The Behavioral Tracker Registry: What it is not and what it needs to be

Today’s announcement of recommendations from a coalition of privacy advocates got a lot of press, which bodes well for a hearty legislative discussion. Some accounts have compared the new proposed “Behavioral Tracker Registry” to the Do-Not-Call registry the FTC operates to limit junk calling. The two actually are quite different.

The Do-Not-Call registry allows consumers to register their telephone number as one that does not want unsolicited calls. Any prospective marketing caller must screen out numbers on that list, or face legal penalties. The Behavioral Tracker Registry, as proposed, would not involve any consumer registration. Rather, it is the targeters who would need to register.

Here’s how the privacy coalition describes the registry:

The FTC should maintain an online registry of organizations that engage in behavioral tracking. Behavioral tracking organizations should be required to provide current information to the FTC registry that will, at a minimum:

a) contain technical information required so that consumers can opt out of tracking through tracking cookies, browser settings or extensions, and other methods.

b) appear online in a format so that third parties can develop consumer tools such as browser settings or extensions or tracking cookie management software that will automatically update from the registry.

c) include the name, physical address, and contact information of the BT company doing the tracking, along with information about how to file a complaint about the company or about its opt-out procedures.

d) include a complete description of the categories of consumer information collected, all online and other sources of consumer information, and the countries where the information is stored.

The essence of the proposal is dead-on right — tracking firms must identify themselves and facilitate third-party tools for consumers to block them. Consumers don’t need to register because their computers and devices can control who has access to their information. Hard to disagree with this, and we will work to develop those tools.

But there’s an important point missing from this formulation of a behavioral tracking registry. In my mind, the most important feature of a registry is this:

• The tracking company identifies every domain they use in the course of behavioral targeting, and
• The tracking company binds their privacy policy with those domains, by registering their privacy policy URL

It is easy enough to identify domains that serve content on pages and write cookies. What is usually more difficult is tracking down the network to which the domain belongs. By requiring trackers to claim the domains they use and confirm their privacy promises as to those activities, you create the infrastructure necessary for third party tools to implement consumer preferences.

20 recommendations, 15 comments

I thought it might be useful to republish the text of the 20 recommendations (PDF)  made today by a coalition of privacy groups, along with unsolicited (italicized) commentary from Yours Truly.

To protect the interests of Americans, while maintaining robust online commerce, Congress must enact clear legislation to protect consumers’ privacy online which implements Fair Information Practices. While these recommendations are not exhaustive, they do represent areas in which the leading organizations concerned with consumer privacy are in consensus. Consumer privacy legislation should include these main points (for more detailed recommendations, please see the Legislative Recommendations Primer):

• Individuals should be protected even if the information collected about them in behavioral tracking cannot be linked to their names, addresses, or other traditional “personally identifiable information,” as long as they can be distinguished as a particular computer user based on their profile.

• Sensitive information should not be collected or used for behavioral tracking or targeting.

• No behavioral data should be collected or used from children and adolescents under 18 to the extent that age can be inferred.

• The ability of websites and ad networks to collect and use behavioral data should be limited to 24 hours, after which affirmative consent should be required.

• Behavioral data should not be retained for more than 3 months.

• Pretexting should not be used to obtain personal or behavioral data from individuals.

• Behavioral trackers and targeters should adopt policies, as relevant, for the types of data that will be collected and how that information will be maintained and used, and clearly explain those policies on their websites.

• Personal and behavioral data should not be used or disclosed in a manner that is inconsistent with published policies, except where required by law.

• Behavioral data shouldn’t be used in any way other than for the advertising purposes for which it was collected.

• Ads based on behavioral data should contain links to consumer-friendly explanations and controls.

• A targeter or tracker that has personal or behavioral data should not use the data or compiled profile in a manner that could affect an individual’s credit, education, employment, insurance, access to government benefits or resources.

• Neither personal nor behavioral data should be used in any way that would unfairly discriminate against an individual.

• Reasonable security safeguards against loss, unauthorized access, modification, disclosure and other risks should protect both personal and behavioral data.

• Individuals should have the right to confirm whether a data controller has their personal or behavioral data, request such data, and delete it.

• Each organization involved in any behavioral tracking and targeting should be accountable for complying with the law and its own policies.

• Consumers should have the right of private action with liquidated damages.

• Data collected for behavioral tracking or targeting should be protected by the constitutional safeguards that rule evidence collection.

• The FTC should establish a Behavioral Tracker Registry.

• There should be no preemption of state laws.

To protect the interests of Americans, while maintaining robust online commerce, Congress must enact clear legislation to protect consumers’ privacy online which implements Fair Information Practices. While these recommendations are not exhaustive, they do represent areas in which the leading organizations concerned with consumer privacy are in consensus. Consumer privacy legislation should include these main points (for more detailed recommendations, please see the Legislative Recommendations Primer):

• Individuals should be protected even if the information collected about them in behavioral tracking cannot be linked to their names, addresses, or other traditional “personally identifiable information,” as long as they can be distinguished as a particular computer user based on their profile. PC: Now the question is, what does “protected” mean?

• Sensitive information should not be collected or used for behavioral tracking or targeting. PC: Yes, and the government needs to crisply define what that means. Take a look at the privacy summaries for the top 10 ad networks to see how that varies in practice now.

• No behavioral data should be collected or used from children and adolescents under 18 to the extent that age can be inferred. PC: “Can be inferred” or “is inferred” would be the key distinction. They say you can identify the gender of a person within a few clicks across sites, perhaps the same is true for kids. This will be hard technically.

• The ability of websites and ad networks to collect and use behavioral data should be limited to 24 hours, after which affirmative consent should be required. PC: This is a somewhat indirect way of saying, behavioral targeting should always be on an opt-in rather than opt-out basis, (except for retargeters). If this was the law, few if any of the other recommendations would be necessary. This feels like an opening negotiating position.

• Behavioral data should not be retained for more than 3 months. PC: Even with user consent (as required by the prior recommendation)? If so, that seems paternalistic.

• Pretexting should not be used to obtain personal or behavioral data from individuals.

• Behavioral trackers and targeters should adopt policies, as relevant, for the types of data that will be collected and how that information will be maintained and used, and clearly explain those policies on their websites. PC: That’s what is supposed to be happening now, but if you read this blog, you know compliance is spotty.

• Personal and behavioral data should not be used or disclosed in a manner that is inconsistent with published policies, except where required by law. PC: Although this doesn’t sound hard hitting, it’s actually a key point: to make it clear that published privacy policies are binding obligations of the companies that post them.

• Behavioral data shouldn’t be used in any way other than for the advertising purposes for which it was collected. PC: This is good, so long as there are meaningful disclosures of those purposes.

• Ads based on behavioral data should contain links to consumer-friendly explanations and controls. PC: It seems like the stage may be set for conflict on this point. The IAB self-regulatory principles agree that in-ad disclosure is good, but also allows for in-site disclosure, perhaps because it is less disruptive to the consumer experience and easier to use. In-ad disclosure puts the burden on the consumer to watch out for ads that might be tracking them, whereas meaningful and prominent in-site exposure gives consumers all of the relevant information about sites tracking them and the opportunity opt out. See what an in-site privacy disclosure can look like with this example.).

• A targeter or tracker that has personal or behavioral data should not use the data or compiled profile in a manner that could affect an individual’s credit, education, employment, insurance, access to government benefits or resources. PC: Well put and sensible.

• Neither personal nor behavioral data should be used in any way that would unfairly discriminate against an individual.

• Reasonable security safeguards against loss, unauthorized access, modification, disclosure and other risks should protect both personal and behavioral data.

• Individuals should have the right to confirm whether a data controller has their personal or behavioral data, request such data, and delete it. PC: Wouldn’t this only apply if the behavioral information is associated with personal information that would allow retrieval? Personally, I’d rather see a ban on those associations (unless consensual).

• Each organization involved in any behavioral tracking and targeting should be accountable for complying with the law and its own policies.

• Consumers should have the right of private action with liquidated damages. PC: Gulp. I would think there will violent industry opposition to this. No doubt you would see more resources spent on compliance, but violations will be transparent to users, by and large, so where’s the recommendation on external auditing?

• Data collected for behavioral tracking or targeting should be protected by the constitutional safeguards that rule evidence collection. PC: No disagreement with that, although I don’t understand it either.

• The FTC should establish a Behavioral Tracker Registry. PC: If this means the equivalent of a Do-Not-Call registry, I have some technical questions. Tracking inherently operates at the machine or device level, which means any do-not-track implementation centers around giving the user technical tools (in browser) that either signify an optout decision or actually prevent tracking by blocking certain domains, and do so permanently. AKA Ghostery. Perhaps the law needs to be that behavioral trackers need to cooperate and not subvert these browser tools, and that their opt-out processes must remain open for folks (like us) to build privacy preference applications?

• There should be no preemption of state laws. PC: I’m sure there’s a fascinating story behind this one. Unfortunately, preemption caselaw makes my head hurt.

* * *

For those interested in diving deeper, here’s the full legislative analysis the was released with the recommendations.

View this document on Scribd