Most of the online world is based on a simple, if unarticulated, agreement: consumers browse Web sites free, and in return, they give up data — like their gender or income level — which the sites use to aim their advertisements.
AP
Federal Trade Commission
The new head of the Bureau of Consumer Protection at the Federal Trade Commission, David C. Vladeck, says it is time for that to change. In an interview, Mr. Vladeck outlined plans that could upset the online advertising ecosystem. Privacy policies have become useless, the commission’s standards for the cases it reviews are too narrow, and some online tracking is “Orwellian,” Mr. Vladeck said.
After eight years of what privacy advocates and the industry saw as a relatively pro-business commission, Mr. Vladeck, has made a splash. In June, the commission settled a case with Sears that was a warning shot to companies that thought their privacy policies protected them. In just over six weeks on the job, he has asked Congress for a bigger budget and for a streamlined way to create regulations. And he said he would hire technologists to help analyze online marketers’ tracking.
“These are pretty aggressive moves for an agency of a new administration,” said Charles Kennedy, who handles privacy cases at Morrison & Foerster.
But some executives say they are wary of too much intervention. “We have to be very, very careful not to take steps that will upset” the Internet economy, said Stuart P. Ingis, a partner at the law firm Venable who is counsel to an ad industry consortium.
Mr. Vladeck’s first moves have been to pick apart industry groups’ proposed self-regulatory principles and to meet with companies to discuss online ad guidelines.
“The frameworks that we’ve been using historically for privacy are no longer sufficient,” Mr. Vladeck said.
Though the privacy issues are new to Mr. Vladeck, he appears to have studied quickly — he didn’t refer to notes during an interview. A professor at Georgetown Law for seven years, he also spent 26 years as a litigator with the Public Citizen Litigation Group, a public-interest law firm. “There is a sense of urgency around here,” he said. “Consumers, I don’t think are sufficiently protected under the current regime.”
He said his broad mission was to redefine how the commission looked at online privacy. Predecessors at the agency had different approaches to regulating online behavior, including whether companies were causing harm to consumers, and instructing companies to write privacy policies, Mr. Vladeck said.
The Sears case suggested that Mr. Vladeck had adopted a new approach. Sears had offered customers $10 to download software onto their computers, saying it would track their browsing. The commission said that the software also collected information like prescription records and bank statements. Sears settled with the commission in June.
It wasn’t a case that caused economic harm, though. Rather than taking money from consumers, Sears was paying them for the tracking. “Under the harm framework, we couldn’t have brought that case,” Mr. Vladeck said. (Though he hadn’t officially started at the commission, and the case was under way before he joined, he was consulting for it when the settlement was announced.) Now, Mr. Vladeck indicated, the commission would begin considering not just whether companies caused monetary harm, but whether they violated consumers’ dignity.
“There’s a huge dignity interest wrapped up in having somebody looking at your financial records when they have no business doing that,” he said.
The Sears case also signaled a departure from what the commission’s presumed position that as long as marketers wrote detailed privacy policies, they were protected. Sears had included information about tracking in its user license agreement, but that wasn’t good enough anymore, Mr. Vladeck said.
“I don’t believe that most consumers either read them, or if they read them, really understand it,” he said.
Mr. Vladeck has signaled that he will make changes, but he has not specified what they will be, and he said he did not necessarily support new rules.
“We’re not committing ourselves to imposing regulation,” he said. “What we would like is to figure out useful tools and a more comprehensive way of looking at privacy protections that may obviate the need for rules.”
In February, before Mr. Vladeck joined the commission, it issued a report on what it wanted to see from online advertising companies. Industry groups scrambled to respond with their own report, issued in July, outlining how they would regulate themselves. Their views are somewhat in line with Mr. Vladeck’s, but they differ in significant areas. For instance, Mr. Vladeck said he would consider requiring sites collecting personal data to get consumers’ assent whenever they visit the site (an “opt-in”).
But marketers say such a tactic would be disastrous. “It’s impossible to communicate the value proposition to a consumer at the point of an advertisement,” said Matt Wise, chief executive of Q Interactive, a Chicago online marketing firm. Mandatory opt-in “would be a tremendous setback in innovation,” he said.
The changes Mr. Vladeck is considering could mean a different online world, where sites couldn’t depend on targeted ads to make money. But could a site refuse to allow access to people who wouldn’t hand over data?
Mr. Vladeck said that the commission would have to consider whether that meant businesses were treating consumers unfairly, but over all, he said he was not troubled by the problems this might pose for marketers.
“Let people vote with their feet,” he said. ““If the marketers are right, and the consumers like behavioral advertising, then it should be no big deal.
“The message is, you have to be more transparent about what it is you’re doing.”