NetChoice filed comments today with the FCC, which were in response to the agency’s request for comments on online privacy issues. The FCC asked for comments on the use of personal information, identity management services and privacy protections across broadband applications. The questions raised in the request were drafted entirely by the Center for Democracy and Technology, and are an attempt to inject the privacy debate into discussion of the National Broadband Plan.

Our comments took a nuanced approached—we focused our response on the appropriateness of this inquiry as it relates to Internet privacy issues. While we assert that the FCC doesn’t have the legal authority if it were to act, we focus the bulk of our comments on how the FTC has already  established jurisdiction and occupies the online privacy issue area. We also highlight how the FCC’s ability to regulate broadband pipes as infrastructure does not convey jurisdiction to regulate that which flows over the pipes as information. Importantly, privacy is not a broadband issue:  the privacy policies of the ends (consumers and online services) are not defined by the middle (the speed of the communications pipe).

In short, our comments state:

• NetChoice members care about the privacy of our customers
• The exchange of data between and among users and online services create valuable opportunities for socially beneficial business models
• The FTC has already established jurisdiction, including in the areas of reviewing behavioral advertising practices, COPPA and adherence to privacy policies
• NetChoice will continue to engage on privacy matters at the state and federal level. Privacy is an important issue not because it is specific to broadband; rather, because privacy is a consumer-driven expectation that must be met regardless of transmission technology.

-Braden Cox

I spoke about the merger. As I've discussed in a previous blog post, the merger of the largest ticket issuer with the largest promoter raises red flags. Big isn't necessarily bad, particularly in well-functioning competitive markets. However, the tickets market is unique in that you have a secondary marketplace (mostly Internet-based) that has existed and thrived due to inefficiencies in the primary market--and new paperless ticket technology threatens to kill-off secondary market competition.

There are three major issues in play for 2010, including:

• Transparency:  Information is the key to well-functioning markets. Without adequate data on the number of tickets available for sale to the general public on first sale, prices can be artificially inflated (or depressed). There is a growing need for promoters and venues to be more transparent about how tickets are sold and the number of seats that are made available for purchase and are retained for distribution through alternative channels.
• Transferability:  There were about 3 million paperless tickets sold in 2009, which sounds like a lot but it's only about 1% of all tickets sold. Still, it's a growing trend for primary ticket sellers to use a "paperless" format that they claim offers increased consumer convenience. But it's really about control -- control to restrict further resale. Miley Cyrus did not allow transfer of tickets once they were purchased. You couldn't even give them away to friends or family!
• Interoperability: So that consumers can transfer tickets, computer systems will need to interoperate and talk to each other. I'm not sure the best technological route for this, but a policy that allows (or in the case of the merger, would be a conditional requirement) for interoperability is key to a well-functioning tickets marketplace.

It will be a busy and important year for event tickets!

-Braden Cox

This is the kind of educational initiatives that we like to see, and which is an important part of the NetChoice online safety model legislation.

Historically, the approach of the FTC toward privacy has been one of notice and consent and to hold companies to the word of their privacy policies -- if companies say one thing and then do another, the FTC goes after them for being deceptive. This is the "deceptive" part of the FTC's power to enforce the law against unfair or deceptive commercial practices.

For privacy, we really haven't seen the "unfair" part being enforced. But if public comments from high-ranking officials is any indicator (and it is), that's about to change.

A recent New York Times article summarizes its interview with FTC Chairman Jon Leibowitz and David Vladeck, chief of the FTC’s Bureau of Consumer Protection. It's another insight into how aggressive the commission wants to be toward privacy.

Advise-and-consent “depended on the fiction that people were meaningfully giving consent,” Mr. Vladeck said. “The literature is clear” that few people read privacy policies, he said.

But even if people did read privacy policies, Vladeck still doesn't think it is fair that people give consent to data practices, often in exchange for free services:

There is also a problem with companies conflating consent, Mr. Vladeck said. For example, if a Web site asks people to agree to a transaction and to let their data be sold in one form. “I don’t necessarily think that’s fair,” Mr. Vladeck said.

The FTC wants to make things less "unfair" by flipping upside-down the way that most users consent to information collection and use:

“Philosophically, we wonder if we’re moving to a post-disclosure era and what that would look like,” Mr. Vladeck said. “What’s the substitute for it?”

He said the commission was still looking into the issue, but it hoped to have an answer by June or July, when it plans to publish a report on the subject. Mr. Leibowitz gave a hint as to what might be included: “I have a sense, and it’s still amorphous, that we might head toward opt-in,” Mr. Leibowitz said. [emphasis added]

Requiring opt-in is a radical departure from the FTC's prior focus, which has been directed at the consequences of the use and misuse of consumer information. And it will lead to a radical reversal of the participation rates of users in sharing data for targeted advertising.

Behavioral economists teach us that defaults matter. An overwhelming majority of people do not affirmatively select a different option if there's a default presented to us.

A default of opt-in means that consumers will likely not share their information. While this may in fact be the goal of the FTC, the effect will be the transformation of free services to fee services online. And requiring opt-in does nothing to incentivize data brokers and other companies that share data to engage in good practices.

-Braden Cox

Facebook's users are quick and vocal about Facebook's privacy practices. And Facebook has been quick to respond. The Facebook blog on privacy highlights all its recent undertakings to respond to privacy concerns, including the Facebook Site Governance page, the Statement of Rights and Responsibilities, an open letter and other blog posts from Facebook founder Mark Zuckerberg. There's even Facebook Principles that highlight the site's mission. How many other companies have been so transparent and responsive? 

Indeed, you could say that Facebook has been the gold standard of responding to consumers. In this most recent change to privacy settings, users were prompted to revisit their privacy settings. Facebook made some recommended changes based on where it sees its service going. Users (like me) could change these if they wanted.

And change is what the Internet and new web services are all about. Forcing Facebook or any other online site to perpetually maintain original settings prevents new and innovative business models and services (just ask Microsoft about how backward compatibility makes Windows innovation so difficult). Web 2.0 services like Facebook have to experiment with the ways that users publish and share information. If these sites go too far, their customers will leave--which is the best check on privacy compared to any law or regulation.

So that's why I'm disappointed why these privacy groups are complaining to the FTC. There's a high bar of specificity for FTC action, so it would have been far better to petition the Facebook community and let them unleash whatever fury they have. But my hunch is that these complaining groups don't think that the FTC will actually do anything here. After all, making a federal case of actions by high visibility companies makes for a good publicity opportunity even if there's no sound legal case.

Unfortunately--now that it's a federal case--customer relations is now confused with consumer protection.

That almost anything can be bought and resold is a benefit to consumers, particularly in tough economic times. But under Ticketmaster's paperless tickets policy, instead of getting a paper ticket (or an email that you print up at home) you have to present 1) the credit card used to purchase the tickets, and 2) a government-issued photo identification for admittance. Paperless tickets have been used throughout the recent Miley Cyrus tour this year. She performed at the Verizon Center last month in Washington, DC and a local news story reported on the hardship it created for many fans:

A photo ID is also required, meaning Talia Levin couldn't just take her mom's credit card to the concert. Her mom had to swipe her through. "If you are older, then you can go by yourself, so it's hard to have to go with your parents," stated Talia Levin. "I refuse to buy into any artist who does this ever again," said Talia's mom, Melanie Levin. "I won't do it."

Thanks to this new "innovation" we now have consumer frustration. What if I wanted to go online to buy concert tickets for my parents as a Christmas Gift? Would I have to go down to the arena to get them in--down in Atlanta??  What's up with that? It’s an online transaction so I should be able to go online and determine who’s got permission to pick up these tickets. 

But even if Ticketmaster figures out the logistical headaches, there's still a serious problem:  consumers can't resell their tickets! An editorial in the LA Times does a good job of describing who really benefits from paperless tickets--two points if you guessed "Ticketmaster." They control the primary market, and now the company wants to control the secondary market too.

This control will turn into a death grip if Ticketmaster (the largest ticket distributor) merges with LiveNation, (the largest promoter) to create one giant company. As a merger condition, DOJ should require Ticketmaster to give customers control of who can pick-up their tickets. This is the best way to preserve the secondary market without prophylactic regulation. If not, Congress will need to look at maintaining customer control and convenience in a post-merger "Ticketmaster Nation".

But the event wasn't about consumer protection (in the traditional sense), it was about privacy. Privacy online is today's issue du jour, whether it is marketing to children or collecting and sharing data for targeted ads. The FTC has devoted a series of roundtable discussions toward privacy, with the first one beginning Dec. 7.

Privacy's getting so hyped-up that I believe it to be the next "online safety" sort of issue where isolated and particularized incidents become sensationalized in the media and among regulators, creating counterproductive techno-panics that other commentators have described. This shift is apparent as many policymakers and advocacy groups become increasingly hostile toward targeted online advertising.

But are social media and privacy at odds such that there needs to be a "balance"--whatever that entails? While this question was never explicitly asked, it is clear that Ari Schwartz would say "yes" because he asserts that consumers don't know what information is being collected and that users need help to gain control over their own data.

Ari acknowledged that when it comes to privacy, lawsuits would be filed and that the courts might rule differently on whether social media sites or their advertiser would be liable, depending on the circumstances. The case-by-case approach in the courts is something that many pro-market advocates would support--but it flies in the face of CDT's public comments for next week's FTC Privacy Roundtable.

A cornerstone recommendation in CDT's comment is that "[t]he FTC should encourage Congress to pass general consumer privacy legislation that is based on a full set of Fair Information Practices. Self-regulation cannot adequately protect consumer privacy when it is not girded by legal standards and more direct oversight from the FTC." It's a sweeping statement that ignores the unintended consequences of a general, one-size-fits-all privacy law.

The Maine law regulating "predatory" marketing to children that passed this year is a great case study on the pitfalls of general privacy regulation. The law prohibits the collection of personal and "health-related" information from minors without parental permission, and bans outright its use in marketing to teens.

Because the law was not specific to a particular harm, it was way overbroad. Legitimate advertising and information sharing was now illegal, violating the free speech rights of both advertisers and teenagers. Thankfully, a legislative committee voted in October to recommend repeal of the law.

You often hear privacy advocates rail against the sectoral approach of the U.S. toward privacy, where we have particular laws specific to financial and health care information. They'd rather see a European model of general consumer privacy regulation. But there's no one-size-fits-all to something that is as highly contextual and personal as one's privacy. 

At the event we heard Pablo Chavez say how hard it is to convince consumers to click on display ads. Online publishers and service providers are constantly thinking of new ways to show relevant and compelling advertising to consumers. It is this experimentation and innovation that, by making ads more relevant, keep paying for the free services we all use on the 'Net. When this experimentation goes too far and some consumers get harmed--which will undoubtedly happen as it does in any other commercial context--consumers can sue and the FTC can enforce.

Perhaps I'm reading too much into Ari's acknowledgment that litigation and FTC enforcement will likely figure this out. CDT is an influential and respected organization, so it would be nice to see them acknowledge the pitfalls of a one-size-fits-all solution and talk more about how targeted enforcement can help to weed out any bad actors in targeted advertising. I hope CDT might agree that we need more FTC enforcement and private lawsuits, not new legislation.

Braden Cox

The story quotes Susannah Fox of the Pew Internet and American Life Project:

"They are posting their first-person accounts of treatments and side effects from medications," says Fox. "They are recording and posting those podcasts. They're tagging content. They are part of the conversation. And that, I think, is an indicator of where we could be going in terms of the future of participatory medicine."

For every story that talks about the bad on the Internet, there are are hundreds of positive examples about how online communities improves lives. If only we can get the doctors to use online technology more often....

-Braden Cox

I'm a member of the NTIA Online Safety and Technology Working Group (OSTWG). Our third meeting was on parental controls, child protection technologies and content rating methods. Adam Thierer organized a wealth of speakers to discuss tools available from ISPs, tools existing in operating systems, browsers, and search, and settings that exist in some social networking websites.

Here are the highlights:

• Safety experts praised AOL's parental tools that don't report to parents every site that a child visits. Child abuse, contraception, and other sites are the kinds that many people feel children have legitimate privacy (and in abusive situations even safety concerns for their lives) surrounding the sites they visit.
• A representative from the Department of Education asked about "best practices" -- a good idea in concept but given the diversity of online sites and services easier said then done.
• It is common to categorize children into age groups for parental controls but there's data lacking about how children understand advertising and what is the harm, if any.
• Age groups: 7 and below--white list only. 7-12--no white list only but lots of restrictions. 13-17--very permissive, lots of sites accessible. 17+--only porn images blocked.
• Google will soon be launching a national media digital literacy citizenship campaign.
• FTC will release its virtual worlds report on Dec 10. There is an OECD conference on e-commerce on Dec 8-10.
• "Report abuse" icons on websites are often themselves abused and result in false positives and false reporting. Uniform buttons won't work.
• The FCC wants to know why the V-Chip uptake has not been greater and has been ineffective (can comment on the FCC's NOI).
• Carrie James, a Harvard researcher, has a report that shows that a higher percentage of kids that play online video games are more ethical than their peers that do not (due to the community that's created playing games).

Next time we'll be discussing data retention issues and what this means for child safety.

-Braden Cox

I remember testifying at the Sep-2008 hearing, when the National Retail Federation (NRF) described how regular folks get "hooked" on the "addictive qualities" of selling online, and then steal to "support their online selling habit."  Naturally, I took issue with that, and was joined by hundreds of NetChoice members in demanding an apology from the NRF.

While we got no apology, I think we got something much better at today’s hearing --  a glimmer of hope that retailers and online markets can cooperate to stop retail theft and to stop stolen goods from polluting the online channel.

Committee leadership set the stage for a more productive discussion by selecting witnesses from law enforcement for this year’s hearing.  We heard from experts at FBI, Customs, Secret Service, and the Postal Inspections Service. 

These professionals described their efforts to chase-down organized crime involving stolen goods.  And all of these officials reported that online marketplaces—particularly eBay and PayPal—cooperate fully when law enforcement investigates listings for suspected stolen goods.  Moreover, the FBI and Secret Service witnesses said that online markets will often flag suspicious items and proactively notify law enforcement.

Members of this Congressional subcommittee asked witnesses if they needed new laws and/or new enforcement resources to pursue organized retail crime.  None asked for new laws, which was surprising given that this hearing was triggered by three legislative proposals being supported by big retailers.  Not surprisingly, the witnesses indicated they’d gladly accept additional funding for their enforcement activities.

That’s about right. More enforcement is the most effective way to stop criminals from ripping-off retailers and selling their stolen goods at flea markets and on the Internet.  Still, Chairman Bobby Scott plans to convene a meeting with retailers and online marketplaces, to explore how they can improve cooperation and help to expedite investigations by law enforcement officials. That’s a good move, too.

Like Rudy Giuliani said when he was a federal prosecutor, “It's about time law enforcement got as organized as organized crime.”

--Steve DelBianco