The U.S. Federal Trade Commission plans to take a hard look at how it enforces consumer privacy standards in the coming months, with new rules for online companies possibly on the way, the agency’s chairman said Monday.
With advances in computer technology, online companies are able to track Web users and store personal data at increasingly lower costs, and the FTC will pay increased attention to online privacy concerns over the next six months, FTC Chairman Jon Leibowitz said during an agency workshop on privacy Monday.
“We’re at another watershed moment in privacy, and the time is right for the commission … to take a broader look at privacy,” Leibowitz said. “Companies can store and chunk massive amounts of data relatively cheaply.”
Web users often have little understanding about what personal data online companies and advertising networks are collecting, and how they are using the data, Leibowitz said. “How many consumers … have ever heard the names of the many ad networks that end up with their information in the process of targeting ads?” he said. “How many people understand the networks’ role?”
Online companies are also grappling with how to best protect privacy, Leibowitz added. Earlier this year, retailer Sears settled an FTC complaint that it tracked the secure Web transactions of customers invited to join a shopping research club, he noted.
“Nobody argues that the folks at Sears are bad people who wanted to do bad things with the information,” he said. “To the contrary, they probably didn’t know exactly what they expected to learn from this data. That just demonstrates, however, that all of us are still feeling our way around what respecting privacy really means.”
Monday’s workshop was the first of three exploring privacy that the FTC has planned in the coming months. The FTC doesn’t yet know what it will do with the information it collects at the workshops, Leibowitz said. The FTC has so far focused on requiring online companies to give customers notice and choice about data collection and on bringing complaints when customers have been harmed, but those approaches “haven’t worked quite as well as we would have liked,” he said.
The FTC will look for ways to enforce privacy standards that are “better for consumers and fair to businesses as well,” he said.
Some U.S. lawmakers have also talked about introducing comprehensive privacy legislation by early next year.
Others at the workshop argued that new rules aren’t needed. While some surveys have suggested Web users value their privacy, in practice, they often trade away some privacy for small benefits, said Adam Thierer, president of the Progress and Freedom Foundation, a free-market think tank.
“People are living their lives like an open book on social-networking sites every single minute of the day,” Thierer said. “Privacy is a subjective condition out there and there’s a lot of trial and error out there. People themselves personally experiment with how much they want to give away about themselves every single day, in exchange for something else.”
Online companies should be able to try new ways to deliver privacy tools to users, without the government telling them how to do it, he said.
“We have to ask the question if we’re going to allow ongoing experimentation with disclosures, dashboards and privacy tools, or whether we’re going to foreclose that process with sort of a one-size-fits-all model that says, ‘This is the way we think it should work, and work forever more,’” he said. “We should allow and encourage more experimentation, more competition between these companies.”
But, according to several surveys, consumers believe the government has more laws to protect their privacy than exist, said Joseph Turow, a professor of communication at the University of Pennsylvania. “There is a sense that laws protect them far more than they do when it comes to privacy,” he said.
Web users also may not understand what activities lead to less privacy, added Lorrie Faith Cranor, associate professor of computer science at Carnegie Mellon University. “There are a lot of people who don’t know what a cookie is, still,” she said. “We have situations where people don’t understand the consequences of their actions. People are behaving in the real world based on asymmetric information.”