X

FTC wants voluntary 'Do Not Track' for the Web

Federal Trade Commission touts Do Not Track idea, but stops short of saying Congress must make it mandatory for Web sites and advertisers.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
3 min read

The Do Not Call list easily tops the list of the Federal Trade Commission's popular successes, with one official joking that that it became "the most popular government program since the Elvis stamp."

The FTC now hopes to build on that unusual success with a Do Not Track concept that would restrict certain types of Web marketing, a concept that the agency broadly endorsed in a 122-page report (PDF) released today.

"Most of us on the commission believe it's time for a Do Not Track mechanism," FTC Chairman Jon Leibowitz told reporters today, though he stopped short at calling for new legislation that would mandate it. Instead, he said, "what we're doing is offering best practices to companies."

The difficulty, though, is that the mechanisms that work well for circuit-switched telephones don't translate successfully to the packet-switched universe of the Internet.

Because each telephone number is unique and doesn't change frequently, a central government database is a useful way to centralize a list of people who have opted out. Internet Protocol addresses, on the other hand, may be shared and can change as frequently as every few days.

And a binary off-or-on approach may be too broad: some consumers might want to allow targeted advertising in some circumstances, but not others, especially if it means that they'll see ads that are relevant to their interests or prevent them from having to pay subscription fees.

At least right now, the FTC envisions any Do Not Track list as only providing an opt-out path for third-party behavioral advertising, meaning it wouldn't affect Web sites that build their own user profiles. It likely would have only a limited affect on sites like Google, which relies primarily on contextual searching-for-vacations-in-Paris ads rather than on assembling an interest-based profile and using that to tout cheap Paris vacations.

The FTC's recommendations, which are part of a broader report laying out a recommended framework for privacy, come as a House of Representatives committee is convening a hearing on whether or not to enact Do Not Track legislation. (Representatives of Time Warner Cable, the Consumer Federation of America, Symantec, and the Information Technology and Innovation Foundation are scheduled to testify.)

Given the scant time left before the Democratic-controlled chamber switches to GOP control, it's virtually impossible for any Do Not Track bill to be enacted this year. But if Republicans seem to like the idea as much as Democrats, tomorrow's hearing could give the concept of new legislation with a running start in 2011.

"The FTC's report makes it clear that self-regulation has largely failed," Sen. Jay Rockefeller (D-W.V.) said today.

That's not exactly what the FTC thinks. Leibowitz said today that "we're going to give these companies a little time, but we'd like to see them work a lot faster."

In addition, two of the agency's five commissioners offered sharp criticisms of the draft report, which will be revised over the next few months and then published in final form next year.

FTC Commissioner William Kovacic warned a Do Not Track system would "be premature," adding that such a mechanism might prompt some Web sites to abandon free content or more broadly disrupt online publishing. And Commissioner J. Thomas Rosch said he has "serious reservations" about the staff report's proposals in general.

What's still unclear are the details of how any Do Not Track mechanism would work. The most obvious approach is for people to configure their Web browsers through a cookie (or Flash cookie, or similar mechanism) to flag themselves as opting out from behavioral advertising. But that requires cooperation among browser makers and advertisers, and without a law enforcing compliance, Web sites could presumably ignore the please-don't-track requests.