FTC stops short of calling for new 'Do Not Track' law

The Federal Trade Commission this morning released a wide-ranging report that stops short of endorsing a new "Do Not Track" law.

This morning's 120-page report instead asks Congress to enact a new law that "would provide consumers with access to information about them held by a data broker" such as Lexis Nexis, US Search, or Reed Elsevier subsidiary Choicepoint -- many of which have been the subject of FTC enforcement actions in the last few years.

But when it comes to a Do Not Track law targeting Web companies, which was proposed by legislation introduced last year, the FTC is more cautious, saying that "industry has made significant progress."

An industry-led effort called the Digital Advertising Alliance has racked up a series of "notable" accomplishments, the FTC says, including obtaining commitments from 90 percent of participants to follow self-regulatory principles and serving 900 billion ad impressions every month. The DAA also has committed to honor the tracking choices consumers make through their browser settings.

Berin Szoka, president of the free-market think tank TechFreedom, said that a strict Do Not Track rule could harm online advertising -- which pays for the costs of innumerable free Web sites -- and even sweep in services including Facebook's Like and Google's Plus buttons.

"The FTC has wisely decided to steer clear of trying to design a Do Not Track mechanism by itself," Szoka said. "I see this as the FTC deferring to the nerds, and wisely so."

While Congress could ignore the FTC's advice and enact a broader Web privacy law, which some left-leaning advocacy groups have been agitating for, legislators tend to be more reluctant to interfere when regulators urge caution and technology is rapidly evolving. The Electronic Privacy Information Center, for instance, responded by saying that it's "not happy" because the FTC's report "does not go far enough."

The FTC's Do Not Track recommendations largely parallel its December 2010 preliminary conclusions, which also stopped short of calling for mandatory federal legislation. In a lengthy preface to today's report, the agency outlined the areas where its thinking has shifted in the last 15 months, including formally endorsing data broker legislation and suggesting that Congress should "consider enacting baseline privacy legislation that is technologically neutral and sufficiently flexible to allow companies to continue to innovate."

The ACLU applauded the FTC's focus on data brokers.

Christopher Calabrese, ACLU legislative counsel, called it a "crucial" point. "These brokers' business model is built on the violation of consumer privacy," he said. "Not only are they are the backbone of a flawed background check industry, these data brokers also provide much of the information that is shared with behavioral targeters and the government."

The FTC also calls on data brokers -- a term that is not clearly defined -- to "explore creating a centralized Web site" where they could disclose what information is collected, how it is used, and what methods consumers can use to review it.

In a six-page dissenting statement, FTC Commissioner J. Thomas Rosch suggests that his colleagues are overly enthusiastic about regulation, especially when starting with the premise that behavior tracking is by definition somehow "unfair" and therefore within the purview of the agency's lawyers. (He also noted that not everyone agrees what Do Not Track means, with some people thinking it means not serving targeted ads, and others claiming it means not collecting any consumer data at all -- a Do Not Collect approach, in other words.)

"If implemented as written, many of the report's recommendations would instead apply to almost all firms and to most information collection practices," Rosch said. "It would install 'Big Brother' as the watchdog over these practices not only in the online world but in the offline world. That is not only paternalistic, but it goes well beyond what the Commission said in the early 1980s that it would do, and well beyond what Congress has permitted the Commission to do."

Rosch has recommended a different approach in the past as well. In August 2011, he said that the best way to create a do-not-track mechanism for the Web would be for the FTC to require all advertising networks to disclose what they do, and then figure out what steps are necessary to take.

Jim Harper, a lawyer at the libertarian Cato Institute, is skeptical of new Internet privacy regulations that govern corporate use and collection of data.

In a blog post this morning, Harper said: "The folks who want regulation of the Internet in the name of privacy should explain how they will do better than Congress did with credit reporting. In forty years of regulating credit bureaus, Congress has not come up with a system that satisfies consumer advocates' demands."