More than a year ago, the staff of the Federal Trade Commission proposed a new framework for online privacy - including a controversial "Do Not Track" option for consumers who want the freedom to surf the Web without having to worry that marketers and data miners will be aware of everything they search for, read, or buy
The online marketing industry bristled at the idea that any limits might be imposed on it, for one obvious reason: In the Internet era, data from online tracking is a high-value currency. Congress, predictably, has balked at taking any big steps. But today, the Obama administration stepped forward with a new privacy proposal, including a "Consumer Privacy Bill of Rights."
The White House says the new bill of consumers' rights is part of "a comprehensive blueprint to improve consumers’ privacy protections and ensure that the Internet remains an engine for innovation and economic growth." It's hard to argue with the rights it aims to protect, which build on so-called Fair Information Practice Principles that date to the 1970s:
Individual Control: Consumers have a right to exercise control over what personal data companies collect from them and how they use it.
Transparency: Consumers have a right to easily understandable and accessible information about privacy and security practices.
Respect for Context: Consumers have a right to expect that companies will collect, use, and disclose personal data in ways that are consistent with the context in which consumers provide the data.
Security: Consumers have a right to secure and responsible handling of personal data.
Access and Accuracy: Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data is inaccurate.
Focused Collection: Consumers have a right to reasonable limits on the personal data that companies collect and retain.
Accountability: Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights.
The devil, as always, is in the details - as well as in the enormous difficulty of enforcing any rules, whether self- or government-imposed. The European Union, which has led America lately in privacy protections, put forward a similar proposal last month, and Obama says rightly that international coordination is crucial to privacy protection.
A key element of Obama's announcement today was the promise of buy-in from the online behavioral marketing industry, which has embraced the idea that consumers should be able to opt out of online tracking via do-not-track tools built into Web browsers. Today's announcement said: "Companies that represent the delivery of nearly 90 percent of online behavioral advertisements, including Google, Yahoo!, Microsoft, and AOL, have agreed to comply when consumers choose to control online tracking. Companies that make this commitment will be subject to FTC enforcement."
Of course, that leaves the companies involved in the delivery of the other 10 percent of behavioral ads, as well as the players who use data amassed online in more nefarious ways - such as the payday lenders I wrote about in Sunday's column who apparently sold or bartered personal financial information to scammers pitching a worthless "platinum" credit card.
And the problem is much bigger than the Internet - as Obama and others have acknowledged, and as was driven home last week by Charles Duhigg's revealing New York Times article on how a critical mass of online and offline data has enabled one retailer, Target, to create incredibly detailed profiles of customers.
Duhigg says Target has been amassing such data into a "Guest ID" for decades. “If you use a credit card or a coupon, or fill out a survey, or mail in a refund, or call the customer help line, or open an e-mail we’ve sent you or visit our Web site, we’ll record it and link it to your Guest ID,” Target statistician Andrew Pole told him, as Duhigg put it, "back when we were still speaking and before Target told him to stop." But Target's knowledge goes well beyond that, Duhigg reported:
Also linked to your Guest ID is demographic information like your age, whether you are married and have kids, which part of town you live in, how long it takes you to drive to the store, your estimated salary, whether you’ve moved recently, what credit cards you carry in your wallet and what Web sites you visit. Target can buy data about your ethnicity, job history, the magazines you read, if you’ve ever declared bankruptcy or got divorced, the year you bought (or lost) your house, where you went to college, what kinds of topics you talk about online, whether you prefer certain brands of coffee, paper towels, cereal or applesauce, your political leanings, reading habits, charitable giving and the number of cars you own. (In a statement, Target declined to identify what demographic information it collects or purchases.
When such data hit a critical mass, the results can be truly disturbing. I wrote two columns last year about a Philadelphia resident who received a direct-mail pitch for an antidepressant drug that suggested a breach in his medical privacy, and the dubious resolution in which the drugmaker, Bristol-Myers Squibb, blamed the mailing on an online survey that that Walter Spencer insisted he never filled out - a survey run by a company that worked with another company that Bristol-Myers did business with.
But Duhigg told an even creepier story about information-gone-wild that centered on a "pregnancy-prediction" model Pole developed for Target's marketers, who are eager to lure expectant mothers to shop:
About a year after Pole created his pregnancy-prediction model, a man walked into a Target outside Minneapolis and demanded to see the manager. He was clutching coupons that had been sent to his daughter, and he was angry, according to an employee who participated in the conversation.
“My daughter got this in the mail!” he said. “She’s still in high school, and you’re sending her coupons for baby clothes and cribs? Are you trying to encourage her to get pregnant?”
The manager didn’t have any idea what the man was talking about. He looked at the mailer. Sure enough, it was addressed to the man’s daughter and contained advertisements for maternity clothing, nursery furniture and pictures of smiling infants. The manager apologized and then called a few days later to apologize again.
On the phone, though, the father was somewhat abashed. “I had a talk with my daughter,” he said. “It turns out there’s been some activities in my house I haven’t been completely aware of. She’s due in August. I owe you an apology.”
Obama, the FTC, and perhaps even the behavioral-marketing industry itself deserve credit for recognizing that our data-intensive, networked world creates an entirely new class of problems for people who just want to preserve what Justice Louis Brandeis once called "the right to be let alone."
It's an enormous challenge, and it may eventually turn on the question of whether consumers - and voters - really care about protecting that right. Because there's plainly a lot of money riding on the right to intrude.