Yes, the Feds Are Spying on Social Media

Just in case anyone still harbors illusions on this score, the answer is “Yes, the federal government is definitely spying on social media.” In the latest development, a group of online privacy advocates is suing the Department of Homeland Security for failing to release records of its online spying -- which isn’t terribly surprising, considering that it’s not really spying anymore if everyone knows what you’re doing.

The DHS has admitted in a public statement that it creates profiles to monitor “publicly available online forums, blogs, public websites, and message boards,” including social media sites like Facebook and Twitter, in what is known as the “Publicly Available Social Media Monitoring and Situational Awareness Initiative.” The aim is to “to provide situational awareness” for the federal, state, and local governments; the DHS “may also share this de-identified information with international partners and the private sector where necessary and appropriate for coordination.” Crucially, the DHS statement also reveals that participating agencies may reveal personally identifying information about Internet users in emergency, life-and-death situations.

The list of search and monitoring tools used by the DHS includes Collecta, RSSOwl, Social Mention, Spy, Who’s Talkin, and Shrook RSS Reader, while public content and media sharing sites monitored by DHS include Hulu, iReport.com, Live Leak, Magma, Time Tube, Vimeo, YouTube, and MySpace Video. Twitter alone is monitored through a score of Twitter-specific search engines and trend monitoring services.

The array of search terms used by DHS to keep tabs on social media includes “Secret Service,” “Border Patrol,” “Agent,” “Task Force,” “Air Marshal,” “Assassination,” “Attack,” “Drill,” “Exercise,” “Cops,” “Dirty Bomb,” “Militia,” “Shooting,” “Shots fired,” “Deaths,” “Explosion,” “Gangs,” “Breach,” and “Lockdown,” as well as -- surprise -- the names of agencies like the CIA, the FBI, and of course the DHS itself.

Back in April 2011 an organization called the Electronic Privacy Information Center filed a Freedom of Information Act request for records pertaining to the DHS use of social media monitoring -- a request that EPIC says the DHS has failed to respond to. Thus on December 20 EPIC filed an FOIA lawsuit against DHS for these records, which EPIC director Marc Rotenberg told ABC News will supply more information about when, where, and how social media monitoring is used.

ABC News quotes Rotenberg: “We want to know how they're collecting information online, what they're collecting online and if there's legal basis to do this… We are trying to understand what the circumstances are when the DHS is engaged in tracking to social media sites.”

In an earlier post I wrote about the fact that the DHS is using social networks to ferret out fake "green card" marriages between U.S. citizens and immigrants for the purpose of obtaining residency or citizenship for the latter. According to awesomely frank internal DHS records obtained by the Electronic Frontier Foundation under a Freedom of Information Act request, “Narcissistic tendencies in many people fuels a need to have a large group of ‘friends’ link to their pages and many of these people accept cyber-friends that they don't even know. This provides an excellent vantage point for [the Office of Fraud Detection and National Security] to observe the daily life of beneficiaries and petitioners who are suspected of fraudulent activities.”


Read more: http://www.mediapost.com/publications/article/164961/yes-the-feds-are-spying-on-social-media.html?print#ixzz1i7RR7pE7

FTC, Facebook Reach Privacy Settlement

Facebook has agreed to settle a Federal Trade Commission complaint by promising to obtain users' express consent before sharing their information with a wider audience than in the past.

The social networking service also promised to prevent anyone from accessing deleted accounts within 30 days of deletion. Plus, Facebook agreed to institute a comprehensive privacy policy and to submit to audits for 20 years.

The proposed settlement, announced Tuesday, would resolve an FTC complaint alleging that Facebook deceived users by repeatedly sharing information that users believed would be private when uploaded. The FTC's 19-page complaint, unveiled on Tuesday along with the proposed settlement, spells out a variety of ways that Facebook allegedly deceived users.

Among others, in December of 2009 Facebook reclassified a host of data about users as “public” -- including people's names, photos and friend lists. “They didn't warn users that this change was coming, or get their approval in advance,” the FTC said in a statement. That Facebook shift also prompted the Electronic Privacy Information Center and other groups -- including the American Library Association, Center for Digital Democracy and Consumer Federation of America -- to file a complaint against the company.

The FTC also said that Facebook broke promises to users by allowing app developers to access profile information they didn't need. “A platform application with a narrow purpose, such as a quiz regarding a television show, in many instances could access a user’s relationship status, as well as the URL for every photo and video that the user had uploaded to Facebook’s Web site, despite the lack of relevance of this information to the application,” the FTC said in its complaint.

The authorities also alleged that Facebook shared some users' names with advertisers via referrer headers. (Facebook recently prevailed in a lawsuit stemming from that same issue. A judge in that case ruled that the users weren't harmed by any disclosures and, therefore, couldn't pursue their claim in court.)

Facebook CEO Mark Zuckerberg said in a blog post that the company had made “a bunch of mistakes.” He added: “I think that a small number of high-profile mistakes, like Beacon four years ago and poor execution as we transitioned our privacy model two years ago, have often overshadowed much of the good work we've done.”

Zuckerberg also noted that Facebook had already fixed some of the issues noted by the FTC.

In the last two years, Facebook revised its privacy controls to give users more say over who can access their data. But the social networking service hadn't promised prior to Tuesday to seek users' opt-in consent to future privacy-related changes.

Sen. John Kerry (D-Mass.), who introduced an online privacy bill earlier this year, praised the deal.

“This settlement will help ensure that companies keep their promises to consumers and give those consumers a real voice in how their information is used, distributed, and managed,” Kerry stated. “These priorities are consistent with what Senator McCain and I had in mind when we introduced our Internet Privacy Bill of Rights.”

The terms of the Facebook settlement, which were first rumored earlier this month, are in line with the FTC's settlement with Google over its launch of Buzz. That deal requires Google to create a comprehensive privacy program and submit to independent privacy audits for the next 20 years. Google also promised that it will obtain people's express consent before sharing their information more broadly than its privacy policy allowed at the time of collection.

Buzz created social networks out of people's Gmail contacts. At launch, the service revealed information about the names of users' email contacts, if users activated Buzz without changing the defaults. That design meant that a host of confidential information could inadvertently become known, including the names of Gmail users' doctors, lawyers or coworkers.

The FTC will accept comment on the proposed Facebook settlement until Dec. 30.

by Wendy Davis

FTC Accuses Video Ad Network Of Using Flash Cookies For Tracking

In a first, the Federal Trade Commission has charged an ad network with engaging in a deceptive business practice by allegedly using Flash cookies to track Web users.

The regulators' complaint, unveiled on Tuesday, alleges that video ad network ScanScout violated its privacy policy by using Flash cookies from 2007 to 2009 in order to track users' online activity to serve them targeted ads.

Flash cookies were originally designed to remember users' preferences for online video players and other applications, but some companies use such cookies to store the same type of information that is normally found on HTTP cookies. Flash cookies are stored in a different place in people's browsers than HTTP cookies and, until recently, couldn't be deleted or blocked through browser controls.

ScanScout, which was acquired last year by Tremor Media, allegedly said in its privacy policy that users could opt out of receiving cookies by changing their browser settings. That statement was deceptive, the FTC says in the complaint.

“ScanScout represented, expressly or by implication, that consumers could prevent ScanScout from collecting data about their online activities by changing their browser settings to prevent the receipt of cookies,” the FTC alleges. “Consumers could not prevent ScanScout from collecting data about their online activities by changing their browser settings to prevent the receipt of cookies. Therefore, the representation ... was false or misleading.”

The case comes almost two years after consumer protection head David Vladeck expressed concern that companies were thwarting users' privacy settings with Flash cookies. Since then, several other companies have been accused of tracking people with Flash cookies and three companies -- Quantcast, Clearspring and Say Media's VideoEgg -- agreed to pay a total of $3.4 million to settle civil lawsuits.

The FTC hasn't publicly accused any companies other than ScanScout of using Flash cookies deceptively.

The same day that the FTC announced the complaint, it also announced that Tremor had agreed to settle the charges by promising to notify Web users about tracking and allow them to opt out. The company specifically said it will allow users to opt out of the collection of most data containing unique identifiers, including an IP addresses. The proposed settlement allows Tremor to continue collecting data from opted-out users for some purposes, including frequency capping, fraud prevention and age verification.

Tremor said two months ago that it planned to roll out the you-are-being-targeted icons developed by the umbrella group Digital Advertising Alliance on video ads. The company isn't admitting wrongdoing as part of the proposed settlement.

Tremor also is facing a lawsuit in federal court in Boston by consumers over ScanScout's alleged use of Flash cookies. Defendants in that case include AOL and Brightcove. All recently filed court papers asking for the matter to be dismissed. ScanScout said in its court papers in that matter that it “never used Flash or any other technology to respawn deleted cookies.”

by Wendy Davis

How The White House Blogged Nothing About The New Piracy Agreement

The White House decided a new voluntary agreement between ISPs and Hollywood on internet privacy was important enough to blog about. Unfortunately, the blog post pretty much said nothing. Since I already wasted time reading that White House post, I decided I should waste more time deconstructing what a waste of time it was.

The Administration is committed to reducing infringement of American intellectual property as part of our ongoing commitment to support jobs, increase exports and maintain our global competitiveness.

Well, I assume you’re committed to reducing anything that’s against the law, right? I mean, that’s why we have laws. But if you want to give me the this is all about jobs spiel, I suppose an election year is coming up.
The joining of Internet service providers and entertainment companies…

I’m sorry. Was there a merger of some sort? Is the FTC involved? Don’t some of the entertainment companies already own ISPs? But go on, I’m sure you’ll explain more.

…in a cooperative effort to combat online infringement can further this goal and we commend them for reaching this agreement. We believe it will have a significant impact on reducing online piracy.

Say what? What effort? What are they doing? Got a link or anything about this? Sounds pretty important. If I wanted to understand more about it, um, you want to point me to anything in particular?

We believe that this agreement is a positive step and consistent with our strategy of encouraging voluntary efforts to strengthen online intellectual property enforcement and with our broader Internet policy principles, emphasizing privacy, free speech, competition and due process.

Again, what agreement? You’re telling me this is all wonderful, but you can’t explain what’s going on? I mean, I know it’s all voluntary or whatever, and you’ve got nothing apparently to do with it other than saying you support it. But if you are so supportive of it to do a blog post, maybe you could explain it?

As such, we will follow the implementation and outcomes of this arrangement with great interest. Our expectation is that the new organization created by it will have ongoing consultations with privacy and freedom of expression advocacy groups to assure that its practices are fully consistent with the democratic values that have helped the Internet to flourish.

There’s a new organization? What’s it called? Does it have a web site? A Twitter account? Throw me a bone here. Maybe tell me some of the organizations behind it?

Simultaneously, the Administration will continue to pursue comprehensive solutions to the problems associated with Internet piracy, including increased law enforcement and educational awareness. To win the future and succeed in the global economy, it is critical to protect the intellectual property of America’s innovators and creators.
Really, that’s it? You called me over to the blog to tell me basically nothing? Thanks. I ended up having to head over to Techmeme, to read what journalists were writing about this new rosy future. Thank goodness they were around, because you told me zilch.

Next time, if you have nothing to say, then say nothing.
Oh, special request. If you’re all for helping Hollywood fight piracy, how about helping those consumers who actually do buy thing legitimately. For one, I never, ever, ever want a DVD to force me to sit through 5 minutes of previews. Can we have a law that if I push Menu, I immediately get the Menu button?

And that FBI warning? Enough. Let them put it on the box. I don’t need to see that logo over and over again. What other industry gets to shove those kind of warnings down the throats of consumers over and over again, outside of maybe the airline industry. And it’s not like we’re getting safety instructions, or anything.

By Danny Sullivan

Ad Groups Granted Extension To Comment On Do-Not-Track

At the request of a coalition of industry groups, the Federal Trade Commission has extended the deadline for comments to its privacy report until Feb. 18. The original deadline was Jan. 31.

Stuart Ingis, counsel to the umbrella organization Digital Advertising Alliance, asked for an extension in a letter to the FTC sent late last year. He said that business associations needed more time to evaluate the FTC's report -- which called on Web companies to create a universal mechanism for consumers to opt out of online tracking -- as well as a separate report about privacy issued by the Department of Commerce.

"Additional time will allow business to evaluate the potential impact on the proposals to important business operations and critical services to consumers," he wrote. "By allowing members to fully digest the two proposals and provide thoughtful input in the form of additional comments, we believe we can provide the Commission with more meaningful input from a broad spectrum of affected industries."

The American Association of Advertising Agencies, American Advertising Federation, Association of National Advertisers, Direct Marketing Association, Newspaper Association and U.S. Chamber of Commerce were among the groups that requested extra time. They had asked for an extension until March 15.

In a separate letter, the Securities Industry and Financial Markets also asked for a 30-day extension. That organization said the FTC's report "may impact the financial services industry to a significant extent."

In its privacy report, the FTC sought comment on a host of issues, including whether it should recommend legislation requiring do-not-track if the industry doesn't voluntarily implement "an effective uniform choice mechanism."

The separate Commerce Department report called for business groups and consumer advocates to work together to develop self-regulatory privacy policies based on Fair Information Practices principles. That report also called for comments about whether new laws are needed. The deadline for those responses is Jan. 28.

The Senate is expected to conduct a hearing next month about online privacy.

To date, the FTC has received more than 200 comments on its report, primarily from individuals, but also from at least one business organization -- the Management Association for Private Photogrammetric Surveyors, made up of private firms engaged in remote sensing, spatial data and geographic information systems.

That group takes issue with a section of the report calling for companies to seek consumers' affirmative consent before collecting "precise geolocation data" -- included in the FTC's proposed definition of sensitive information. MAPPS says this restriction could "hamper the ability of firms, agencies and organizations to collect, use, share, or apply geospatial data."

The organization is asking the FTC to either exempt geolocation data from the prior-consent requirement or define the term more precisely. "It would be impractical, if not impossible, for our member firms to obtain prior approval or consent from individual citizens prior to acquiring or applying data such as satellite imagery, aerial photography, or parcel, address, or transportation data," the group writes.

By Wendy Davis

IAB Prepares To Take Larger Role In Litigation, Lobbying Efforts

Positioning itself to take a more active role in litigation that could have an impact on online advertisers, the IAB said on Friday that it has elevated Mike Zaneis to senior vice president, general counsel, from his previous position as vice president of public policy.

In his new role, Zaneis, along with Alison Pepper, director of public policy, will deal with routine legal matters -- like reviewing contracts for IAB events -- in addition to lobbying duties. By taking business matters in-house, the IAB will be able to shift resources to matters like filing friend-of-the-court briefs in online privacy cases, or in challenges to laws that restrict advertisers, Zaneis says.

"There are cases that could have broader implications for the industry, where we may want to weigh in," he says. For instance, Zaneis says, the IAB might consider getting involved in litigation about the use of cookies and Flash cookies to track people online. "We wouldn't want a bad precedent set in any one case," he says.

Zaneis also says the IAB aims to broaden its lobbying and regulatory operations. "We'll look to expand in the coming year," he says. "Certainly we're going to continue to devote resources to public policy. The challenges there are only increasing."

The IAB's move comes amid a flurry of new privacy lawsuits against companies involved in online advertising. In the most recent case, filed this week, a New York resident alleged that the behavioral targeting network Interclick violated federal computer fraud laws and wiretap laws by using "history sniffing" technology to determine what other sites she had visited, and also using Flash cookies to recreate deleted HTP cookies.

In addition, Congress is considering legislation that could affect how online ad networks track Web users, the Commerce Department is expected to propose baseline privacy laws, and the Federal Trade Commission recently recommended that online ad companies implement a universal do-not-track mechanism.

In addition to promoting Zaneis, the IAB also said on Friday that it elevated Patrick Dolan to chief operating officer and David Doty to chief marketing officer.

By Wendy Davis

Legislators Question Web Companies' Privacy Practices

Two senior lawmakers are questioning AOL, Yahoo, MSN and other Web companies about their practice of allowing third-party ad companies to install cookies and other tracking mechanisms on visitors' computers.

In letters to the companies, Reps. Ed Markey (D-Mass.) and Joe Barton (R-Texas) said they were troubled by the notion "that the price of consumers' daily use of the Internet increasingly is surrender of their personal information." The legislators' move comes in response to a recent Wall Street Journal report that the top 50 U.S. Web sites installed an average of 64 pieces of tracking technology -- like cookies or beacons -- onto users' computers.

Web companies often say that such tracking is anonymous, but privacy advocates worry that individuals can be identified if the information that's gathered is sufficiently detailed. Markey and Barton said in their letter that the online data collection now underway "permits web-based enterprises to develop digital dossiers on consumers for a range of purposes, including highly targeted marketing."

They asked the Web sites a host of questions, including how information about users is collected, whether such information is monetized, and if so, how much revenue was associated with that information in the last 12 months.

The letter also asked the sites to provide the names of all ad and analytics companies that have access to visitors' data. The lawmakers also questioned the Web sites about their privacy policies, asking whether consumers are notified about the array of companies that collect data.

The 15 sites to receive letters were Dictionary.com, MSN.com, Comcast.net, AOL.com, Merriam-Webster.com, Photobucket.com, Answers.com; Careerbuilder.com; MSNBC.com, Live.com, Myspace.com, Yahoo.com, Verizonwireless.com, Yp.com, and About.com.

A Verizon Wireless spokesperson said the company was reviewing the request and would get back to Congress.

A Microsoft spokesperson said in a statement that the company "takes seriously our responsibility to protect people's privacy when they are using Microsoft's products and services." The spokesperson added: "We look forward to reviewing the letter and continuing to work with Representatives Markey and Barton on this important issue."

A third company said it had not yet received the letter.

Separately, a coalition of privacy advocates including the Center for Digital Democracy and U.S. Public Interest Research Group asked lawmakers to investigate a report in The Wall Street Journal stating that Microsoft lessened privacy protections in the latest version of its browser in response to concerns raised by the ad industry. The original plan reportedly was to have a setting that automatically rejected tracking technology. Instead, while the browser allows consumers to reject tracking technology, people must activate that setting anew each time they launch the software.

"Microsoft's self-serving action is emblematic of the ad industry's failure to enact meaningful self-regulation," the advocates state in letters sent to Reps. Barton and Waxman (D-Calif.) as well as Sens. Jay Rockefeller (D-W.Va.) and Kay Bailey Hutchison (R-Texas).

Lawmakers currently are mulling two proposals for privacy legislation -- a bill introduced last month by Rep. Bobby Rush (D-Ill.) and a draft proposal floated earlier this year by Rep. Rick Boucher (D-Va.).

By Wendy Davis

Judge Rules Site Alleging Copyright Infringement Did Not Send Takedown Notices To Google Properly

A federal judge in Los Angeles has handed Google a significant victory in a copyright infringement lawsuit brought by adult entertainment company Perfect 10.

In a ruling issued earlier this week, U.S. District Court Judge A. Howard Matz largely cleared Google for allegedly displaying links in search results to sites that infringe Perfect 10's copyright. Matz found that in many cases, Perfect 10 had not provided the search company with detailed enough information to be able to easily remove the pirated material.

In general, the Digital Millennium Copyright Act protects search engines from liability for returning copyright images in their results, provided the search engines remove pirated material upon request. Matz said in his ruling that Perfect 10 made at least 83 such takedown requests to Google since 2001, but that most of them were deficient.

Matz elaborated that some of the takedown notices were sent to the wrong address -- webmaster@google.com -- instead of the address that Google had designated. Other takedown notices referred to "dozens or even hundreds of alleged infringing links," but many of those didn't contain enough details about the URLs for Google to be able to determine what material to remove.

Matz said that in other instances, Perfect 10 merely provided Google with a package of a cover letter, spreadsheet and DVDs with electronic files -- and then expected Google to "comb through hundreds of nested electronic folders containing over 70,000 distinct files, including raw image files such as JPEG files and screen shots of Google search results, in order to find which link was allegedly infringing."

While Matz didn't dismiss all of Perfect 10's claims, the ruling seems to put a big dent in the company's case, which has been pending since 2004.

Santa Clara University law professor Eric Goldman says on his blog that the ruling shows that content owners "should not get creative or lazy" with their takedown requests. "Over and over again, we've seen that the big service providers will respond quickly to properly drafted takedown notices; and we've seen judges become increasingly less tolerant of plaintiffs who couldn't bother to follow the statutory roadmap," he writes.

The ruling marks at least the second major recent defeat for Perfect 10. In May, a different federal judge denied Perfect 10's request for an injunction shutting down RapidShare for allegedly contributing to copyright infringement.

FTC Considers Do-Not-Track List

By Wendy Davis

The Federal Trade Commission is considering proposing a do-not-track mechanism that would allow consumers to easily opt out of all behavioral targeting, chairman Jon Leibowitz told lawmakers on Tuesday.

Testifying at a hearing about online privacy, Leibowitz said the FTC is exploring the feasibility of a browser plug-in that would store users' targeting preferences. He added that either the FTC or a private group could run the system.

Leibowitz said that while Web users on a no-tracking list would still receive online ads, those ads wouldn't be targeted based on sites that users had visited in the past.

Three years ago, a coalition of privacy groups including the World Privacy Forum, Center for Digital Democracy and Center for Democracy & Technology proposed that the FTC create a do-not-track registry, similar to the do-not-call registry. At the time, the online ad industry strongly opposed the idea of a government-run no-tracking list.

Currently, many people who want to opt out do so through cookies, either on a company-by-company basis or through the Network Advertising Initiative's opt-out cookie (which allows users to opt out of targeting from many of the largest companies). But those opt-outs aren't stable because they're tied to cookies, which often get deleted.

The Network Advertising Initiative recently rolled out a browser plug-in that enables consumers to opt out of targeted ads by NAI members.

Leibowitz also told lawmakers that he personally favored opt-in consent to behavioral targeting, or receiving ads based on sites visited. "I think opt-in generally protects consumers' privacy better than opt-out, under most circumstances," he said. "I don't think it undermines a company's ability to get the information it needs to advertise back to consumers."

Online ad companies say that behavioral targeting is "anonymous" because they don't collect users' names or other so-called personally identifiable information, but Leibowitz said that it might be possible to piece together users' names from clickstream data. He told lawmakers about AOL's "Data Valdez," which involved AOL releasing three months' of "anonymized" search queries for 650,000 users. Even though the company didn't directly tie the queries to users' names, some were identified based solely on the patterns in their search queries. Several lawmakers expressed concerns with behavioral advertising during Tuesday's hearing. Sen. Claire McCaskill (D-Mo.) said she was "a little spooked out" about online tracking and ad targeting.

McCaskill said that after reading online about foreign SUVs, she noticed that she was receiving ads for such cars. "That's creepy," she said, likening it to someone following her with a camera and recording her moves.

She added that if an "average American" were to learn that someone was trailing him around stores with a camera, "there would be a hue and cry in this country that would be unprecedented."

Sen. Jay Rockefeller (D-W. Va.) and Sen. John Kerry (D-Mass.) both expressed concern that privacy policies weren't giving Web users enough useful information about online ad practices.

Rockefeller proposed that some companies were burying too much information in lengthy documents that consumers don't read. "Some would say the fine print is there and it's not our fault you didn't read it," he said, adding, "I say, that's a 19th-century mentality."

Kerry added that he didn't know that consumers understood how companies use data. "I'm not sure that there's knowledge in the caveat emptor component of this," he said.

IAB, Consumer Advocates Weigh In On Privacy Laws

A senior Republican lawmaker expressed concern on Thursday that a privacy bill introduced by Rep. Bobby Rush (D-Ill.) could impose too many restrictions on businesses.

"We must craft legislation that creates an incentive for businesses to subscribe to the very best practices," Rep. Cliff Stearns (R-Fla.) said at a hearing on Rush's proposal. Stearns criticized several aspects of Rush's bill, including that it would allow consumers to bring lawsuits against companies that violate the law, and that it delegates too much power to the Federal Trade Commission.

Stearns had signed on to an earlier proposal floated in May by Rep. Rick Boucher (D-Va.), which differs in a few key ways from Rush's bill the Best Practices Act (H.R. 5577).

Rush's measure would require Web companies to obtain users' explicit permission before sharing their personal information with third parties, unless those companies participate in a "universal opt-out" program operated by a self-regulatory program and overseen by the Federal Trade Commission. Rush also would allow consumers to sue privately for up to $1,000 per violation, with damages capped at $5 million per incident.

Boucher's slightly different proposal would require ad networks that track people and collect personal information for ad purposes to obtain users' opt-in consent, unless the networks provide prominent notice through an icon and also allow people to view and edit their profiles. Boucher also would ban private lawsuits.

Rush's bill, like Boucher's, doesn't just cover personally identifiable information like names and addresses, but also applies to supposedly anonymous information, including Web users' marketing profiles that are associated with cookies on their computers. But unlike Boucher's proposal, Rush's measure also tasks the FTC with further defining the type of data that is covered by the bill.

At Thursday's hearing, Rep. Ed Whitfield (R-Ky.) asked whether the collection of anonymous browsing activity should "require the same level of consent" as collecting material like names and financial account numbers.

Two privacy advocates on the panel, Ed Mierzwinski, program director of the U.S. Public Interest Research Group, and Leslie Harris, president and CEO of the Center for Democracy & Technology, indicated they believed the answer was yes, because of the possibility that people could be identified based on "anonymous" information.

"We're concerned that de-identified or supposedly anonymous information can be repackaged back together," Mierzwinski said.

But the Interactive Advertising Bureau's Vice President for Public Policy Mike Zaneis said that Congress shouldn't try to legislate about activity that was only theoretical. He said that it isn't the "predominant business model" to connect clickstream data to personally identifiable information.

Whitfield also asked whether requiring users' opt-in consent to data collection would hinder online businesses.

Federal Trade Commission Consumer Protection Chief David Vladeck said that the most important consideration isn't whether companies obtain opt-in or opt-out consent, but whether they are adequately notifying consumers about data collection. "The goal ought to be to keep consumers well-informed," he said. "Clarity and ease of use ought to be the key metrics."

Google Takes FTC to Task Over Journalism’s Future

There’s a lot of hand-wringing about the future of journalism, but does that mean the government should step in?


The Federal Trade Commission last month issued a “discussion draft” paper that proposed things like legislation to limit news aggregators, and tax breaks and antitrust exemptions for news organizations. Other reports, like one from Columbia University, also have suggested that the government take a bigger role in supporting journalism. This week, tech giant Google put in its two cents — or 20 pages, to be exact — questioning the FTC draft proposals and saying that “business problems require business solutions” rather than regulation.

The problem, Google says, is that newspapers have failed to keep up with the times. To back up its argument, Google quotes the former editor of the Rocky Mountain News on lessons he learned from the paper’s failure, including that the company made a mistake by seeing its website as relatively unimportant.

Google points out that search engines and services like Google News allow news organizations to find new audiences. And it says the Internet has increased the opportunity for new publishers — like bloggers — to enter the market. Meanwhile, the FTC draft focuses on newspapers and mentions the word “blog” only once in 35 pages, as City University of New York journalism professor Jeff Jarvis pointed out on his blog.

Google also argues that journalists should not have a copyright on so-called “hot news” or scoops, given that journalists have long reported the work of others and that facts shouldn’t be copyrighted. (It’s no surprise that Google comes down on the side of news aggregators, since Google itself operates one, but this brief uses tougher language than Google has in the past.)

The tech giant comes out strongly against breaks for news organizations and journalists, pointing out that historically the FTC has opposed such exemptions.

But there’s still a consensus that journalism is an important part of democracy. The question is whether that part of its role will survive. Other ideas proposed in the FTC document included increasing access to government data and starting a journalism division of AmeriCorps.

Report: Consumers Prefer Receiving Credit Card Information Via Email, Targeted Approach Best For New Business

Marketers able to mount multichannel, highly targeted ad campaigns are well positioned to capture a piece of the lucrative credit card business, according to new research from direct marketing agency Epsilon.

"Consumers want and expect to receive information that is relevant and personal, especially when it comes to financial services marketing," said Michael Penney, EVP of Epsilon's Strategic & Analytic Consulting Group. "In order to engage consumers and create unique experiences, marketers need to focus on asking questions and understanding what consumers want and how to engage with them."

More than half of consumers surveyed were unsure of what credit card company they were going to use when opening up a new account. Only 34% of consumers surveyed definitely knew which company they would go with, while over four in ten consumers chose a company with which they already had accounts.

The most influential sources of information were friends and family, followed by a financial advisor, brand Web sites, and product review Web sites.

"A multichannel approach that speaks directly with the individual consumer can create long-lasting relationships," Penney added.

Meanwhile, the primary reason why consumers selected a credit card company was the rewards program, while interest rates and recommendations from friends and family were also driving forces. The preferred channel for receiving information about credit cards was email, followed by postal mail and company Web sites.

Consumers also expressed interest in receiving rate changes and sales/discount offers from credit card companies, while nearly one-third also chose information tailored to their interests as one of their top two selections.

Loyalty programs were identified as another critical component of a successful retail banking marketing strategy.

The survey included responses from over 180 consumers who recently opened up a new credit card. It was part of a listening exercise designed to explore the concept of Customer Experience Marketing, an approach to deliver relevant interactions that anticipate and respond to the many ways that consumers want to engage, shop and buy today.

FTC Offers Broad Interpretation (Extending All The Way To Twitter) Of Its Endorsement Guides

People who endorse marketers for a fee on Twitter could disclose the payment by adding a hashtag like "#paid ad" or "#ad" to their tweets, the Federal Trade Commission said this week. That was just one piece of new advice from the FTC about how to interpret its revised guides to testimonials and endorsements, issued last October.

The guides are not in themselves enforceable, but indicate the type of activity the FTC will consider deceptive. They specifed that bloggers should reveal "material connections" to marketers -- including the receipt of free review copies -- when consumers would be surprised to learn of the connections.

This week, the FTC published additional material about the guides, including answers to frequently asked questions. One of the questions addressed concerned how Web users could make adequate disclosures on Twitter, where posts are limited to 140 characters. The FTC suggested using a hashtag like "#paid ad," noting that it only required eight characters. (The FTC incuded the space in its suggested hashtag.)

The FTC also reiterated this week that its focus is on advertisers, not bloggers. The agency says it has no intention of monitoring bloggers; even if they come to its attention. Instead, the commission says, its focus "will be on advertisers, not endorsers -- just as it's always been."

The new advice typically suggests that people resolve any ambiguities by making more rather than fewer disclosures. For instance, one question considers whether individuals who say on Facebook that they work for a company must also make disclosures when they tout that company's products. The FTC says that doing so is "a good idea."

In addition, the FTC suggests that even token perks, like $1 coupons, should be disclosed. "While getting one item that's not very valuable for free may not affect the credibility of what you say, sometimes continually getting free stuff from an advertiser or multiple advertisers is enough to suggest an expectation of future benefits from positive reviews," the commission says.

When the guides came out last year, some industry observers criticized them for treating bloggers differently than writers for more traditional media. For instance, while the FTC recommended that bloggers tell readers about the receipt of free review copies, the agency didn't recommend that newspapers, magazines or Internet news sites make similar disclosures.

The FTC continues to make that distinction in its new document, on the theory that consumers have different expectations for blogs than news media. "For a review in a newspaper, on TV or on a website with similar content, it's usually clear to the audience that the reviewer didn't buy the product being reviewed," the FTC says. "But on a personal blog, a social networking page, or in similar media, the reader may not expect the reviewer to have a relationship with the company whose products are mentioned."

But the FTC doesn't spell out why it believes that consumers make different assumptions about reviews depending on where they appear -- an omission that troubles some observers like Santa Clara University law professor Eric Goldman. "It's an empirical statement that they have no support for," he says.

Jeff Greenbaum, an advertising and marketing lawyer with Frankfurt Kurnit Klein & Selz, adds that marketers who were awaiting additional guidance might be "surprised, and perhaps even disappointed," by the FTC's latest advice. "One of the major concerns that people had about the guides was that any time you provided a free product to a blogger, disclosure would be required," he says. The new material "really reinforces the FTC's position that almost anything you provide to a blogger will require disclosure."

By Wendy Davis

Google-AdMob Deal Gets Extended Federal Review

SAN FRANCISCO — Google may have gotten some help from its rival Apple in its attempt to acquire the mobile advertising start-up AdMob.

The Federal Trade Commission got a two-week extension from Google and AdMob for its review of Google’s $750 million acquisition, according to two people briefed on the review process. The agency wants to use the additional time, in part, to better understand the competitive effects of Apple’s purchase of Quattro Wireless, an AdMob rival, and Apple’s impending introduction of its new iAds mobile advertising system, these people said.

Under the F.T.C.’s initial agreement with Google and AdMob, the review period was set to expire last Monday. A decision on the deal could come as soon as Friday.

According to several people briefed on the investigation, the F.T.C. has been leaning toward opposing the deal, reasoning that it would substantially diminish competition in the nascent market for advertising on mobile phones.

But the F.T.C. also must evaluate whether a strong second player in the market — Apple — would significantly change the competitive landscape and make it easier, or more difficult, for smaller players to gain entry. Google executives have pointed to Apple’s entry into the mobile ad market as a sign that the business is competitive.

One factor that could be complicating the F.T.C.’s review, said a person briefed on the process, is Apple’s famous reluctance — even with federal regulators — to open up about its business plans. It is unclear what kind of effect that the iAds system, which Steven P. Jobs, Apple’s chief executive, unveiled last month along with new software for the iPhone, could have on the overall mobile ad market. Apple’s iAds, unlike mobile ads from Google and AdMob, will appear only on the iPhone, and the system will cater exclusively to high-end advertisers, at least at first.

A representative for Google did not immediately return requests for comment, and an Apple spokesman declined to comment.

The F.T.C. and the Justice Department have begun a discussion over who will lead an inquiry into Apple’s restrictions on the terms of service for developers of the iPhone.

Another person briefed on the F.T.C.’s deliberations said that the agency’s decision on Google’s acquisition of AdMob “would have been much easier without Apple and its new ad system and terms of service provisions.”

As the F.T.C. decision approaches, battle lines are forming, with each party trying to marshal public support for its position. In the last two weeks, several prominent technology bloggers have written that the agency would be shortsighted to block Google’s activities in such a new market.

On the other hand, Martin Sorrell, chief executive of WPP, one of the world’s largest advertising groups, told the news agency Reuters on Monday that the investigation “should be rigorous” and that the F.T.C.’s review of Google’s acquisition of DoubleClick in 2007 was not “deep enough or strong enough.”

By Brad Stone

Feds vs. Facebook: Just Give Up Now

It was inevitable, really: between the need of Congressional Democrats to rattle the media cage, and the need of Facebook to turn itself into a viable ad platform at any cost, there was bound to be some kind of collision. Predictably, the issue is privacy. Equally predictable is the outcome: Facebook will have to offer at least a few real concessions to hold on to the basic core strategy.

Last week, Facebook announced a bold new audience and advertising strategy that will extend its presence across the Web through partnerships with sites like Pandora, Yelp and Microsoft Docs. The new strategy involves sharing user information from Facebook with these other Web sites. Today four U.S. Senators -- Sen. Charles Schumer, D-NY, Sen. Michael Bennet, D-CO, Sen. Mark Begich, D-AK, and Sen. Al Franken, D-MN -- are demanding that Facebook implement new controls that will make it easier for users to determine how much of their personal information is shared with other Web sites.

I'm no legal expert, so I couldn't say whether Facebook really runs a risk of crossing some regulatory authority on privacy issues (although MediaPost's Wendy Davis thinks the new strategy is problematic). I doubt very much that the company would undertake something of questionable legality at this point in its existence -- but that doesn't mean it will be smooth sailing. In the past misconceived revamps and new programs like Beacon have encountered strident opposition from Facebook users, even though they were perfectly legal and also covered by the site's existing terms of use. In keeping with the basic ethos of a social network, there are other criteria beyond legality to consider -- namely, public opinion.

That's where Congress comes in. Always ready to grandstand unhelpfully, members of Congress seem compelled to insert themselves into controversial media debates, whether or not they possess any actual expertise or useful advice. A good example is the recently concluded Congressional hearings about issues surrounding Arbitron's Portable People Meter for radio ratings. The hearings were held at the behest of minority broadcasters who asserted that Arbitron's audience samples failed to adequately represent minority listeners. Obviously this was a rather complex technical issue involving the firm's sampling methodology, audience sociology, and statistical validity, and it's unclear what a couple sound bites from a full-time politician could contribute to this quantitative quagmire -- but that didn't stop the House Committee on Government Oversight and Reform from holding months of "inquiries."

The Arbitron example is instructive and cautionary for Facebook. After a lot of back and forth and around and around, Congress heard testimony from the Media Rating Council, which reminded Congress that it had created the MRC back in the 1960s for just this very purpose (i.e., maintaining quality standards in media ratings). Surprised at its own foresight, Congress joined MRC boss George Ivie in encouraging minority broadcasters to join the MRC, so they could gain access to confidential information regarding Arbitron's sampling techniques and also have a say in future reviews of PPM methodology. Last week Arbitron, the MRC, and the minority broadcasters announced they reached an agreement wherein Arbitron would take steps to improve minority sampling techniques.

Congress declared victory without really having done anything -- and that's the whole point. Congressional hearings don't seem designed to achieve much of anything; rather, they simply generate a continuous stream of negative publicity for companies accused of political (but not legal) transgressions, until the companies "voluntarily" agree to take whatever measures seem necessary to placate public opinion.

Frankly, in my humble opinion, Facebook would be well advised to just skip this whole process by caving in to the Senators' demands now. Because ultimately you can't win. The really dangerous thing about Congressional hearings is that they can go on forever: members of Congress get paid no matter what, and positively revel in the publicity. They want the hearings to last forever, and the universe of subject matter they can address is effectively infinite.

Meanwhile, ironically enough, Facebook users have already come up with an effective response to the Facebook changes. A message has been making the rounds which reads: "There is a new privacy setting called 'Instant Personalization' that shares data with non-Facebook websites and it is automatically set to 'Allow.' Go to Account > Privacy Settings > Applications and Websites and uncheck 'Allow.' Please copy & repost."

IAB Gets Tough to Play Nice with FTC

The Interactive Advertising Bureau wants to play nice with the Federal Trade Commission. As the online ad industry braces for impending online privacy legislation, the trade association made a key move recently to help the FTC crack down on rogue companies. During the group's annual leadership summit in February, its board of directors and general membership body voted to establish a code of conduct intended to help the government enforce the IAB's privacy guidelines.

Once the IAB establishes the code, its members will be obligated to abide by it. If a company is accused of skirting the rules, the FTC can bring a deceptive practices case against that firm. The goal, explained Mike Zaneis, IAB's VP of public policy, is "to create a federal law enforcement hook."

According to Zaneis, there were no objections raised by board members, who approved the measure unanimously, or by general members attending the conference, who participated in a voice vote. Self-Regulatory Principles for Online Behavioral Advertising put forth last July by a broader industry coalition will provide a basis for the code, which will be written in the next few months, Zaneis said.

The move has flown largely under the radar. Though it may seem a mere procedural change, establishment of a conduct code will provide the organization an enforcement mechanism - one some argue is needed in order to ward off regulatory pressure.

"The key is that we know for the principles to be successful, it has to be a partnership with the Federal Trade Commission," said Zaneis. "It's not necessarily out of the ordinary... It's a major commitment." The FTC mainly has been supportive of the industry's efforts to self-regulate.

Rather than create its own monitoring program, the Better Business Bureau will help the IAB patrol its members' practices, said Zaneis. The IAB partners with the Better Business Bureau's advertising review body, which is overseeing a broad industry initiative that also involves the Association of National Advertisers to self-regulate through consumer education and disclosure.

Yet, as the IAB and the broader industry coalition takes steps towards enforceable self-regulation, new privacy laws are looming that could have serious effects on online advertising. New privacy legislation is expected in the next few weeks, according to Zaneis, who told ClickZ earlier this week, "We absolutely expect to see a draft bill from Congressman [Rick] Boucher in the next several weeks. They seem to have language and are working through the last few substantive and procedural issues before sharing it more widely," Boucher, a Virginia Democrat, chairs the House Subcommittee on Communications, Technology and the Internet, a key body dealing with online ad related issues and online privacy.

According to Zaneis, the IAB's board will draft the code of conduct over the next few months, and vote on final approval once it is written. "It's likely to be an evolving document," he said.

Watchdogs Ask FTC To Probe 'Behavioral Targeting On Steroids'

A coalition of advocacy organizations led by the Center for Digital Democracy is asking the Federal Trade Commission to investigate companies that are merging online and offline data about Web users in order to serve targeted ads to highly specific audiences.

Advocates have filed other complaints about online behavioral advertising, or serving users ads based on sites visited, but they say that newer methods of ad targeting are especially problematic -- in part because of the extremely detailed user profiles that result from integrating online and offline information.

"It's behavioral targeting on steroids," says Jeff Chester, CDD's executive director. "Online marketers have made what was science fiction in 'Minority Report' now a reality. They have created a stunning and impressive -- but deeply disturbing -- automated system that, while boosting revenues and efficiency, has very serious consequences to consumers."

The complaint alleges that the "massive and stealth data collection apparatus" threatens privacy and also "robs individual users of the ability to reap the financial benefits of their own data."

Joining CDD in the filing are the U.S. Public Interest Research Group and the World Privacy Forum. The groups are asking for a probe of a host of Web companies, including Microsoft, Google and Yahoo.

They are asking the FTC to require companies that are "involved in real-time online tracking and auction bidding, including providing related data optimization" to obtain consumers' opt-in consent.

"The online marketing industry has to begin paying attention to this notion of consumer empowerment," Chester says.

In addition, the groups argue that consumers should reap some financial reward when data about them is used to convince marketers to pay a premium for ads. "The availability of so-called free content is an insufficient return to a consumer for their loss of privacy, including their autonomy," they allege.

The online ad industry generally argues that targeting poses no privacy threat because companies don't know individuals' names or other identifying information. Also, they say, self-regulatory principles require companies to allow users to opt out of targeting.

But the advocates specifically challenge the idea that targeting is anonymous simply because marketers don't have so-called personally identifiable information. The groups point to a recent spate of deals, such as eXelate's arrangement to add Nielsen's PRIZM data to users' cookies, to show that companies are compiling far more detailed profiles than in the past.

"The incorporation of outside data, including behavioral information, on a single user or set of users, illustrates the need for the FTC to quickly clarify to marketers that they can no longer hide behind the flimsy excuse that targeting is ok because it isn't so-called personally identifiable," the complaint alleges.

In 2006, the CDD and U.S. Public Interest Research Group filed an FTC complaint that kicked off much of the current debate in Washington about behavioral targeting and privacy.

FTC Reviewing COPPA Rules

The FTC is seeking comment on whether changes should be made to rules imposing certain requirements on Web sites directed at children, including a mandate that they obtain parental consent before collecting personal information from children under the age of 13.

In a Federal Register notice Monday, the FTC said the Children's Online Privacy Protection Act, which went into effect in 2000, requires the agency to review the rules required by the law every five years. While the agency declined to make changes in 2005 when it first reviewed the rules for Web sites aimed at children under 13, the FTC said it now "believes that changes to the online environment over the past five years, including but not limited to children's increasing use of mobile technology to access the Internet, warrant reexamining the rule at this time."

In addition to parental consent, the current FTC rules imposed under COPPA also require Web sites aimed at children under 13 to secure the information they collect from children and bars them from requiring children to provide more information than is "reasonably necessary to participate" in activities provided on the site.

In its request for comments, which are due by June 30, the FTC is asking for input on such issues as whether the definition of "Internet" should be expanded to include mobile communications, interactive television and gaming and other activities and whether the defition of "personal information" also should be expanded to include persistent IP addresses, mobile geolocation data or information used to help target ads at specific Internet users. Other issues, the FTC is seeking comment on include whether changes should be made to the requirements that information be kept secure and private; the requirement that allows parents to review or delete personal information about their children; and on the provision barring the linking of participation in activities on a children's Web site to the collection of personal information.

Industry Coalition Urges Congress To Update 24-Year-Old Electronic Privacy Act

A coalition of Web companies including Google, AOL and Microsoft, along with digital rights groups like the Electronic Frontier Foundation, are calling on Congress to enact new online privacy protections.

The organizations have formed the group, Digital Due Process, which is urging lawmakers to protect information that is not generally accessible by the public, including emails, some photos and videos, cell phone location data, and even search queries. Specifically, the coalition argues that such information should remain private unless courts issue search warrants for it.

The Electronic Privacy Communications Act already says that Internet service providers can't disclose some data without search warrants, including many emails that are less than 180 days old. But the 1986 statute does not appear to cover much of the data that users currently store online.

In some circumstances, the government can obtain access to material uploaded by users simply by issuing subpoenas -- which are easier to obtain than search warrants. In general, courts require that officials have probable cause of criminal activity to obtain a search warrant, but will issue subpoenas as long as the information requested is considered "relevant" to an investigation.

Google's Richard Salgado, senior counsel for law enforcement and information security, says that updating the law will provide some needed clarity in the space. "It will be much easier to keep our users informed about how their data is protected from disclosure to the government," he says.

Although the Electronic Communications Privacy Act is somewhat dated, its provisions banning ISPs from disclosing some data have been used by consumers in lawsuits alleging privacy violations by online companies. Currently, social networking sites Classmates.com and Facebook are facing lawsuits alleging violations of the ECPA.

In addition, when consumers filed a potential class-action privacy lawsuit against behavioral targeting company NebuAd and its Internet service provider partners, the consumers alleged that the companies had violated the law by using data about users' Web-surfing activity to serve them ads.

FTC To Consider New Restrictions On Collecting Data From Children

The Federal Trade Commission said Wednesday that it's seeking input from the public about whether to broaden regulations aimed at preserving children's privacy online.

The last time the FTC issued regulations regarding the federal Children's Online Privacy Protection Act was in 2000. The commission said it's now considering revamping the regulations due to "changes to the online environment ... including children's increasing use of mobile technology to access the Internet."

The 12-year-old Children's Online Privacy Protection Act prohibits companies from collecting personal information from children younger than 13 without their parents' consent. In a notice published in the Federal Register, the FTC specifically asks how the regulations regarding that law should apply to new platforms, including mobile, interactive TV and interactive gaming.

The commission also says it's considering whether the definition of "personal information" should be expanded to include "persistent IP addresses, mobile geolocation information or information collected in connection with online behavioral advertising."

That language is yet another sign that the FTC is concerned that even supposedly non-personally identifiable information -- that is, data other than name, address, phone numbers, etc. -- could be used to identify specific users. Last year, the FTC said in suggested guidelines for behavioral targeting that clickstream data potentially could be tied back to particular users.

Privacy advocate Jeff Chester, executive director of the Center for Digital Democracy, says he supports a ban on the use of behavioral targeting techniques on commercial sites geared toward children. "The agency must bring its regulations on COPPA up to date, including specifically prohibiting the use of cookies and other techniques that track, profile and target kids on children's commercial sites," he said.

Chester also said that advocates have asked the FTC to specifically address efforts to collect data from TV viewers.