Risk
2/22/2011
12:54 PM
50%
50%

FTC Internet Privacy Proposal Slammed By Ad Industry

“Do Not Track” settings planned by the Federal Trade Commission may not go far enough according the Center for Digital Democracy and U.S. Public Interest Research Group.

Google Chrome 9 Advances The 3D Graphical Web
(click image for larger view)
Slideshow: Google Chrome 9 Advances The 3D Graphical Web

Will the future see a "Do Not Track" setting in browsers that prevents data brokers and Web sites from tracking a consumer's every click?

In December, the Federal Trade Commission made that recommendation when it released "Protecting consumer privacy in an era of rapid change: A proposed framework for businesses and policymakers." In the proposal, released for public comment, the FTC said that the previous approach, in which industry groups could self-regulate by setting and disclosing their own privacy policies, had failed.

"Current privacy policies force consumers to bear too much burden in protecting their privacy," said the FTC. Furthermore, it warned that more advanced technologies were enabling "rapid data collection and sharing that is often invisible to consumers."

Industry groups, however, have slammed the FTC's proposal, suggesting it would wreck the ability of Web sites to provide personalized content. "The Internet is comprised of millions of interconnected Web sites, networks and computers -- a literal ecosystem, all built upon the flow of different types of data," according to a statement released by the Interactive Advertising Bureau (IAB). "To create a Do Not Track program would require reengineering the Internet's architecture." Instead, it suggested a new self-regulated program for online behavioral advertising.

But consumer rights groups have been arguing differently. The Center for Digital Democracy and U.S. Public Interest Research Group (PIRG) on Friday released a statement recommending that the FTC require that all surveillance technologies in use be disclosed. It also wants people to be allowed to view and correct the data collected about them, in addition to a Do Not Track feature.

On Friday, the Privacy Rights Clearinghouse (PRC) released similar recommendations, including what it calls a "one-stop opt-out process" for consumers. According to the PRC, there are currently at least 133 data brokers in the United States, all of which have different procedures -- or offer no option -- for consumers to opt out. Some organizations also put hurdles in place, such as requiring consumers to mail a copy of their driver's license together with any opt-out request, while others have levied a fee.

Legislation would be a crucial component of any Do Not Track feature, since the FTC can't create laws, but only advise Congress. Earlier this month, however, Rep. Jackie Speier (D-Calif.) introduced a bill that would require the FTC to develop Do Not Track standards, and give it the power to enforce companies' compliance with those regulations.

What would a Do Not Track approach look like to consumers? The three major browser developers are creating their own strategies: Mozilla Firefox 4 uses a Do Not Track header that gets transmitted to any Web site visited. Microsoft Internet Explorer 9 allows for user-created Tracking Protections Lists that forcibly block tracking via the browser. Google Chrome, meanwhile, provides a "Keep My Opt-Outs" extension that alerts any companies that are members of the National Advertising Initiative to not track that user.

PRC endorsed the Firefox approach to "do not track," citing its "simplicity for the user as well as being universal and persistent," and noted that together with legislation, it would be the toughest approach for data brokers to circumvent.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?