Risk
2/22/2011
12:54 PM
50%
50%

FTC Internet Privacy Proposal Slammed By Ad Industry

“Do Not Track” settings planned by the Federal Trade Commission may not go far enough according the Center for Digital Democracy and U.S. Public Interest Research Group.

Google Chrome 9 Advances The 3D Graphical Web
(click image for larger view)
Slideshow: Google Chrome 9 Advances The 3D Graphical Web

Will the future see a "Do Not Track" setting in browsers that prevents data brokers and Web sites from tracking a consumer's every click?

In December, the Federal Trade Commission made that recommendation when it released "Protecting consumer privacy in an era of rapid change: A proposed framework for businesses and policymakers." In the proposal, released for public comment, the FTC said that the previous approach, in which industry groups could self-regulate by setting and disclosing their own privacy policies, had failed.

"Current privacy policies force consumers to bear too much burden in protecting their privacy," said the FTC. Furthermore, it warned that more advanced technologies were enabling "rapid data collection and sharing that is often invisible to consumers."

Industry groups, however, have slammed the FTC's proposal, suggesting it would wreck the ability of Web sites to provide personalized content. "The Internet is comprised of millions of interconnected Web sites, networks and computers -- a literal ecosystem, all built upon the flow of different types of data," according to a statement released by the Interactive Advertising Bureau (IAB). "To create a Do Not Track program would require reengineering the Internet's architecture." Instead, it suggested a new self-regulated program for online behavioral advertising.

But consumer rights groups have been arguing differently. The Center for Digital Democracy and U.S. Public Interest Research Group (PIRG) on Friday released a statement recommending that the FTC require that all surveillance technologies in use be disclosed. It also wants people to be allowed to view and correct the data collected about them, in addition to a Do Not Track feature.

On Friday, the Privacy Rights Clearinghouse (PRC) released similar recommendations, including what it calls a "one-stop opt-out process" for consumers. According to the PRC, there are currently at least 133 data brokers in the United States, all of which have different procedures -- or offer no option -- for consumers to opt out. Some organizations also put hurdles in place, such as requiring consumers to mail a copy of their driver's license together with any opt-out request, while others have levied a fee.

Legislation would be a crucial component of any Do Not Track feature, since the FTC can't create laws, but only advise Congress. Earlier this month, however, Rep. Jackie Speier (D-Calif.) introduced a bill that would require the FTC to develop Do Not Track standards, and give it the power to enforce companies' compliance with those regulations.

What would a Do Not Track approach look like to consumers? The three major browser developers are creating their own strategies: Mozilla Firefox 4 uses a Do Not Track header that gets transmitted to any Web site visited. Microsoft Internet Explorer 9 allows for user-created Tracking Protections Lists that forcibly block tracking via the browser. Google Chrome, meanwhile, provides a "Keep My Opt-Outs" extension that alerts any companies that are members of the National Advertising Initiative to not track that user.

PRC endorsed the Firefox approach to "do not track," citing its "simplicity for the user as well as being universal and persistent," and noted that together with legislation, it would be the toughest approach for data brokers to circumvent.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8015
Published: 2014-12-22
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.

CVE-2014-8017
Published: 2014-12-22
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.

CVE-2014-8018
Published: 2014-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur1...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.