Initially, I became interested in the topic of consumer privacy after I read about interactive television and how it was used to gather and sell personal data from users of the service without their knowledge. Heck, I didn't even know that was possible. I guess I was naïve and should have realized it was bound to happen. Specifically, TiVo was tracking what a person watched on TV and selling it to advertisers to supplement ITV subscription fee revenues, without the person knowing. But they did this with great risk because consumers got wind of it and were concerned about the use of their personal information. For their part, TiVo was concerned that changes in their privacy policy could reduce demand for the their service, increase the cost of doing business as a result of litigation costs, and even harm their reputation and business. It was a classic privacy versus profits dilemma.
You, our ChipCenter visitors, have told us through these type articles that your privacy is important and your personal information should not be for sale and certainly should not be taken without your consent. (Which is why we don't offer it to anyone without your consent). I agree wholeheartedly with you, but the facts remain that personal information is harvested legally and illegally and sold to many willing buyers.
Why do companies put so much effort into acquiring this information? As you probably already know - it helps them to know their existing customers and find new customers. So, you can understand why it is important to the lifeblood of a company to gather data on their existing and potential customers. But these company goals are polar opposites of most consumers' desires to be anonymous. Like most people, I want to be unknown to all except those that I choose. I don't want to be bothered by businesses - except when I want to be contacted - and don't ask me when because I don't know. Let's face it, our needs change and we don't know when they will change. So that makes it okay for companies to gather as much personal data as they can and use it however they want, right? Wrong, but that's what happens. However, businesses aren't looking for you specifically, they're looking for a profile that you happen to fit, to help them target their advertising better. They take a compiled and culled list that meets their target market and insert advertisements on the appropriate web pages. It's a fact that individuals and companies benefit when the advertising is appropriate. But I want to know how I get off a list if I am no longer interested in the products defined by the list.
There are technologies available now, according to Economics and Law Professor Paul Rubin of Emory University, (in testimony before the House Subcommittee on Commerce, on March 1, 2001) that allow consumers to address their privacy concerns:
- Basic browsers now allow some customization with little effort. For example, Netscape allows a user four options with respect to cookies. Microsoft also offers some control.
- Other options allow control of cookies. For example, ZDNet Downloads offers many programs that allow control of cookies. These programs allow one to refuse certain cookies, or to delete cookies after they are received.
- There are also several services that allow anonymous surfing, including Anonymizer.com, IDZap.Com, iPrivacy.com, SafeWeb, SilentSurf.com, and others as well. These services offer different levels of control over information, depending on the your preferences and willingness to bear the 'inconvenience cost' of protecting information.
- American Express offers a "one-time" credit card number, good only for one purchase, designed for Internet use. Since Web sites selling products to consumers using this card never have access to information about the consumer, privacy is protected.
- The World Wide Web Consortium (W3C.org), an association of 505 members (as of February 26, 2002), including the largest players on the Internet, such as Microsoft, AOL Time Warner and Cisco, have drafted a major privacy protocol, the Privacy Preferences Project (P3P 1.0 Specification - Proposed Recommendation issued January 28, 2002). It is an automated way for users to gain more control over the use of personal information on Web sites they visit. At its most basic level, P3P is a standardized set of multiple-choice questions, covering all the major aspects of a Web site's privacy policies. Taken together, they present a clear snapshot of how a site handles personal information about its users. P3P-enabled Web sites make this information available in a standard, machine-readable format. P3P enabled browsers can "read" this snapshot automatically and compare it to the consumer's own set of privacy preferences. P3P enhances user control by putting privacy policies where users can find them, in a form users can understand, and, most importantly, enables users to act on what they see. Visit http://www.w3.org/P3P for more information.
Some countries like Australia and the members of the European Union (EU) are enacting privacy legislation that restricts the type of information businesses can collect about their customers and what they can sell to third parties. Although the U.S. Commerce Department is against making federal laws to enforce privacy concerns, expecting business to deal with the problem, it has made concessions to the EU by creating the "Safe Harbor" program. This was set up to appease the EU and help U.S. companies meet the stricter European privacy laws.
Should the U.S. do more? Some think that the government should stay away from making laws about privacy, especially for the Internet, and let business deal with the problem. And they're not entirely crazy for thinking that way. Some evidence suggests that voluntary standards in the U.S. work better than the mandatory ones in the EU. For example, according to an article by Ben Vickers in the Wall Street Journal (February 20, 2001), an opt-out clause is required for European websites but only 20% of them offer it, while in the U.S. 60% of the web sites offer it to consumers, by choice.
It has been observed by many that the Internet is fluid and organic. I've even heard it said that to be successful in the Internet space you have to be willing to make mistakes - but make them quickly, learn from them and move on.
It is because of its dynamic nature we should be careful about implementing rules for privacy on the Internet. "Any regulation at this time would freeze some aspects of the Internet in their current state. Even if the regulators were able to devise perfect regulations for today's environment, these regulations would quickly become obsolete as the Internet changes," said Professor Rubin. The P3P release 1.0 indicates that the drafters expected the privacy policies embedded in the document to change over time. "Change is the normal state of affairs for the Internet and for software and other products that interact with the Internet. Once an inefficient regulatory scheme is in place, however, it becomes very difficult to change," continued Professor Rubin.
The FTC has recommended that Congress pass a law regulating four aspects of privacy: Notice, Choice, Access and Security. "These may be the correct elements for a privacy policy to address. But they also may not be, and the FTC has not done the analysis necessary to show that they are," cautioned Rubin. If it should turn out that other policies are better, the Internet would nonetheless be locked into the FTC's choices. The FTC's desire that all Web sites structure their privacy policy in the terms dictated by the FTC would have the effect of freezing in place a particular policy.
Regulation of this sort is of necessity the "one size fits all" variety. Rubin says this might be justified if all consumers had similar or identical preferences. But, it is difficult to justify what are in essence mandatory product design regulations if preferences differ substantially, as is the case with respect to privacy. Some consumers view privacy protection as a good thing, but others welcomes the advertising information they receive when they give out information about themselves. As an industry source puts it, "What's an invasion of privacy to one consumer is a great deal to another." When preferences do differ in such significant ways, then some consumers must be harmed by regulation.
A recent book, "Privacy and the Commercial Use of Personal Information," by Paul H. Rubin and Thomas M. Lenard tackles the difficult issue about the government getting involved in regulating privacy. The authors say that basic public policy questions need to be answered before taking this route. Answers need to be determined for questions including:
- Are there "failures" in the market for personal information?
- If market failures exist, how do they adversely affect consumers?
- Can such failures be remedied by government regulation?
- Would the benefits of government regulation exceed the costs?
Electronic transmittal of information has led to a major reduction in the cost of information and therefore a major increase in the amount of information available to the economy. The investigation by Rubin and Lenard indicates that the economy works better when information is available easily and that any regulation that impedes that flow below an efficient amount will have a detrimental effect on the economy. They go on to say that data on individuals has been used by marketers and advertisers long before the Internet. But, the Internet has increased the flow of personal information and, in the process, raised the level of concern about privacy.
On the Internet, targeted advertising is accomplished by examining visitors' online activities, developing an understanding of their interests, and then matching and delivering relevant advertisements. This is accomplished, according to Rubin and Lenard by compiling the web browsing activities of the visitors and applying database technologies and statistical models that yield demographic and interest profiles. Advertisements relevant to their profiles are then inserted in the Web pages they visit.
This assumes that everything is working correctly. But there is widespread concern about privacy and perceptions that personal information may be subject to misuse. Rubin and Lenard contend that there is no evidence of harm to consumers from legal use of information for marketing and advertising purposes. However, the authors only cited one article from CNET that was a year-end summary of the year 2000 dealing with privacy issues. A study that did in-depth research would have made me more comfortable with their conclusion. To be fair, Rubin and Lenard only focused on misuse of advertising data, not illegal or surreptitious access of information.
There is one very powerful reason to allow the market to take care of misuse of personal data and that is reputation effects. Companies that violate consumer privacy will face a loss of reputation, and that translates into a loss of revenues and marketplace. I think your comments to the Avant! case (see "What Do You Think Should Happen in Avant! Case?"), underscore that point. As much as we may think otherwise, even giants like Microsoft has to pay attention to what its customers think. Look at their .Net My Services initiative. The company hopes it will become a "digital safe-deposit box" for hosting and delivering personal information, while providing an array of services ranging from commerce to communication with Web retailers. The company has visions that customers will pay fees that cover the bulk of the expense to run these one-stop services, and Microsoft would then manage passwords and other personal information. The company is having a hard time getting this initiative off the ground because potential users are not sure they want to trust Microsoft as the gatekeeper of all this personal information. They have good reason because the company has had security and privacy lapses with its MSN and Hotmail properties, and competitors as well as some state regulators warn against another monopoly. Simply put, people don't think Microsoft can be a trusted provider, and the company must overcome that image if they are to succeed in the new venture.
Trust is important to you and me when dealing with businesses. Trust is also high on the list of possible solution vendors. They realize that often times the needs of businesses to gather data about customers conflicts with the customer's desire for privacy. So, some companies like Demand Profiles Inc. (DEI), have developed a business process that captures data that marketing people call unfulfilled demand. Unfulfilled demand data is described by a buyer and given to a trusted brand. A demand profile is created from this information that describes the needs of a buyer, or purchase intent, but not their identity. Studies from publications such as the Harvard Business Review indicate that this is significantly more effective than demographic or behavioral profiles because it takes the guesswork out of determining who wants what.
An example best illustrates how this would work. A Web-based search engine, based on DPI's technology, is offered to buyers who visit a website, say, Yahoo. This permits visitors to search for their perfect job, date, home, car, vacation, product, and so on. This information is de-identified so that only Yahoo knows to whom the demand profiles belong. Two things make this search engine unique: (1) the item does not have to exist and (2) the search engine keeps looking even when the buyer is not online. The resulting demand profiles are then sold to merchants and advertisers who can then make relevant offers through Yahoo to its buyers in a way that guarantees the buyer's privacy. Demand profiles permit buyers to control their data after it has been sold to third parties. For example, these profiles have no value if stolen, hacked, or misused. The result, according to DPI, is that buyers get the privacy and convenience they need, merchants and advertisers get the data they need, and Yahoo gets the incremental revenue they need.
This is just one very creative way that the free market, when left to
its own devices, can come up with solutions where privacy and profits
can work together without the need for new laws. The intervention of the government would certainly slow or even prevent these type ideas from even surfacing. But I also like the idea of checks and balances where the government threatens intervention if the market doesn't respond to consumer needs. Let us know where you stand by voting in our poll.
Return to Poll
Analog Main | Product of the Week | Columns | Editorial | Tech Notes
