tracking. But, as I have said, consumer surveys are inconclusive, and individual consumers by and large do
not “opt out” from tracking when given the chance to do so.
Not surprisingly, large enterprises in highly
concentrated industries, which may be tempted to raise the privacy bar so high that it will disadvantage
rivals, also support adopting more stringent privacy principles.
周e “ﬁnal” Privacy Report (incorporating the preliminary staﬀ report) repeatedly sides with consumer
organizations and large enterprises. It proceeds on the premise that behavioral tracking is “unfair.”
周us, the Report expressly recommends that “reputational harm” be considered a type of harm that
the Commission should redress.
周e Report also expressly says that privacy be the default setting for
commercial data practices.
Indeed, the Report says that the “traditional distinction between PII and non-
PII has blurred,”
and it recommends “shifting the burdens away from consumers and placing obligations
To the extent the Report seeks consistency with international privacy standards,
urge caution. We should always carefully consider whether each individual policy choice regarding privacy is
appropriate for this country in all contexts.
周at is not how the Commission itself has traditionally proceeded. To the contrary, the Commission
represented in its 1980, and 1982, Statements to Congress that, absent deception, it will not generally
enforce Section 5 against alleged intangible harm.
In other contexts, the Commission has tried, through
its advocacy, to convince others that our policy judgments are sensible and ought to be adopted. And, as I
stated in connection with the recent Intel complaint, in the competition context, one of the principal virtues
6 See Katy Bachman, Study: Internet User Adoption of DNT Hard to Predict, adweek.com, March 20, 2012, available at http://
www.adweek.com/news/technology/study-internet-user-adoption-dnt-hard-predict-139091 (reporting on a survey that found
that what Internet users say they are going to do about using a Do Not Track button and what they are currently doing about
blocking tracking on the Internet, are two diﬀerent things); see also Concurring Statement of Commissioner J. 周omas Rosch,
Issuance of Preliminary FTC Staﬀ Report “Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework
for Businesses and Policymakers” (Dec. 1, 2010), available at http://www.ftc.gov/speeches/rosch/101201privacyreport.pdf.
7 See J. 周omas Rosch, Comm’r, Fed. Trade Comm’n, Do Not Track: Privacy in an Internet Age, Remarks at Loyola Chicago
Antitrust Institute Forum, (Oct. 14, 2011), available at http://www.ftc.gov/speeches/rosch/111014-dnt-loyola.pdf; see also
Report at 9.
8 Report at 8 and n.37.
9 Id. at 2. 周e Report seems to imply that the Do Not Call Rule would support this extension of the deﬁnition of harm. See
id. (“unwarranted intrusions into their daily lives”). However, it must be emphasized that the Congress granted the FTC
underlying authority under the Telemarketing and Consumer Fraud and Abuse Prevention Act, 15 U.S.C. §§ 6101-6108,
to promulgate the Do Not Call provisions and other substantial amendments to the TSR. 周e Commission did not do so
11 Id. at 19.
12 Id. at 23, see also id. at 24.
13 Id. at 9-10. 周is does not mean that I am an isolationist or am impervious to the beneﬁts of a global solution. But, as stated
below, there is more than one way to skin this cat.
14 See Letter from the FTC to Hon. Wendell Ford and Hon. John Danforth, Committee on Commerce, Science and
Transportation, United States Senate, Commission Statement of Policy on the Scope of Consumer Unfairness Jurisdiction
(Dec. 17, 1980), reprinted in International Harvester Co., 104 F.T.C. 949, 1070, 1073 (1984) (“Unfairness Policy
Statement”) available at http://www.ftc.gov/bcp/policystmt/ad-unfair.htm; Letter from the FTC to Hon. Bob Packwood and
Hon. Bob Kasten, Committee on Commerce, Science and Transportation, United States Senate, reprinted in FTC Antitrust
& Trade Reg. Rep. (BNA) 1055, at 568-570 (“Packwood-Kasten letter”); and 15 U.S.C. § 45(n), which codiﬁed the FTC’s
of applying Section 5 was that that provision was “self-limiting,” and I advocated that Section 5 be applied
on a stand-alone basis only to a ﬁrm with monopoly or near-monopoly power.
Indeed, as I have remarked,
absent such a limiting principle, privacy may be used as a weapon by ﬁrms having monopoly or near-
周ere does not appear to be any such limiting principle applicable to many of the recommendations
of the Report. If implemented as written, many of the Report’s recommendations would instead apply to
almost all ﬁrms and to most information collection practices. It would install “Big Brother” as the watchdog
over these practices not only in the online world but in the oﬄine world.
周at is not only paternalistic, but
it goes well beyond what the Commission said in the early 1980s that it would do, and well beyond what
Congress has permitted the Commission to do under Section 5(n).
I would instead stand by what we have
said and challenge information collection practices, including behavioral tracking, only when these practices
are deceptive, “unfair” within the strictures of Section 5(n) and our commitments to Congress, or employed
by a ﬁrm with market power and therefore challengeable on a stand-alone basis under Section 5’s prohibition
of unfair methods of competition.
Second, the current self-regulation and browser mechanisms for implementing Do Not Track solutions
may have advanced since the issuance of the preliminary staﬀ Report.
But, as the ﬁnal Report concedes,
they are far from perfect,
and they may never be, despite eﬀorts to create a standard through the World
Wide Web Consortium (“W3C”) for the browser mechanism.
More speciﬁcally, as I have said before, the major browser ﬁrms’ interest in developing Do Not Track
mechanisms begs the question of whether and to what extent those major browser ﬁrms will act strategically
and opportunistically (to use privacy to protect their own entrenched interests).
In addition, the recent announcement by the Digital Advertising Alliance (DAA) that it will honor the
tracking choices consumers make through their browsers raises more questions than answers for me. 周e
Report is not clear, and I am concerned, about the extent to which this latest initiative will displace the
standard-setting eﬀort that has recently been undertaken by the W3C. Furthermore, it is not clear that all
the interested players in the Do Not Track arena – whether it be the DAA, the browser ﬁrms, the W3C, or
consumer advocacy groups – will be able to come to agreement about what “Do Not Track” even means.
It may be that the ﬁrms professing an interest in self-regulation are really talking about a “Do Not Target”
mechanism, which would only prevent a ﬁrm from serving targeted ads, rather than a “Do Not Track”
15 See Concurring and Dissenting Statement of Commissioner J. 周omas Rosch, In re Intel Corp., Docket No. 9341, (Dec. 16,
2009), available at http://www.ftc.gov/os/adjpro/d9341/091216intelstatement.pdf.
16 See Rosch, supra note 7 at 20.
17 See Report at 13.
18 Federal Trade Commission Act Amendments of 1994, Pub. L. No. 103-312.
19 Report at 4, 52.
20 Id. at 53, 54; see esp. id. at 53 n.250.
21 Id. at 5, 54.
22 See Rosch, supra note 7 at 20-21.
23 Tony Romm, “What Exactly Does ‘Do Not Track’ Mean?,” Politico, Mar. 13, 2012, available at http://www.politico.com/news/
stories/0312/73976.html; see also Report at 4 (DAA allows consumer to opt out of “targeted advertising”).
mechanism, which would prevent the collection of consumer data altogether. For example, the DAA’s Self-
Regulatory Principles for Multi-Site Data do not apply to data collected for “market research” or “product
For their part, the major consumer advocacy groups may not be interested in a true “Do
Not Track” mechanism either. 周ey may only be interested in a mechanism that prevents data brokers from
compiling consumer proﬁles instead of a comprehensive solution. It is hard to see how the W3C can adopt
a standard unless and until there is an agreement about what the standard is supposed to prevent.
It is also not clear whether or to what extent the lessons of the Carnegie Mellon Study respecting the
lack of consumer understanding of how to access and use Do Not Track will be heeded.
Similarly, it is not
clear whether and to what extent Commissioner Brill’s concern that consumers’ choices, whether it be “Do
Not Collect” or merely “Do Not Target,” will be honored.
Along the same lines, it is also not clear whether
and to what extent a “partial” Do Not Track solution (oﬀering nuanced choice) will be oﬀered or whether
it is “all or nothing.” Indeed, it is not clear whether consumers can or will be given complete and accurate
information about the pros and the cons of subscribing to Do Not Track before they choose it. I ﬁnd this
last question especially vexing in light of a recent study that indicated 84% of users polled prefer targeted
advertising in exchange for free online content.
周ird, I am concerned that “opt-in” will necessarily be selected as the de facto method of consumer
choice for a wide swath of entities that have a ﬁrst-party relationship with consumers but who can
potentially track consumers’ activities across unrelated websites, under circumstances where it is unlikely,
because of the “context” (which is undeﬁned) for such tracking to be “consistent” (which is undeﬁned)
with that ﬁrst-party relationship:
1) companies with multiple lines of business that allow data collection
in diﬀerent contexts (such as Google);
2) “social networks,” (such as Facebook and Twitter), which could
potentially use “cookies,” “plug-ins,” applications, or other mechanisms to track a consumer’s activities across
24 See Self-Regulatory Principles for Multi-Site Data, Digital Advertising Alliance, Nov. 2011, at 3, 10, 11, available at http://
www.aboutads.info/resource/download/Multi-Site-Data-Principles.pdf; see also Tanzina Vega, Opt-Out Provision Would
Halt Some, but Not All, Web Tracking, New York Times, Feb. 26, 2012, available at http://www.nytimes.com/2012/02/27/
25 See Vega, supra note 24.
26 “Why Johnny Can’t Opt Out: A Usability Evaluation of Tools to Limit Online Behavioral Advertising,” Carnegie Mellon
University CyLab, Oct. 31, 2011, available at http://www.cylab.cmu.edu/ﬁles/pdfs/tech_reports/CMUCyLab11017.pdf; see
also Search Engine Use 2012, at 25, Pew Internet & American Life Project, Pew Research Center, Mar. 9, 2012, available at
http://pewinternet.org/~/media/Files/Reports/2012/PIP_Search_Engine_Use_2012.pdf (“[j]ust 38% of internet users say
they are generally aware of ways they themselves can limit how much information about them is collected by a website”).
27 See Julie Brill, Comm’r, Fed. Trade Comm’n, Big Data, Big Issues, Remarks at Fordham University School of Law (Mar. 2,
2012) available at http://www.ftc.gov/speeches/brill/120228fordhamlawschool.pdf.
28 See Bachman, supra note 6.
29 Report at 41.
30 Id. Notwithstanding that Google’s prospective conduct seems to ﬁt perfectly the circumstances set forth on this page of
the Report (describing a company with multiple lines of business including a search engine and ad network), where the
Commission states “consumer choice” is warranted, the Report goes on to conclude on page 56 that Google’s practices do
not require aﬃrmative express consent because they “currently are not so widespread that they could track a consumer’s every
movement across the Internet.”
and 3) “retargeters,” (such as Amazon or Pacers), which include a retailer who delivers an ad
on a third-party website based on the consumer’s previous activity on the retailer’s website.
周ese entities might have to give consumers “opt-in” choice now or in the future: 1) regardless whether
regardless of the sensitivity of the information being collected; 3) regardless whether the consumer cares
whether “tracking” is actually occurring; 4) regardless of the entity’s market position (whether the entity
can use privacy strategically – i.e., an opt-in requirement – in order to cripple or eliminate a rival); and 5)
conversely, regardless whether the entity can compete eﬀectively or innovate, as a practical matter, if it must
oﬀer “opt in” choice.
Fourth, I question the Report’s apparent mandate that ISPs, with respect to uses of deep packet
inspection, be required to use opt-in choice.
周is is not to say there is no basis for requiring ISPs to
use opt-in choice without requiring opt-in choice for other large platform providers. But that kind of
“discrimination” cannot be justiﬁed, as the Report says, because ISPs have “are in a position to develop
highly detailed and comprehensive proﬁles of their customers.”
So does any large platform provider who
makes available a browser or operating system to consumers.
Nor can that “discrimination” be justiﬁed on the ground that ISPs may potentially use that data to
“track” customer behavior in a fashion that is contrary to consumer expectations. 周ere is no reliable data
establishing that most ISPs presently do so. Indeed, with a business model based on subscription revenue,
ISPs arguably lack the same incentives as do other platform providers whose business model is based on
attracting advertising and advertising revenue: ISPs assert that they track data only to perform operational
and security functions; whereas other platform providers that have business models based on advertising
revenue track data in order to maximize their advertising revenue.
What really distinguishes ISPs from most other “large platform providers” is that their markets can be
Moreover, even when an ISP operates in a less concentrated market, switching costs
can be, or can be perceived as being, high.
As I said in connection with the Intel complaint, a monopolist
or near monopolist may have obligations which others do not have.
周e only similarly situated platform
provider may be Google, which, because of its alleged monopoly power in the search advertising market,
31 Id. at 40. See also supra note 30. 周at observation also applies to “social networks” like Facebook.
32 Id. at 41.
33 See id. at 60 (“Final Principle”).
34 Id. at 56 (“the Commission has strong concerns about the use of DPI for purposes inconsistent with an ISP’s interaction with
a consumer, without express aﬃrmative consent or more robust protection”).
37 Federal Communications Commission, Connecting America: 周e National Broadband Plan, Broadband Competition and
Innovation Policy, Section 4.1, Networks, Competition in Residential Broadband Markets at 36, available at http://www.
38 Federal Communications Commission Working Paper, Broadband decisions: What drives consumers to switch – or stick
with – their broadband Internet provider (Dec. 2010), at 3, 8, available at http://transition.fcc.gov/Daily_Releases/Daily_
39 See Rosch, supra note 15.
has similar power. For any of these “large platform providers,” however, aﬃrmative express consent should
be required only when the provider actually wants to use the data in this fashion, not just when it has the
potential to do so.
Although the Chairman testiﬁed recently before the House Appropriations Subcommittee chaired
by Congresswoman Emerson that the recommendations of the ﬁnal Report are supposed to be nothing
more than “best practices,”
I am concerned that the language of the Report indicates otherwise, and
broadly hints at the prospect of enforcement.
周e Report also acknowledges that it is intended to serve
as a template for legislative recommendations.
Moreover, to the extent that the Report’s “best practices”
mirror the Administration’s privacy “Bill of Rights,” the President has speciﬁcally asked either that the “Bill
of Rights” be adopted by the Congress or that they be distilled into “enforceable codes of conduct.”
I testiﬁed before the same subcommittee, this is a “tautology;” either these practices are to be adopted
voluntarily by the ﬁrms involved or else there is a federal requirement that they be adopted, in which case
there can be no pretense that they are “voluntary.”
It makes no diﬀerence whether the federal requirement
is in the form of enforceable codes of conduct or in the form of an act of Congress. Indeed, it is arguable
that neither is needed if these ﬁrms feel obliged to comply with the “best practices” or face the wrath of “the
Commission” or its staﬀ.
40 See, e.g., Report at 56.
41 Testimony of Jon Leibowitz and J. 周omas Rosch, Chairman and Comm’r, FTC, 周e FTC in FY2013: Protecting Consumers
and Competition: Hearing on Budget Before the H. Comm. on Appropriations Subcomm. on Financial Services and General
th Cong. 2 (2012), text from CQ Roll Call, available from: LexisNexis® Congressional.
42 One notable example is found where the Report discusses the articulation of privacy harms and enforcement actions brought
on the basis of deception. 周e Report then notes “[l]ike these enforcement actions, a privacy framework should address
practices that unexpectedly reveal previously private information even absent physical or ﬁnancial harm, or unwarranted
intrusions.” Report at 8. 周e accompanying footnote concludes that “even in the absence of such misrepresentations,
revealing previously-private consumer data could cause consumer harm.” See also infra note 43.
43 Id. at 16 (“to the extent Congress enacts any of the Commission’s recommendations through legislation”); see also id. at 12-
13 (“the Commission calls on Congress to develop baseline privacy legislation that is technologically neutral and suﬃciently
ﬂexible to allow companies to continue to innovate”).
44 See Letter from President Barack Obama, appended to White House, Consumer Data Privacy in a Networked World: A
Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (Feb. 23, 2012), available at http://
45 See FTC Testimony, supra note 41.
Documents you may be interested
Documents you may be interested