Risk
2/22/2011
12:54 PM
Connect Directly
RSS
E-Mail
50%
50%

FTC Internet Privacy Proposal Slammed By Ad Industry

“Do Not Track” settings planned by the Federal Trade Commission may not go far enough according the Center for Digital Democracy and U.S. Public Interest Research Group.

Google Chrome 9 Advances The 3D Graphical Web
(click image for larger view)
Slideshow: Google Chrome 9 Advances The 3D Graphical Web

Will the future see a "Do Not Track" setting in browsers that prevents data brokers and Web sites from tracking a consumer's every click?

In December, the Federal Trade Commission made that recommendation when it released "Protecting consumer privacy in an era of rapid change: A proposed framework for businesses and policymakers." In the proposal, released for public comment, the FTC said that the previous approach, in which industry groups could self-regulate by setting and disclosing their own privacy policies, had failed.

"Current privacy policies force consumers to bear too much burden in protecting their privacy," said the FTC. Furthermore, it warned that more advanced technologies were enabling "rapid data collection and sharing that is often invisible to consumers."

Industry groups, however, have slammed the FTC's proposal, suggesting it would wreck the ability of Web sites to provide personalized content. "The Internet is comprised of millions of interconnected Web sites, networks and computers -- a literal ecosystem, all built upon the flow of different types of data," according to a statement released by the Interactive Advertising Bureau (IAB). "To create a Do Not Track program would require reengineering the Internet's architecture." Instead, it suggested a new self-regulated program for online behavioral advertising.

But consumer rights groups have been arguing differently. The Center for Digital Democracy and U.S. Public Interest Research Group (PIRG) on Friday released a statement recommending that the FTC require that all surveillance technologies in use be disclosed. It also wants people to be allowed to view and correct the data collected about them, in addition to a Do Not Track feature.

On Friday, the Privacy Rights Clearinghouse (PRC) released similar recommendations, including what it calls a "one-stop opt-out process" for consumers. According to the PRC, there are currently at least 133 data brokers in the United States, all of which have different procedures -- or offer no option -- for consumers to opt out. Some organizations also put hurdles in place, such as requiring consumers to mail a copy of their driver's license together with any opt-out request, while others have levied a fee.

Legislation would be a crucial component of any Do Not Track feature, since the FTC can't create laws, but only advise Congress. Earlier this month, however, Rep. Jackie Speier (D-Calif.) introduced a bill that would require the FTC to develop Do Not Track standards, and give it the power to enforce companies' compliance with those regulations.

What would a Do Not Track approach look like to consumers? The three major browser developers are creating their own strategies: Mozilla Firefox 4 uses a Do Not Track header that gets transmitted to any Web site visited. Microsoft Internet Explorer 9 allows for user-created Tracking Protections Lists that forcibly block tracking via the browser. Google Chrome, meanwhile, provides a "Keep My Opt-Outs" extension that alerts any companies that are members of the National Advertising Initiative to not track that user.

PRC endorsed the Firefox approach to "do not track," citing its "simplicity for the user as well as being universal and persistent," and noted that together with legislation, it would be the toughest approach for data brokers to circumvent.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-3518
Published: 2014-07-22
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to exec...

CVE-2014-3530
Published: 2014-07-22
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.