Risk
2/22/2011
12:54 PM
Connect Directly
RSS
E-Mail
50%
50%

FTC Internet Privacy Proposal Slammed By Ad Industry

“Do Not Track” settings planned by the Federal Trade Commission may not go far enough according the Center for Digital Democracy and U.S. Public Interest Research Group.

Google Chrome 9 Advances The 3D Graphical Web
(click image for larger view)
Slideshow: Google Chrome 9 Advances The 3D Graphical Web

Will the future see a "Do Not Track" setting in browsers that prevents data brokers and Web sites from tracking a consumer's every click?

In December, the Federal Trade Commission made that recommendation when it released "Protecting consumer privacy in an era of rapid change: A proposed framework for businesses and policymakers." In the proposal, released for public comment, the FTC said that the previous approach, in which industry groups could self-regulate by setting and disclosing their own privacy policies, had failed.

"Current privacy policies force consumers to bear too much burden in protecting their privacy," said the FTC. Furthermore, it warned that more advanced technologies were enabling "rapid data collection and sharing that is often invisible to consumers."

Industry groups, however, have slammed the FTC's proposal, suggesting it would wreck the ability of Web sites to provide personalized content. "The Internet is comprised of millions of interconnected Web sites, networks and computers -- a literal ecosystem, all built upon the flow of different types of data," according to a statement released by the Interactive Advertising Bureau (IAB). "To create a Do Not Track program would require reengineering the Internet's architecture." Instead, it suggested a new self-regulated program for online behavioral advertising.

But consumer rights groups have been arguing differently. The Center for Digital Democracy and U.S. Public Interest Research Group (PIRG) on Friday released a statement recommending that the FTC require that all surveillance technologies in use be disclosed. It also wants people to be allowed to view and correct the data collected about them, in addition to a Do Not Track feature.

On Friday, the Privacy Rights Clearinghouse (PRC) released similar recommendations, including what it calls a "one-stop opt-out process" for consumers. According to the PRC, there are currently at least 133 data brokers in the United States, all of which have different procedures -- or offer no option -- for consumers to opt out. Some organizations also put hurdles in place, such as requiring consumers to mail a copy of their driver's license together with any opt-out request, while others have levied a fee.

Legislation would be a crucial component of any Do Not Track feature, since the FTC can't create laws, but only advise Congress. Earlier this month, however, Rep. Jackie Speier (D-Calif.) introduced a bill that would require the FTC to develop Do Not Track standards, and give it the power to enforce companies' compliance with those regulations.

What would a Do Not Track approach look like to consumers? The three major browser developers are creating their own strategies: Mozilla Firefox 4 uses a Do Not Track header that gets transmitted to any Web site visited. Microsoft Internet Explorer 9 allows for user-created Tracking Protections Lists that forcibly block tracking via the browser. Google Chrome, meanwhile, provides a "Keep My Opt-Outs" extension that alerts any companies that are members of the National Advertising Initiative to not track that user.

PRC endorsed the Firefox approach to "do not track," citing its "simplicity for the user as well as being universal and persistent," and noted that together with legislation, it would be the toughest approach for data brokers to circumvent.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.