A government created Do Not Track list is not a practical solution for advancing online consumer controls.  Recent progress by companies in providing users with access to profiles and the ability to edit  or delete their ad preferences is a far more useful path and should be encouraged.  Companies and technologists can deliver on the goals of “Do Not Track” by improving the current imperfect cookie based opt-out process.  Moreover, certain existing laws can bolster the effectiveness of new technologies designed to empower consumers.  Once consumers choose not to be tracked, companies that ignore those wishes do so at their legal risk. Note: Other panelists at the FPF event will present a range of diverse views.  The opinions of Chris and Jules are not necessarily representative of the position of supporters or advisory board members of the FPF.