Consumer Advertising Law Blog

P2P Users - Upgrade Your Software Before Sharing Your Latest Vacation Pics!

For many of us who did not learn to use a computer keyboard and mouse before we could walk, terms like downloading files using BitTorrent or talking to friends on the Gnutella network sounds like having some dental procedure. But others in this generation, and certainly our kids, use those protocols and networks daily to chat and share pictures and videos with their friends though peer to peer or P2P file-sharing networks.

But the same feature of P2P software that underpins its functionality -- its ability to access and share files on your computer across the Internet -- also creates potential security vulnerabilities. The Federal Trade Commission investigated the reportedly largest provider of these P2P services - Limewire. The FTC alleged that older versions of the Limewire software contained security vulnerabilities that put users at risk of inadvertently sharing personal information, including social security numbers, bank account numbers and other matters, stored on their computers.

Limewire upgraded its software, incorporating safeguards into its user interface to help users avoid the inadvertent sharing of sensitive information. The company also said it would tell consumers to upgrade their Limewire software and inform consumers on how to best avoid inadvertent sharing, even though the company could not force users to upgrade (one version is free and the other is a one-time download for $39.99). In large part for those reasons, and the fact that the FTC found that users tended to upgrade voluntarily at a high rate (undoubtedly wanting the fastest service possible to share their latest creations), the FTC closed the investigation without action.

While no computer connected to the Internet is invulnerable, using the most recent version of P2P software may help reduce the vulnerability of your personal information to unintended disclosure.

- Ronald Lee and Beth DeSimone

FTC Testimony On Efforts To Protect Consumer Privacy

Last week, FTC Chairman Jon Leibowitz testified before the U.S. Senate Committee on Commerce, Science, and Transportation about the FTC’s efforts to protect consumer privacy. The testimony detailed the FTC’s consumer privacy program over the past few decades, focusing on data security enforcement, identity theft, children’s privacy, and protecting consumers from unwarranted intrusions such as spam and spyware.

Liebowitz highlighted the FTC’s recent attempts to re-examine consumer privacy protection in light of rapidly evolving new technologies. Over the past two decades, the Commission has used two main policy approaches towards protecting consumer privacy: (1) promoting the fair information practices of notice, choice, access and security; and (2) protecting consumers from specific and tangible privacy harms. The testimony briefly discussed the limitations of these traditional models of enforcement in adequately protecting privacy in light of rapid developments in technology. The testimony noted that these policy approaches may place too heavy a burden on consumers to read and understand complex privacy policies. Liebowitz also noted that the they may place too strong an emphasis on financial and other tangible harms from exposure of private information.

This past winter, the FTC held a series of roundtables to explore the privacy challenges posed by emerging technology (see here and here).  A number of concerns were raised during the roundtables, notably that most consumers do not understand the extent to which companies are collecting and using their personal information as well as the limitations of the FTC Fair Information Practices model which places a heavy burden on consumers to read and understand lengthy privacy policies.

Moving forward, the FTC indicated that it will be focused on the following areas:

1. integrating privacy into business practices;
2. simplifying consumer choices about commercial data practices; and
3. improving transparency.

The Commission has indicated that they will release a report on this initiative later this year.

The Commission’s testimony coincided with Rite Aid Corporation’s agreement to settle with the FTC over charges that it failed to protect sensitive financial and medical information of its customers and employees.

- Nancy Perkins and Tiana Russell

Insecurity is No Tweet

Many people use Twitter to share their deepest feelings to the cyberworld (in 140 characters or less) about topics ranging from their dismay about the current unemployment rate to the joy of Landon Donovan’s dramatic goal in the World Cup. But sometimes Twitter users just want to send private messages to their friends and colleagues and of course, no one wants their private information to be shared with the public or to be misrepresented through phony tweets in such a public forum. However, according to the FTC, Twitter users’ private information may have been at more risk than they were led to believe through Twitter’s privacy disclosures.

Last week, the FTC voted 5-0 to settle charges against Twitter that it deceived consumers by failing to provide the necessary safeguards to protect their personal information. The FTC alleged that “serious lapses” in data security allowed hackers to obtain unauthorized administrative control of Twitter, including access to non-public user information, tweets that consumers designated as private, and the ability to send phony tweets from any user. This was the first case of this kind brought by the FTC against a social networking service.

In its complaint, the FTC alleged that Twitter made several misleading statements on its webpage about the protection of their users’ private information and the ability to make private, direct Twitter messages and to create private Twitter accounts. For example, the Twitter webpage states that users can “send followers private tweets, called direct messages” and that “only author and recipient can view direct messages.” With regard to protected accounts, the webpage states that users “have the option of … protecting the account to keep [their] updates private” and “only approved followers are able to see [their] profile page.”

Vladeck Discusses Policy and Enforcement Issues on Consumer Privacy

On June 3, 2010, FTC BCP Director David Vladeck spoke at the Privacy Law Scholars Conference in Washington, DC. His remarks focused on the issue of privacy and technology. In the 1890’s, Vladeck noted, Louis Brandeis and Samuel Warren wrote about their concerns with the invasiveness of a new technology, the camera. Since that time, we have grappled with the impacts of more and more invasive technology on privacy. Vladeck discussed new technological information practices and the privacy risks they pose. The FTC, he noted, is trying to “address these risks [through policy development and enforcement.] without stifling the dramatic benefits of technological innovation.”

With respect to policy development, Vladeck offered several key messages from roundtables and public discussions: (1) given the volume of information maintained about consumers, it “no longer makes sense to talk about ‘personal information’ and ‘non-personal information’”; (2) because it is now more expensive to destroy than to keep data, data will likely “hang around long enough that it is re-examined and re-purposed for uses that may not have been contemplated at the point of collection”; (3) consumers are still getting up to speed about how information is handled and with whom it is shared; (4) privacy policies, while useful to promote business accountability, are not useful to consumers because they are not located where “consumers need them and they’re too complicated, too vague, and too long.” Vladeck discussed the effort led by a non-profit think tank, the Future of Privacy Forum, along with marketing company WPP, to develop an icon to notify consumers how to make choices about use of their information in behavioral targeting.

With respect to enforcement, Vladeck indicated that a number of non-public investigations are ongoing, including efforts by the FTC to investigate companies in order to determine whether actions are necessary in new technology areas, such as P2P file sharing software. Finally, he discussed the contribution of academic research. As an example, he discussed the assistance academics from the University of Texas made to an investigation FTC conducted of Netflix’s release of “anonymized” movie queue information. The professors made the FTC aware that it was possible to re-identify individuals using the data set. As a result, Netflix agreed to modify its practice.

In the same vein, an FTC representative spoke at a Calgary, Alberta event put on by Canada’s privacy commissioner. The representative’s remarks, reflected frustration with current U.S. privacy laws, including an indictment that they “[aren’t] working,” in particular because “’[w]e’ve put too much burden on the consumers to understand [privacy] policies.’” No one should be surprised to see more FTC enforcement and regulation efforts in this area.

- Nancy Perkins and Marianne El Sonbaty

Establishing the Legal Position of Geographic Location Applications

With the ever-increasing availability and utilization of smartphones and GPS technology, location has become a vehicle through which marketing and social information can be transmitted. "Geo-location" technology has been in existence since 1999 and is well known from applications ("apps") like Google Maps, which enable a user to search for physical places (i.e. hotels, restaurants, stores, tourist attractions) relative to a computer or phone's location. These apps are now becoming more advanced and creative which has led both Congress and the FTC to examine how businesses and the government (should) regulate location-based information.

Geo-location apps, such as Foursquare and Loopt, allow friends to share their location and post comments about places they frequent or visit. The more places one visits and shares with friends, the more points and "badges" that person receives which can be redeemed for discounts and rewards. For example, on May 22nd, Pepsi released "Pepsi Loot" for the iPhone and iPad. This location-based app directs users to restaurants serving Pepsi products, known as "Pop Spots." As visits to these establishments accumulate, a user can obtain rewards, such as free downloads of exclusive music or free Pepsi with an entree purchase.

From a legal standpoint, the use of location-based information produces privacy and data security concerns. The FTC, after holding a town hall on the mobile marketplace in 2008, issued recommendations ("Self Regulatory Principles for Online Behavioral Advertising") for companies seeking to advertise based on a consumer's online activity over time. The FTC recommended that industry self-regulation consist of a requirement of "affirmative express consent" for "material retroactive changes to privacy promises" and for use of "sensitive" data, which should include "precise geographic location information." Companies need to be certain any notice they provide for location-based apps is consistent with their privacy policy; otherwise, they may be subject to privacy violations for "deceptive" notice under Section 5 of the FTC Act.

Location-based apps may trigger a string of laws concerned with protecting personal information, such as:

• the Children's Online Privacy Protection Rule (for online services aimed at children under 13),
• HIPAA and the FTC Health Breach Rule (for covered entities under HIPAA or their "business associates"), 
• FACTA and the FTC Red Flag Rules (for financial institutions with data subject to identity theft),and
• Section 222 of the Federal Communications Act (for telecom providers with customer proprietary network information), and various state data security laws.

In Congress, meanwhile, Representative Rick Boucher (D-Va) and Representative Cliff Stearns (R-Fla) have sponsored an online consumer privacy protection bill, released May 4th, which would require that consumers opt-in before companies collect, use, or disclose "sensitive" data, such as "precise geographical location." More generally, Apple is looking to control third-party targeted advertising, as the most recent iPhone Developer Agreement mandates that third parties get Apple's permission before collecting user data, which would include location-based data, to advertise. The FTC, however, is reported to be investigating potential antitrust issues with this policy.

The bottom line is this: regulators seem to be in agreement that companies should obtain affirmative consent from online consumers before collecting, using, and disclosing their precise geographic location data. How mandatory any requirements might be, how extensive their reach, and where they might come from is still uncertain. Anyone involved in this growing market should watch to see if the legal parameters are clarified in the near future.

Leibowitz Addresses FTC Efforts to Protect Consumer Privacy

FTC Chairman Jon Leibowitz spoke earlier this month at the National Cable & Telecommunications Association’s Cable Show 2010. He also recently testified before the U.S. Senate Subcommittee on Financial Services and General Government of the Committee on Appropriations concerning the FTC’s FY 2011 budget request. Both his remarks and testimony reflected the FTC’s commitment to protecting consumer privacy while promoting competition. At the Cable Show, Leibowitz discussed behavioral advertising as it intersects with “consumer choice” and “consumer control” -- the choice consumers have to allow advertisers to chart their personal information, and the control they have to say how or where it is stored. In the cyberspace context, Leibowitz commented, “ ‘notice and consent’ rarely reflect[] a consumers’ conscious informed choice.” So what is being done to address this situation?

First, as Leibowitz discussed, a coalition including the Direct Marketing Association, the Interactive Advertising Bureau, and the Better Business Bureau have proposed behavioral advertising guidelines, encouraging companies to explain their information collection practices for advertising outside their privacy policies.

Second, Congress may end up regulating online data collection, as is reflected by Representative Boucher’s draft legislation, released earlier this month. And, last year the FTC issued a revised set of behavioral advertising self-regulatory principles, including the following: (1) websites need to give consumers the choice as to whether they want their personal information gathered for behavioral advertising, and, as Leibowitz warned, the disclosure should not be a “3-point font, ten-page document written by corporate lawyers and buried deep within the site;” (2) consumer data should be stored securely and only as long as necessary to fulfill a business need; (3) where a company changes its privacy policy, consumers should be informed and allowed to choose whether to continue allowing their data to be collected under the new terms; and (4) companies that use sensitive data in advertising should collect it only after receiving express affirmative consent.

Leibowitz’ testimony before the Senate Subcommittee concerning the FY 2011 budget also described the agency’s efforts and successes in protecting consumer privacy, including pursuing 29 actions against companies that failed to protect consumers’ personal information, obtaining $11 million as part of a settlement preventing false identity theft prevention claims, shutting down a rogue ISP that helped deliver child pornography among other illegal spam, and settling a lawsuit against Sears for not fully disclosing the scope of personal information collected. Efforts to protect consumer privacy are also being made in the areas of social networking, cloud computing, online behavioral advertising, and mobile marketing.

Outside the privacy area, Leibowitz also described the FTC’s continuing efforts to (1) protect financially-strapped consumers; (2) continue enforcement of the Do Not Call Registry; (3) protect children through litigation under the Children’s Privacy Protect Act; (4) promote competition by challenging anti-competitive health care mergers and stopping pay-for-delay drug patent settlements; and (5) protect competition in the technology, energy, and consumer goods services. The FTC requested $314 million to support 1,207 full time employees, up $22.3 million and 40 full time employees from last year.

- Amy Mudge and Marianne El Sonbaty

Long-Awaited Consumer Privacy Bill Announced by House Committee

Today, the House Energy and Commerce Committee released a bipartisan, draft proposal of new legislation to protect consumer privacy both on and off the Internet. The proposed legislation would require entities that collect “covered information” from at least 5,000 individuals in any 12-month period to give individual notice of the entity’s privacy policy and request consent before collecting, using, or disclosing their “covered information.” 

The bill defines “covered information” broadly to include personal data such as a consumer’s name, address, social security number, medical records, and financial information. However, the bill’s restrictions and requirements are principally focused on the use and disclosure of such information for advertising or marketing purposes, and generally would not apply to uses and disclosures of information collected for conducting a “transaction” or “operation” at the request of or under an agreement with the individual.

Before collecting any of the covered personal information other than for “transaction” or “operations” purposes, companies would generally be required under the bill to provide notice of the company’s privacy policy and the intended uses of the data. If the information is being collected over the internet, the notice must be posted conspicuously on the web site. Otherwise, the company must provide the consumer with a written copy of the notice. The notice must, among a number of requirements, describe who the company is that is collecting the information, how they will collect it, what it will be used for, how long the company will keep it, and under what circumstances the company will disclose it to others.

Although the bill requires the consumer’s consent before a company can collect, use, or disclose the consumer’s information, it generally assumes consent unless the consumer opts out. This means that if the individual consumer either affirmatively agrees to the use of their information or does not respond either way, then the company may use their information. Companies will only be prevented from using an individual consumer’s information if the consumer actively denies consent. This “opt out” consent does not apply in three situations. First, a company must get affirmative consent before collecting or disclosing sensitive information about the consumer. Sensitive information includes a consumer’s medical records, financial information, location, race, religion, or sexual orientation. Second, a company may not release any of the consumer’s data to another company without express consent. Third, and finally, a company cannot collect or disclose all or substantially all of a consumer’s online activity without express consent.

Under the proposed legislation, the Federal Trade Commission (FTC) would be responsible for enforcing the bill. The FTC would have the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. § 41 et seq.) were incorporated into the bill. The FTC would also be able to make rules as needed to carry out the bill. State attorneys general would also be able to enforce the bill through civil actions in federal court, subject to the intervention of the FTC. However, there would be no private right of action to enforce the bill.

- Nancy Perkins and Peter Roman

FTC Privacy Form Wins ClearMark Award

As reported on our blog, last Thursday, the Center for Plain Language held its first ever awards ceremony for the best and worst use of plain language in government and business. One of the two federal government winners of the Center’s ClearMark award, which goes to best uses of plain language, was the Federal Trade Commission’s Model Privacy Form, linked here.

This form shows how a financial company may clearly disclose its use of consumer personal financial information. It presumably is designed to comply with the consumer privacy rules of the Gramm-Leach-Bliley Act.

We note that the form does not use the model language issued by the banking agencies regulations issued pursuant to the GLB Act. Under the current regulations, use of the model language, if accurate, is deemed compliance with the regulation. Thus, most financial companies use the model language (which is why so many privacy statements look and sound similar).

However, if financial companies could obtain some kind of informal clearance to use forms such as the FTC’s - and presumably the agencies would be open to that - we might see companies adopt these more easily to understand privacy and other forms.

- Beth DeSimone

Hey, Who Put the Hard Drive in My Photocopier?

A recent CBS News investigative report revealed that most copiers made since 2002 contain a hard drive that stores up to 20,000 of the documents copied, faxed, or scanned on the copier. That likely came as a surprise to many folks, and particularly copy machine owners and lessees. As a result, subsequent owners or lessees of the copier may gain access to a company’s confidential intellectual property, business and legal strategy, or individuals’ confidential personal information. A CBS News team bought four machines from a used copier retailer and found confidential documents from the sex crimes unit of a city police force, including incident data and lists of sex offenders, and 300 pages of medical records and health care information from a New York insurance company. Compounding the issue, many copiers are now networked so that the hard drive on the copier may also contain internal information about a company’s network, and its security, making breaches easier.

In a world of data storage, networked desktop computers, laptops, and internet access, none of these issues are new to businesses, what is different about the storage of private information on photocopiers is that many businesses may not have known that it was happening. At least 60% of Americans did not know that copiers stored images of everything that they copied on their hard drives, according to a survey conducted by Sharp Imaging and cited in the same CBS report.

So, perhaps add copiers to the list of office equipment for which data protection steps need to be taken. Companies may need to review policies for access to copiers and wipe hard drives before copiers are removed from their offices. Copiers could also become yet another battleground in the area of electronic discovery. On the other hand, maybe copiers could be designed to delete the stored images as soon as they are used and encrypt the images until then. Clearly many users weren’t aware that copiers were storing this information on a long-term basis or using this feature. So, is it really necessary in most cases?

- Ronald Lee, Suzanne Wilson, and Peter Roman

New Internet Policy Task Force Seeks Comments on Information Privacy, Innovation, Internet, and Economy

The Department of Commerce has put together four terms important to our readers and to all consumers -- Information Privacy, Innovation, Internet, and Economy -- as the topic of a newly launched review of the nexus between privacy policy and innovation. Commerce’s newly-formed Internet Policy Task Force, announced coincident with the issuance of their Notice of Inquiry, is chartered with identifying and evaluating a wide range of public policy issues associated with the “U.S. private sector's ability to realize the potential for economic growth and job creation through the Internet,” and has already suggested it will address privacy, innovation, cyber security, online copyright protection, and barriers to international data exchanges supporting commerce. Commerce’s Internet Policy Task Force will consider comments before issuing a report as part of the Administration’s domestic policy and international engagement in Internet privacy.

Commerce’s Notice of Inquiry suggests some areas in which commentators may wish to weigh in, including whether the US privacy law regime should be modified better to support innovation, fundamental privacy principles, and evolving consumer expectations; the impact of the laws of the 50 states on companies’ compliance costs and product development costs; difficulties in complying with the multiplicity of privacy laws across borders; alternatives to sector-specific privacy laws and regulations; and the role and promise of privacy-enhancing technologies.

While these topics are highly thematic, general, and timeless, the Notice of Inquiry (“NOI”) specifically requests comment on how data privacy laws of different countries cause difficulties for organizations using cloud computing models in which they collect, store, access and process data in various locations around the world. And, as mentioned in the NOI, these issues are also being addressed in other venues, most notably through a series of online privacy roundtables just held by the FTC. While some details may still be developing about the work of Commerce’s task force, and what may emerge from this NOI, the organizations under the Department of Commerce that are leading this task force (NTIA, NIST, ITA and the PTO), suggest that technical standards and initiatives to support businesses’ use of technology and data will receive much attention.

While individuals and organizations will have other opportunities to comment on these issues in the future, providing practical experience-based perspectives and suggestions now might focus deliberations and trigger action down the road.

Comments are due 45 days after publication of the notice in the Federal Register. Commerce’s Notice of Inquiry here.

- Ronald Lee and Tiana Russell

Common Sense Privacy Legislation Passed Last Week

In the midst of the high stakes political rhetoric swirling around the US Senate last week concerning financial reform legislation, the US House of Representatives quietly passed some common sense legislation in the area of privacy disclosure. The legislation, aptly called the “Eliminate Privacy Notice Confusion Act,” (H.R. 3506) would allow financial institutions that do not disclose nonpublic personal customer information to third parties (other than to service or market the institution’s own accounts and certain other exceptions) and have not changed their privacy policies during the previous calendar year to not have to send an annual privacy disclosure notice to their entire customer base.

Currently, all financial institutions must send a copy of their privacy policy to their entire consumer customer base on an annual basis (whether or not the policy has changed during the previous year), or give a customer an opportunity to opt out prior to disclosing nonpublic personal information to a third party. Press reports indicate that many customers are confused by the annual requirement, as it looks like their financial institution has changed their policy when it has not. It also is costly for institutions to send the notices. This burden seems unnecessary if the privacy policy has not changed.

The legislation would allow those institutions that (i) do not provide nonpublic person information to third parties in a manner that would require an “opt-out” notice to a customer and (ii) have not changed their privacy policy in the last year to not have to send those annual notices.

The legislation does not affect the requirement that an institution provides its privacy notice when a customer opens an account, nor does it affect those institutions that are required to send out notices to customers.

This is common sense reform. The legislation has not been referred to the Senate. Hopefully, in the midst of the Senate’s financial reform debate, the Senate will be able to slip this provision into the bill it is considering. Otherwise, it may be some time before this small, but good, change is made.

- Beth DeSimone

Social Networking Site Gets Tagged . . . Again

Earlier this week, the San Francisco District Attorney announced that the city had reached a $650,000 settlement with Tagged.com over allegations of unfair business practices. We previously blogged here about the settlements totaling $750,000 that Tagged reached in November 2009 with the states of New York and Texas over similar allegations.

The San Francisco settlement is especially noteworthy because it marks an expansion of the company’s legal obligations pursuant to the injunctions entered in New York and Texas. Under the San Francisco settlement, in addition to providing clear and conspicuous disclosures prior to accessing a customer’s email contacts, Tagged must also implement new procedures allowing customers to read and approve any message sent under that customer’s name to the people in the customer’s email contacts list.

As we previously noted, social networking sites and web-based member communities must remain abreast of the data security and privacy laws of the jurisdictions (local, state, and national) in which they and their members reside (Tagged.com is based in San Francisco). Failure to do so could lead to similar consequences, including interruptions in regular business operations and multiple sources of potential liability.

- Taja-Nia Y. Henderson

Identity Theft Company's "Locks" Easily Jimmied, Forces $12 Million FTC Settlement

A company that provides identity theft prevention services, has settled charges brought by the FTC that it falsely advertised both the extent of the identity theft protection it offers as well as the extent of its own data security measures to protect customers’ personal information. LifeLock, which gained some notoriety due to advertisements that prominently displayed the CEO’s social security number, has agreed to a $12 million settlement--$11 million to be paid to the FTC and $1 million to be paid to a group of 35 state attorneys general.

First, the FTC had alleged that the company misled consumers by guaranteeing absolute protection against identify theft when, “in truth, the protection it actually provided left enough holes that you could drive a truck through it” according to FTC Chairman Jon Leibowitz. While LifeLock may provide valuable protection against identify theft, the charges were brought because the company allegedly overpromised the amount of protection it could actually provide. The FTC and state attorneys general took issue with certain advertising claims including the following:

• “By now you’ve heard about individuals whose identities have been stolen by identity thieves . . . LifeLock protects against this ever happening to you. Guaranteed.”
• “Please know that we are the first company to prevent identity theft from occurring.”
• “Do you ever worry about identity theft? If so, it’s time you got to know LifeLock. We work to stop identity theft before it happens.”

The FTC claimed such statements are false because the services are limited to only certain forms of identity theft and the protection for the covered forms is itself limited, as is inevitable because there is “no foolproof way to avoid ID theft,” according to Illinois Attorney General Lisa Madigan. In addition to the financial penalty, LifeLock is barred from continuing to make deceptive claims.

Lifelock has also been sued in federal court on similar claims.

Second, the FTC also claimed that the company made false claims regarding its own data security. As part of its program, consumers must entrust extremely sensitive information to LifeLock such as social security and credit card numbers but are assured that the information is protected through a myriad of security measures. The FTC claimed that LifeLock did not follow these internal security measures and the data was vulnerable. As part of the settlement, the company is also barred from misrepresenting its data security measures and is required to establish a stricter and more comprehensive data security program that will have to be assessed by a third party every two years.

Companies should beware of marketing campaigns that overstate what the company can actually deliver. In addition, prudent companies will ensure that any statements they make regarding protecting customer data, including in website or other privacy policies, are in line with the companies’ actual privacy and security protection measures.

The FTC will use the $11 million to provide refunds to former and current Lifelock customers.

- Candida Harty and Nancy Perkins

The Power of I: Advertisers Attempt to Demystify Online Advertising for Consumers

Those of you who shop online, use web-based mail, or spend any amount time perusing websites online (and that covers, well, almost everyone), may have come across an advertisement that left you wondering, “How did I get this ad?” Soon, thanks to a blue symbol with a little white “i”, your question will be answered with the click of a link.

Heeding calls for more self-regulation and concerns of privacy advocates, the Federal Trade Commission, and Congress, the advertising industry has come up with a standardized icon -- referred to as the "Power I" -- that will let consumers know how advertisers use web surfing history, demographic profiles, and other personal data to display ads tailored to the interests of the specific online user. Once a consumer clicks on the Power I, they will be taken to a page detailing why certain ads are being shown to them. Although there is no legal requirement that companies that use online advertising adopt the Power I, industry groups hope that it catches on so that it can be used in the argument against the need for further prescriptive government regulation. An online campaign initially aimed at explaining the system behind web advertisements to consumers has already been launched. The second stage of the online campaign will focus on the "Power I" specifically.

The FTC undoubtedly will keep a close eye on the effectiveness of the Power I, and it is likely companies will have to do more in the way of making online advertising practices more transparent to consumers. For the Power I to be “powerful,” though, most, if not all, advertisers will have to adopt it, and consumers will have to learn to interact with the Power I in a meaningful way. If it works, however, the Power I may be seen as a key step toward better information for consumers about their online privacy and making the process behind behavioral advertising more visible. Nevertheless, this step alone is unlikely to stave off legislation or industry wide regulation, and advertisers will probably have to focus on other key behavioral advertising issues, such as consent, re-use of data, and data retention.

- Danielle Sims, Nancy Perkins, and Sean Morris

Vladeck Calls for "Baked In", Not "Half-Baked" Protections for Consumer Data

The FTC gathered in the west yesterday, holding the second in its series of Internet "Privacy Roundtables" at Berkeley Law School. Like the first round table last month in Washington (previously reported on here), the event yesterday brought together representatives from business, consumer advocacy groups, and government to wrestle with the privacy issues faced in this age when just about every visit to a website, update of a social media profile, or use of an iPhone app results in the collection of consumer data. And also like last month, the panels sometimes became "politely heated" as the participants expressed differing views regarding how to address the issues.

The day began with Commissioner Pamela Harbour stating that, what with all the privacy concerns consumers face, "good" businesses have an opportunity to compete for market share on the privacy point, a sentiment repeated in later panels. Nevertheless, she also noted her view that market forces are not sufficient to protect consumers, because (among other reasons) it is "difficult for consumers to define their expectations" for privacy. BCP Director David Vladeck followed, picking up on the theme of continued concern that many consumers do not understand the privacy issues they face, and that privacy protections for new technology should thus be "baked in at the beginning, rather than half-baked" add ons later.

The panels then addressed issues ranging from the particular issues raised by social networking sites, what happens to consumer data in the "cloud," and how mobile devices bring their own unique issues.

As readers of this blog know, it seems pretty clear that the FTC is looking to move away from a self-regulatory "notice and consent" model for dealing with privacy and toward a prescriptive world. Comments at this Berkeley roundtable were consistent with that, but obviously no solutions were reached. Now it's on to the third and last in the round table series, this time back in DC.

If you are interested in watching the webcast of the Berkeley Roundtable, it is available here.

- Sean Morris

FTC Round Table Tango: Agency and Congress Dance Steps Hint At Where Online Privacy Legislation Is Going

The FTC announced today the agenda for its second privacy roundtable discussion, scheduled for January 28, in Berkeley, California “to explore the privacy challenges posed by the vast array of 21st century technology and business practices that collect and use consumer data.” This second recent foray into online privacy follows the first roundtable, held December 7, 2009, in Washington DC. Although the focus of these roundtables is wider than using consumers' information to support Behavioral Advertising (BA), a bit of background on that practice and the history behind these discussions, provide perspective on some of the issues involved.

A Brief History

As long-time readers know, the FTC has been engaged in a dance with industry for years over using consumers' personal information to support different business activities, including BA (the “tracking of a consumer’s activities online - including the searches the consumer has conducted, the web pages visited, and the content viewed - in order to deliver advertising targeted to the individual consumer’s interest”). When the music first started the FTC and industry seemed to be doing a waltz, moving together in both apposition and concordance, and the FTC in 2007 seemed happy to let industry take a self-regulatory spin. With the changing of administrations, the waltz gave way to alternating turns of break-dancing. First industry, then the FTC, sought to anticipate the other and vied for the crowd's attention. The Network Advertising Initiative (NAI), jumped on stage early, modifying its existing online self-regulatory code of conduct in December, 2008, anticipating the FTC’s release of “final” self-regulatory principles by two months. The FTC issued those principles in February, 2009, with staff in the accompanying report. Congress, watching from the sidelines, grumbled it wasn't overly fond of the music, and began to mutter about changing the tune completely. The Interactive Advertising Bureau (IAB), until then mostly silent, broke onto the floor in July, suggesting Congress stay on the sidelines because the dance floor was full and the dancers already doing quite fine on their own. The FTC then sidled closer to where Congress was standing, and said that it too was thinking it might be time to change the music once and for all. Since then, the dance has slowed to a crawl as everyone has waited to see what music Congress decides to put on and occasionally suggesting the current tune was still snappy and shouldn't be changed just yet.

FACTA Court Opinion: E-Mail Receipt Is Not “Electronically Printed”

It is apparent, especially during the holiday season, that Internet commerce has become an evolving substitute for traditional in-store shopping. In the area of federal identity theft protections, however, purchases over the Internet are not comparable to in-store transactions.

Under the Fair and Accurate Credit Transactions Act (“FACTA”), a person that accepts credit or debit card payments is prohibited from printing more than the last five digits of the card number or the expiration date on any receipt provided at the point of sale or transaction. The U.S. District Court for the Northern District of Illinois, however, recently determined that these FACTA prohibitions do not apply to email order confirmations related to Internet purchases. (Shlahtichman v. 1-800 CONTACTS (N.D. Ill. 2009) 

In Shlahtichman v. 1-800 CONTACTS, Inc., the plaintiff purchased contact lenses from the defendant through an Internet transaction with his credit card. The defendant sent the plaintiff a receipt through e-mail which contained the plaintiff’s credit card expiration date. The district court dismissed the plaintiff’s claim that the defendant’s actions were in violation of FACTA for two reasons: 1) an e-mail receipt is not an “electronically printed” receipt under FACTA; and 2) an e-mail receipt is not provided at a transaction’s point of sale.

(1) An e-mail receipt is not an electronically printed receipt under FACTA

The relevant FACTA prohibitions are limited to “receipts that are electronically printed.” The court examined the plain meaning of FACTA, as well prior case law analyzing FACTA’s language, and concluded, consistent with the majority of court opinions to date, that e-mail receipts are not “electronically printed” receipts. The judge noted that the word “print” means to transfer information onto paper and not to display on a computer screen. To emphasize the point that print could only refer to a tangible paper receipt, the judge quoted a prior case (Grabein v. Jupiterimages (S.D. Fla. 2008), noting that the definition of “print” only refers to a tangible, paper receipt. That is why a person “has to print a copy of his receipt to get it off of his computer; it is why the machine used to transfer text from a computer to paper is called a printer.” 

The Shlahtichman court also looked at Congress’ intent underlying the FACTA, noting that the statute was only meant to prevent low levels of identity theft, such as using information on a receipt obtained from the trash. If FACTA were aimed at protecting email privacy, the court opined, Congress would have explicitly referenced e-mail, as it has done in other statutes.

(2) An e-mail receipt is not provided at a transaction’s point of sale

FACTA also requires that the receipt covered by the statute be provided “at the point of the sale or transaction.” According to the Shlahtichman court, Internet commerce has no tangible point of sale or transaction, and thus FACTA cannot apply to an e-mail receipt resulting from an Internet purchase. E-mail receipts are directed to an account that could be accessed anywhere in the world, and not specifically to the place or computer where the consumer made the purchase. The court concluded that the a point of sale or transaction could only exist in the context of printed paper receipts.

As the Internet continues to drive retail shopping to the virtual realm, with search engines, one-click transactions, and cyber promotions, FACTA’s identity theft protections may become more and more limited. Shoppers eschewing the crowds at the mall should be aware that if they leave their e-mail on view to others, they may not have recourse to relief under FACTA in the event their receipts show too much of their personal data.

- Beth DeSimone, Nancy Perkins, and Brian Larkin

The FTC Tackles Online Privacy - Vladeck Speaks

In sessions filled with healthy doses of Louis Brandeis references, the FTC hosted on December 7 the first of its day-long roundtable discussions designed to explore online privacy issues. FTC Chairman Jon Leibowitz kicked off the day by referring to this as a watershed time for online privacy policy. Panelists representing industry, consumer groups, technology, and government then debated the benefits and risks of collection and use of consumer data over the Internet.

The final session addressed whether additional regulation is needed, which unsurprisingly drew a sharp split of opinion. This, of course, comes as we await anticipated draft privacy legislation being overseen by Congressman Rick Boucher, D-Va.

In summing up the day, David Vladeck, the FTC Director for the Bureau of Consumer Protection, noted that the last panel in particular “exemplified just how difficult the questions we have to confront are,” and offered these additional overarching conclusions and “questions [that] face us in the future”:

• The panelists “pointed out that the benefits [of online information tracking] include[e] free content, better search results and more relevant advertising,” but also “mentioned real risk including the disclosure of information consumers believe is private,” and the "chilling effect” for those who might “modify their online behavior for fear of being tracked.” “These are real risks as well and we need to confront them.”
• Panelists also questioned whether “the traditional distinction that has been drawn in privacy law between personal identifiable information and anonymous information may be a thing of the past.” “These observations raise questions about how to build in transparency, consumer control and accountability into the process without sacrificing the benefit.”
• Researchers seem to “confirm our intuition that consumers do not really understand the data collection process.”
• “Many consumers believe that if a company has a privacy policy it means the company does not share data with third parties,” which is not necessarily correct. “There is also general agreement that consumer disclosure as we know it simply does not work.” But, “just because it's broken, doesn't mean we should scrap it or discharge it. Transparency is challenging but we need to think more creatively and innovatively about how to deliver important information for consumers when they need it and in clear and in simple terms.”
• “The economists also pointed out the limits of disclosure. They noted that consumers engage in bounded rationality when they tend to discount long-term negative effects [] of giving up their privacy. I also have questions about timing, is the type of collection adequate or should we think about notice at the time of use?”
• The industry has implemented “a number of initiatives, including efforts to improve consumer notice about these ads and to provide more effective choice to consumers,” but there are “concerns, particularly about how some in the industry frustrate consumer choice by using technologies other than cookies to gather information online and by collecting and using sensitive data for behavioral advertising. “
• “The broker industry is largely unknown and invisible to the consumers and there's a lot of diversity in the types of information, uses of information and even the rules that apply to how such information” is managed. “This is an issue that may warrant our attention.”

There is a second roundtable discussion scheduled for January 28 in Berkeley, California.

- Sean Morris

One if By Land, Two if By Electronic Storage or Transmission

Following in the finest traditions of legislative “punting”, Massachusetts' General Court (the less than obvious name for the state legislature), passed data security legislation in 2007 and charged the Massachusetts Office of Consumer Affairs and Business Regulation (“OCABR”) to “adopt regulations relative to any person that owns or licenses personal information about a resident of the commonwealth.” Two years, multiple drafts, and several public hearings later, OCABR recently released what it’s calling final data security regulations, which will take effect this coming March. Despite all the angst about a revolution in regulation from both businesses and privacy advocates over the past two years, the final regulations borrow concepts liberally from the FTC, some states’ data security or breach notification laws, and unsurprisingly, federal requirements for information systems security. The regulations mandate both general approaches and specific security practices.

So, what’s in the final regulations, in two sentences? Individuals or businesses, who own, license, store or maintain, personal information about Massachusetts’ residents, have to develop and follow written and comprehensive risk-based information security programs. These programs create a process, carried out by identified people, to evaluate the sensitivity of information and mandate appropriate protections. If this approach sounds familiar, it should be. Ask any IT security professional what the Federal Information Security Management Act (FISMA) requires of federal agencies, and compare the duties imposed by section 17.03 of the regulations to the National Institute of Standards and Technology ("NIST") risk-management framework for designing and implementing information systems security, and you should get the same picture -- implement a process rather than specific technologies, and recognize parties, protections, and the sensitivity of data all vary widely. It is no surprise that OCABR shifted to a risk-based, rather than the one-size-shoe-fits-all approach reflected in earlier drafts of the Massachusetts regulation, following a series of comments from businesses and other interested parties.

What is new, and potentially problematic for some, is that the regulations additionally require specific protections for personal information stored or transmitted electronically. Although many of the section 17.04 protections are fairly standard (for example, secure access controls and user authentication procedures), some go further, such as the requirement to encrypt personal information transmitted across public or wireless networks, or stored on laptops and other portable devices. In this, Massachusetts goes beyond other states which have passed laws requiring encryption of social security numbers before transmission over the Internet, and more recently encryption of any personal information before transmission outside a business’s own secure system. Any laptop or portable device containing personal information about Massachusetts residents will have to be encrypted, not just protected by a password.

The good news? Encryption and other specific computer security measures are only required “to the extent technically feasible” by the regulations. The bad? The regulations don’t define what “technically feasible” means. OCABR suggests in a FAQ something is technically feasible “if there is a reasonable means through technology to accomplish a required result.” The next question -- if something is technically possible but economically prohibitive under the circumstances is it a “reasonable means through technology” -- is somewhat of an open question. Although OCABR staff that drafted the regulation willingly admit they borrowed liberally from FTC concepts of reasonable security which look at many surrounding circumstances including the size of a company, the sensitivity of information involved, and possibly the cost of a particular practice, OCABR’s FAQ intimates economic considerations don’t factor into whether a practice is technically feasible. While it is probable that businesses may seek additional clarification, at least on this point, any person who has not already come into compliance now has one more chance to meet the compliance deadline. Again.

- Ronald Lee

Social Networking Site Gets Tag-Teamed by NY and TX AGs

Yesterday, the Attorneys General for the states of New York and Texas announced that settlements had been reached with social networking site Tagged.com over claims that Tagged misappropriated the identities and email address books of its members and sent millions of deceptive and unsolicited emails promoting use of its site. In New York, the company has agreed to pay $500,000 in penalties and costs and to adopt “industry-leading measures” to govern the use of its members’ personal information; in Texas, the company will pay $250,000 in penalties and costs and will implement new data privacy and security features.

With more than 80 million members worldwide, Tagged bills itself as the third-largest internet-based social networking site in the U.S., after Facebook and MySpace. Previously, Tagged requested that members provide the company access to their email address books during the enrollment process (through a process termed “import your friends”). Those contacts were then sent auto-messages purporting to be from the new member. Under its agreements with New York and Texas, Tagged will need to seek specific consent before accessing its members’ address books and will need to disclose specifically how that data will be used (including by whom and for how long). The Texas judgment also requires Tagged to designate a “corporate level compliance representative” to oversee its compliance with the terms of the agreed-upon judgment and that state’s data and privacy protection laws, as well as to respond to consumer complaints or inquiries regarding Tagged’s privacy guidelines.

While social networking sites and other web-based member communities face intense competition to reach and enroll new members, these companies must be careful to ensure that their recruiting efforts do not run afoul of the data security and privacy laws of the jurisdictions in which their members live.

- Taja-Nia Henderson and Amy Mudge