Don't track Internet surfers by default, says FTC official

A Federal Trade Commission official on Thursday issued a warning of sorts to Internet companies: stop collecting information about your users by default, and give them shorter, more conspicuous details about what's going on with their data.

The government doesn't need to force such practices "at this point," said Commissioner Jon Leibowitz, a Democrat. But in his view, online services need to start offering users more "meaningful choices," such as the ability to "opt in" to placement of Web cookies on their machines from the start, rather than the typical "opt out" scenario. Those options are especially important as more and more sites share information gleaned from those tracking tools with third parties, he said.

"The current 'don't ask, don't tell' mentality in online profile tracking needs to end," he said in a speech near the start of a two-day FTC workshop on behavioral marketing.

In any case, he said the FTC won't hesitate to bring lawsuits against companies if there's evidence of "problematic practices" in the increasingly sophisticated world of behavioral marketing, in which companies seek to deliver ads based on tracking consumers' search, searching and other Internet-based habits.

"As the Internet has evolved, the ad targeting has become more sophisticated, arguably bringing greater benefits and a richer experience to consumers, but the question is, at what cost?" Leibowitz asked. "Are we paying too high a price in privacy?"

The online advertising industry, not surprisingly, says it's aware of potential privacy threats but argues self-regulation is the best way to manage them.

Burdensome government regulations could stunt the delivery of new services, Randall Rothenberg, president of the Interactive Advertising Bureau (of which News.com parent company CNET Networks is a member), told workshop attendees. That's because increasingly sophisticated analysis of "non-personally-identifiable data to detect patterns in peoples' interests and consumption habits" has led to a surge in interactive, often free content and has helped to usher in a "renaissance" in American mom and pop shops, he said.

But Leibowitz said he wasn't so sure a hands-off government approach will be enough. One "very promising approach," he said, would be creating a "do-not-track" list for Web surfers. That idea, proposed to the FTC Wednesday by nine privacy and consumer advocacy groups, would involve requiring all online advertisers that use "persistent tracking technologies" (such as cookies) to register domain names of all such servers with the federal agency, so that consumers could set their browsers to block them. (It's modeled after the do-not-call list, which allows consumers to register their phone numbers with the FTC in order to evade telemarketing calls.)

It's particularly troubling when online ads target children and teenagers, Leibowitz added. A 1998 federal law called the Children's Online Privacy Protection Act, requires sites targeting children under 13 to post their data-collection practices and obtain verifiable parental consent before gathering information about children or sharing it with a third party.

But with the rise of targeted advertising approaches, the "parental buffer between advertisers and our children" seems to be "eroding," Leibowitz said. Although he seemed to suggest legal updates may be necessary, he said it wasn't yet clear what specific steps the government should take.

Leibowitz acknowledged that Internet companies are already "making progress." The major U.S. search engines in particular are "literally tripping over each other," as he put it, to improve their privacy policies, minimize data retention and anonymize personal information.

Still, his comments included many of the same concerns detailed in a supplemental privacy complaint that two public-interest groups filed Thursday with the FTC. They called out the rise of social-networking sites and increasingly "invasive" marketing techniques as reason for a federal investigation and, potentially, new Internet privacy rules.

Privacy groups have already asked the FTC to investigate the potential privacy implications of Google's proposed buyout of online ad-tech company DoubleClick.

Leibowitz said he wasn't at liberty to give any details on that review process, except to say the staff "is working through this matter as expeditiously as possible given the complexity of the deal."

He added, however, that "our analysis of the merger has got to be about competition and potential competition. It can't be about privacy per se."