On online privacy and avoiding overregulation

Editors' note: This is a guest column. See Berin Szoka's bio below.

Is there a better way forward on online privacy that straddles the divide between heavy-handed regulation and complete laissez-faire? Rep. Marsha Blackburn (R-Tenn.) has sketched out a potential "third way" to break the logjam.

Blackburn is kicking off a series of privacy roundtables to develop details of this approach, starting with one today in New York City. It's being hosted by the Interactive Advertising Bureau at their "Ad Lab" and brings together industry leaders to learn more about the state of technology and what, if anything, Washington can do to help.

In a speech in May (PDF), Blackburn recognized growing concerns about information collection and called for a "voluntary self-regulatory solution that will restore [consumer] trust." She aims to stir industry "to empower consumers before government empowers itself."

These roundtables are the result. Two more are planned later this summer--in Washington, D.C., and in the San Francisco Bay Area.

These discussions should rally those who fear that overly burdensome restrictions on online data flows will ultimately harm consumers--for example, reducing the advertising revenue that funds "free" content, preventing innovative uses of data such as predicting flu outbreaks based on search query patterns, and limiting the benefits of personalization in advertising as well as content delivery. The Federal Trade Commission and many members of Congress have paid lip service to these concerns but underestimate the true costs of regulation while overstating privacy problems.

Related links:
• Google+ steers clear of privacy missteps
• Republican politico's do-not-regulate Net manifesto
• Geo-privacy bills aim to curb warrantless tracking
• Remove embarrassing YouTube videos, untag Facebook photos

True to form, Blackburn warns about the dangers of "hyperregulation from a menu of agencies." To avoid regulatory duplication, she plans to introduce legislation to get the Federal Communications Commission out of the privacy business and give the FTC comprehensive authority over privacy.

But she also noted the more subtle danger that the "perspective that defines private information as property" would ultimately lead to a "strict opt-in approach to privacy where no information can be used or interpreted without explicit authorization." That caution might surprise some, given her defense (PDF) of copyrights and her obvious sympathies with the content creators in her Nashville district. But she's exactly right that the property approach can be taken too far when it comes to personal information. After all, who "owns" the shared experiences of social interactions and observations, whether offline or online?

Blackburn rightly fears what Google's Nicklas Lundblad and Betsy Masiello have dubbed "Opt-in Dystopias." As they explain, mandating restrictive defaults ultimately makes consumer choice empowerment less, not more, effective. That's because consumers quickly become desensitized to increasingly broad opt-in requests for data sharing. That helps big companies at the expense of small ones and could lock consumers into "walled gardens." It also means most consumers will miss out on the benefits of new services and forms of online culture they haven't yet tried.

Instead, Blackburn wants a "third way" on privacy that allows the "online world to continue to thrive." Through these roundtables, she's calling on industry to make user empowerment more effective by clarifying how companies collect and use data through industry standards. Those standards can and should work hand-in-hand with user empowerment tools. For example, the ad industry is already working with browser makers on how to implement do-not-track requests--without regulatory mandates.

Furthermore, industry should build on examples of how market forces have effectively "regulated" businesses offline--especially through ratings systems that reward good actors and shame bad ones. The Better Business Bureau, perhaps, which has been in the ratings and self-regulation business for a century, has taken the lead on enforcing compliance with the advertising industry's self-regulatory principles through its Online Interest-Based Advertising Accountability Program. Finally, skeptics of increased data regulation can agree on the need for greater FTC enforcement against bad actors.

If the goal is to avoid breaking the Internet, listening carefully to the people who've actually built the technology and business models that make the Internet work is good place to start. Such "bottom-up" solutions are also more likely to avoid getting tied up in protracted First Amendment battles, especially in light of the Supreme Court's recent decision striking down a Vermont opt-in law.

To succeed, a "third way" on privacy will certainly require spurring industry to greater transparency and better self-regulation. But we also need a conceptual framework capable of explaining when and how government can actually help, and when it "needs to get out of the way."

That framework must be based on a core belief in empowerment, consumer education, continually enhancing self-regulation, and actively enforcing existing laws against fraud and deception. If the privacy debate remains stuck on tightly restricting the use of data, the creativity and competitiveness of the U.S. tech sector will suffer--and we will all be worse off for it.