This week's Privacy Bill of Rights hearing and headlines are proof that the time has finally come to address consumer privacy. Unfortunately, the action thus far is not nearly enough. It may be tempting to say that the devil is in the details of the various bills, but the problem here isn't even in the details: it is that regulators and others are focusing on the symptoms rather than the ultimate causes of our failing online privacy.
Creepy behavioral advertising is the most visible symptom of our privacy-deficient society, but it is not the ultimate problem. Every overly-familiar advertisement ("how did it know that I've put on a few pounds recently?") is just a reminder that many companies will sell every bit of personal information they have about you in exchange for a few pennies of revenue. But the real problem is that there is such a marketplace in personal information at all, not just that it is exploited for advertising.
The drive to make money from your personal information is much larger than online advertising. Your data is packaged and sold to every bidder, not just those that use it to show ads in your browser. Legislation that papers over creepy online advertisements might make the problem less visible, but it won't make our privacy foundations solid. Unless we follow with comprehensive privacy reform, then headlines about "do-not-track" will only provide false hope.
Don't get me wrong. A well-implemented "do-not-track" law will improve privacy. Consumers deserve to how their browsing habits will be treated by the sites they visit. And a well-written "do-not-track" will give consumers meaningful control over how their browsing habits on one site (a glance at a recipe for low-calorie shrimp marinara) can be used by others (a week's worth of advertisements for weight-loss surgery). The law will have to be written carefully to allow legitimate innovation, including features such as Facebook's "Like" button (such as the one on this page): is "Like" a form of tracking, a useful feature, or both? But empowering legitimate innovation is a challenge that can be overcome.
What really scares me is that online advertising and behavioral tracking is only the tip of the data iceberg, both in terms of value and in terms of future danger. Everyone sees advertising, so everyone thinks about it all the time, but there is a massive and frightening economy in personal information that goes un-reported and un-legislated.
The biggest threat to privacy is the packaging and sale of private data that happens behind the scenes. The Internet has created a marketplace in all kinds of data for use and abuse by third parties like lenders, insurers, employers, health care providers, scammers, and peeping neighbors. These uses are largely unregulated today, and exist in a shadowy underworld of data sales. And most of this data doesn't come from online behavioral tracking; instead, it is compiled from everything from voter records to survey cards to social profiles. It is combined in ways that consumers don't anticipate, then sold off to every interested buyer.
Consumers often never know that their data is being packaged and sold by data brokers; they don't see evidence of this marketplace in private information every time they open a web browser, and it has thus far escaped attention on the Hill. But countless websites offer both wholesale and retail storefronts for your personal information. With just clicks, it is possible for anyone to go online and find your address, the names of your relatives, your creditworthiness, your occupation, and a street-level photograph of your house -- all neatly packaged into one convenient interface. Nosy neighbors can browse through Spokeo.com profiles about anybody they want to snoop on, and marketers can download this information in bulk from Rapleaf.com, filling their computers with gigabytes of detailed personal information.
Most consumers don't realize that their data has been sold until it is too late: whey they are stalked, scammed, denied a job, or declined for health coverage. And consumers are powerless to correct this information when it's wrong; all too often, data brokers provide a dead-end to concerned consumers. It's all part of your permanent digital record, whether you like it or not.
This underground economy treats consumers as commodities and strip-mines their privacy for profit. Stopping behavioral tracking won't stop these abuses. Consumers deserve to know where and how all of their personal information is being used, not just by advertisers, and they deserve the right to control their digital privacy
Today's attention to Internet privacy is extremely promising. But we must be certain that we're driving meaningful reform, rather than just plastering over the most obvious symptoms. The way I see it, comprehensive Internet privacy reform requires giving individuals control and ownership over their data. Putting the brakes on advertisers with "do-not-track" is just the beginning.
Follow Michael Fertik on Twitter: www.twitter.com/michaelfertik
My attitude today on internet privacy: What, me worry? Because ultimately, there's no point in worrying about it. The only time maybe you SHOULD worry, is if you're up ta sumpin'. Then, be afraid, very afraid, because among the other dataminers, is government. Welcome to the 21st century? Hey, when are you going to take out the trash? Could you sit up a little taller please so the security-cam can see you?
Thanks for your comment on the article. Many people share your feelings regarding personal privacy (the "It's not a problem if you're not doing anything bad" school of thought), but that position doesn't adequately take into account the legitimate harm that can be done to innocent people when personal data is aggregated, sold, and exploited against their will.
Ryan Calo, the senior research fellow at the Center for Internet and Society at Stanford University Law School, did an interesting Q&A on the subject of privacy harm for the Wall Street Journal last year. You can check that out here: http://blogs.wsj.com/digits/2010/08/26/qa-how-do-you-define-privacy-harm/.
Also, this video from Reputation.com paints a pretty clear picture of the various privacy harms that can come from unregulated data aggregation: http://www.youtube.com/watch?v=ceGdmZ_LLfg.
As examples of personal data abuse become more prominent, consumers will reject the current status quo. Indeed, they already are beginning to, as evidenced by the multiple consumer privacy bills currently on the agenda in Congress.
Rob Frappier
Community Manager
Reputation.com
The internet has been fine for over 25 years and does not need incompetent people to manage it. Please spare us your Hobbesian thinking that gov "cannot allow" people to have liberty or trouble ensues. We can more manage our lives and activities far better than any "planner" can.
And, Chomsky says, most regulations aren't for the everyday man but to give corporate interests special powers and favors and monopolies which is exactly what any net neutrality legislation will do.
Any group that wishes to tell us what we can put in our garbage, what we can drive, who monoplizes our health care, who dictates our words and behavior has no business then claiming they are the champions of privacy.
Privacy from utilitarians..... right.
The problem here is that there is no counterforce to oppose this practice and keep it in check outside of a few people who see this as a problem like myself and the author. Unfortunately, we have little power at the moment and as a result these practices will continue in some form completely unchecked. What I'm saying is, in this case, there is no force to counter that of the data gatherers. Until we have such a force, be it through legislation of some sort or through wider acknowledgment of this as a problem, these practices will continue unabated and that is not good.