Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

FTC Internet Privacy Proposal Slammed By Ad Industry

“Do Not Track” settings planned by the Federal Trade Commission may not go far enough according the Center for Digital Democracy and U.S. Public Interest Research Group.

Google Chrome 9 Advances The 3D Graphical Web
(click image for larger view)
Slideshow: Google Chrome 9 Advances The 3D Graphical Web

Will the future see a "Do Not Track" setting in browsers that prevents data brokers and Web sites from tracking a consumer's every click?

In December, the Federal Trade Commission made that recommendation when it released "Protecting consumer privacy in an era of rapid change: A proposed framework for businesses and policymakers." In the proposal, released for public comment, the FTC said that the previous approach, in which industry groups could self-regulate by setting and disclosing their own privacy policies, had failed.

"Current privacy policies force consumers to bear too much burden in protecting their privacy," said the FTC. Furthermore, it warned that more advanced technologies were enabling "rapid data collection and sharing that is often invisible to consumers."

Industry groups, however, have slammed the FTC's proposal, suggesting it would wreck the ability of Web sites to provide personalized content. "The Internet is comprised of millions of interconnected Web sites, networks and computers -- a literal ecosystem, all built upon the flow of different types of data," according to a statement released by the Interactive Advertising Bureau (IAB). "To create a Do Not Track program would require reengineering the Internet's architecture." Instead, it suggested a new self-regulated program for online behavioral advertising.

But consumer rights groups have been arguing differently. The Center for Digital Democracy and U.S. Public Interest Research Group (PIRG) on Friday released a statement recommending that the FTC require that all surveillance technologies in use be disclosed. It also wants people to be allowed to view and correct the data collected about them, in addition to a Do Not Track feature.

On Friday, the Privacy Rights Clearinghouse (PRC) released similar recommendations, including what it calls a "one-stop opt-out process" for consumers. According to the PRC, there are currently at least 133 data brokers in the United States, all of which have different procedures -- or offer no option -- for consumers to opt out. Some organizations also put hurdles in place, such as requiring consumers to mail a copy of their driver's license together with any opt-out request, while others have levied a fee.

Legislation would be a crucial component of any Do Not Track feature, since the FTC can't create laws, but only advise Congress. Earlier this month, however, Rep. Jackie Speier (D-Calif.) introduced a bill that would require the FTC to develop Do Not Track standards, and give it the power to enforce companies' compliance with those regulations.

What would a Do Not Track approach look like to consumers? The three major browser developers are creating their own strategies: Mozilla Firefox 4 uses a Do Not Track header that gets transmitted to any Web site visited. Microsoft Internet Explorer 9 allows for user-created Tracking Protections Lists that forcibly block tracking via the browser. Google Chrome, meanwhile, provides a "Keep My Opt-Outs" extension that alerts any companies that are members of the National Advertising Initiative to not track that user.

PRC endorsed the Firefox approach to "do not track," citing its "simplicity for the user as well as being universal and persistent," and noted that together with legislation, it would be the toughest approach for data brokers to circumvent.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23381
PUBLISHED: 2021-04-18
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374
PUBLISHED: 2021-04-18
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23375
PUBLISHED: 2021-04-18
This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23376
PUBLISHED: 2021-04-18
This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23377
PUBLISHED: 2021-04-18
This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.