Progress & Freedom Foundation Podcasts

PFF Event Recap: Nuts & Bolts of Online Privacy, Advertising, Notice & Choice

bszoka@pff.org (The Progress & Freedom Foundation)

We had a great discussion yesterday about the technical underpinnings of the ongoing privacy policy debate in light of the discussion draft of privacy legislation recently released by Chairman Rick Boucher (see PFF's initial comments here and here). I moderated a free-wheeling discussion among terrific panel consisting of:

Lorrie Faith Cranor, Associate Professor, Computer Science, Engineering & Public Policy at Carnegie Mellon University; director of the CyLab Usable Privacy and Security Laboratory

Ari Schwartz, Vice President & Chief Operating Officer, Center for Democracy & Technology

Shane Wiley, Senior Director, Privacy & Data Governance, Yahoo!

Here's the audio (video to come!)

Ari got us started with an intro to the Boucher bill and Shane offered an overview of the technical mechanics of online advertising and why it requires data about what users do online. Lorrie & Ari then talked about concerns about data collection, leading into a discussion of the challenges and opportunities for empowering privacy-sensitive consumers to manage their online privacy without breaking the advertising business model that sustains most Internet content and services. In particular, we had a lengthy discussion of the need for computer-readable privacy disclosures like P3P (pioneered by Lorrie & Ari) and the CLEAR standard developed by Yahoo! and others as a vital vehicle for self-regulation, but also an essential ingredient in any regulatory system that requires that notice be provided of the data collection practices of all tracking elements on the page.

For more info, check out:

Ari's recent paper Looking Back at P3P: Lessons for the Future

Lorrie's work on P3P Deployment on Websites and Standardizing Privacy Notices: An Online Study of the Nutrition Label Approach.

The IAB/NAI Technical Specifications for CLEAR Ad Notice (Control Links for Education and Advertising Responsibly)

In particular, we touched on the critical question raised by the Boucher bill: Will website publishers be required to disclose the data collection practices of all parties they allowed to collect data from thei webpages? While it is commonly said that websites "share" information with advertisers (a view seemingly implied by the Boucher bill), in fact, it would be more accurate to say that website publishers simply allow third parties to load tracking elements on their pages, and as a technical matter, they have no way of knowing definitively who all the data collectors on their page might be, let alone what their particular data collection and privacy practices are--not just for behavioral advertising, but for the basic reporting, analytics, conversion optimization, sequencing, frequency capping, and other techniques that make online ads profitable for publishers (thus supporting more free content and services) and also more relevant to users. More on this to come!

PFF TechCast #5: Concerns about the Boucher-Stearns Privacy Bill

bszoka@pff.org (The Progress & Freedom Foundation)

Adam Thierer & I offered our initial thoughts upon first reading the discussion draft of the privacy bill introduced by Rep. Rick Boucher (D-VA) & Cliff Stearns (R-FL). In PFF's latest TechCast, I sat down to discuss the bill and my concerns about it with PFF's VP for Communications, Mike Wendy:

Stay tuned for more from us on this. PFF plans to file written comments, as solicited by the bill's authors, by June 4. For more on this, check out our comments to the FTC last December on these issues.

Subscribe now to PFF's TechCast podcast (generally 5-8 minutes) by RSS or through iTunes!

PFF TechCast #4: Senate Testimony on the Children's Online Privacy Protection Act (COPPA)

bszoka@pff.org (The Progress & Freedom Foundation)

I'm testifying this morning before the Senate Commerce Committee's Consumer Protection Subcommittee on Examining Children's Privacy: New Technologies and the Children's Online Privacy Protection Act at 10 am in 253 Russell. I offered an overview of my testimony in a PFF TechCast interview yesterday.

MP3 file: PFF TechCast #4 - Senate COPPA testimony of Berin Szoka

My pre-scripted oral testimony (PDF) follows below, but you can download my somewhat longer written testimony here, which offers an overview of our past work on this subject at PFF, particularly the paper Adam Thierer and I published last summer COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech.

________________________

Mr. Chairman and Committee members, thank you for inviting me here today. My name is Berin Szoka.^[1] I'm a Senior Fellow at The Progress & Freedom Foundation. I commend this Committee for studying COPPA, and the FTC for its upcoming COPPA Review and Roundtable.^{^[2]}

Background on COPPA

For an "Internet Jr." of sites "directed at" children under 13, COPPA requires sites either to age-verify all users or limit functionality to prevent children from making personal information "publicly available"--including the sharing of user-generated content. COPPA imposes the same requirement on general audience sites when they have actual knowledge a user is under 13. Because of this forced separation and the costs of age verification, COPPA may well have unintentionally limited choice and competition by driving increased consolidation in the marketplace for child-oriented sites and services online. On the other hand, COPPA has been reasonably successful in fulfilling Congress's original goal of "enhancing parental involvement" to protect children's online privacy and safety.

Whatever this trade-off, I'm here today to caution against expanding COPPA beyond its original, limited purpose. COPPA's unique value lies in its flexibility, subtlety, and intentional narrowness.

COPPA is flexible because it potentially applies to the entire Internet regardless of the access device used--including services scarcely imaginable in 1998.

COPPA is subtle because it requires "verifiable parental consent" not only if site and service operators gather personal information from kids for their own use, but also if sites enable children to make personal information "publicly available" online. Even more subtle is COPPA's creative solution to the thorny problem of age verification. Unlike the similarly-named Child Online Protection Act,^{^[3]} COPPA only requires age verification of users on sites clearly directed at children, whereas COPA required it for any site offering content deemed "harmful to minors."

Efforts to Expand COPPA Raise Serious First Amendment Concerns

Back in 1998, Congress wisely chose not to apply COPPA to adolescents. Unfortunately, recent efforts to expand COPPA have put online privacy, child safety, free speech and anonymity on a collision course. Several states have proposed what we at PFF have called "COPPA 2.0" laws, extending COPPA to adolescents under 17 or 18. But once the age threshold rises above 13, it becomes increasingly difficult to distinguish sites "directed at" children below the threshold from general audience sites. With this seemingly small change, COPPA would essentially converge with COPA: COPPA would extend beyond a discrete "Internet, Jr." to require age verification for sites used by many adults--and, indeed, other states have proposed simply extending COPPA to all social networking sites. But requiring adults and even older teens to prove their age by identifying themselves constitutes a prior restraint on anonymous or pseudonymous communication. This raises the same First Amendment concerns that caused the courts to strike down COPA.

COPPA Expansion Would Undermine Privacy

Ironically, broad age verification mandates would reduce online privacy by requiring more information to be collected from both adolescents and adults, including credit card information. While COPPA's safe harbors play a valuable role in administering self-regulation under COPPA,^{^[4]} government shouldn't put them in the awkward position of becoming repositories for huge troves of personal information in the name of protecting privacy.

COPPA Expansion Would Not Enhance Child Safety

Nor would COPPA expansion make adolescents safer online. Some have argued that age verification mandates could protect children by allowing sites to create "safe spaces" that exclude predators. Unfortunately, the reality is that the technology for reliable age verification simply doesn't exist. Even the FTC has made clear that it doesn't consider COPPA's verifiable parental consent methods, such as use of a credit card,^{^[5]} as equivalent to strict age verification.^{^[6]}

Fears of Advertising Should Not Drive COPPA Expansion

COPPA expansion could also undermine the viability of many online sites and services. Some consider marketers the "real predators"--even though advertising is the great "Hidden Benefactor"^{^[7]} that funds the overwhelming majority of "free" Internet content and services. COPPA already applies to the collection of information that could potentially allow the contacting of a child under 13. The Network Advertising Initiative already requires verifiable parental consent for behavioral advertising to children under 13. But if COPPA were expanded to require general audience sites funded by tailored advertising to age-verify all users, it would devolve into the unconstitutional approach found in COPA. Importantly, COPPA expansion would also raise costs for smaller or new sites and services geared toward minors. This could discourage new innovation, limit choice, and raise prices for consumers.^{^[8]}

Ultimately, concerns about tailored advertising may be less about privacy than about what advertising scholar Jack Calfee has dubbed the "Fear of Persuasion"--the idea that advertising is inherently manipulative and only grows more so with increased relevance. But as Calfee notes, "by the age 10 or so, children develop a full understanding of the purpose of advertising and equally important, an active suspicion of what advertisers say."^{^[9]} If government has a role to play in addressing concerns about tailored marketing, it lies in educating kids about advertising to help them become smarter consumers. Last week, the FTC launched just such an education campaign with its AdMongo tutorial website (www.admongo.gov).[10] The FTC excels in consumer education, and should be encouraged in these efforts as a less restrictive alternative to regulation.^{^[11]}

Opening the Door to COPPA Expansion through FTC Overhaul via Financial Reform

Finally, financial reform legislation recently passed by the House would give the FTC sweeping new rulemaking powers. H.R. 4173 would allow the FTC to unilaterally change COPPA, including its age range. Such decisions should be made by Congress, not the FTC. If Congress wants to help the FTC implement COPPA, it should consider additional funding for education and enforcement.

Thank you again for inviting me here to testify.

[1] The views expressed here are his own, and not necessarily the views of the PFF board, other fellows or staff.

[2] Federal Trade Commission, Request for Public Comment on the FTC's Implementation of the Children's Online Privacy Protection Rule, April 5, 2010, http://www.ftc.gov/os/2010/03/100324coppa.pdf; see also COPPA Rule Review Roundtable, http://www.ftc.gov/bcp/workshops/coppa/index.shtml.

[3] 47 U.S.C. § 231.

[4] See Federal Trade Commission, Safe Harbor Program, www.ftc.gov/privacy/privacyinitiatives/childrens_shp.html.

[5] Under the FTC's "sliding scale" approach to obtaining parental consent, other acceptable methods include print-and-fax forms, follow-up phone calls and e-mails, and using encryption certificates. 16 C.F.R. § 312.5(b)(2).

[6] In a February 2007 report to Congress about the status of the law and its enforcement, the FTC said that no changes to COPPA were then necessary because the law had "been effective in helping to protect the privacy and safety of young children online." Federal Trade Commission, Implementing the Children's Online Privacy Protection Act: A Report to Congress at 1, Feb. 2007, www.ftc.gov/reports/coppa/07COPPA_Report_to
_Congress.pdf. In discussing the effectiveness of the parental consent verification methods authorized in the FTC's sliding scale approach, however, the agency acknowledged that "none of these mechanisms is foolproof." Id. at 13. The FTC attempts to distinguish these parental consent verification methods from other kinds of age verification tools in noting that "age verification technologies have not kept pace with other developments, and are not currently available as a substitute for other screening mechanisms." Id. at 12.

[7] Adam Thierer & Berin Szoka, The Hidden Benefactor: How Advertising Informs, Educates & Benefits Consumers, Progress on Point 6.5, Feb. 2010, www.pff.org/issues-pubs/ps/2010/pdf/ps6.5-the-hidden-benefactor.pdf.

[8] In 2005, the FTC has cited an estimate of $45/child as the cost of obtaining verifiable parental consent for child-oriented sites to comply with COPPA. See Comments of Parry Aftab, Request for Public Comment on the Implementation of COPPA and COPPA Rule's Sliding Scale Mechanism for Obtaining Verifiable Parental Consent Before Collecting Personal Information from Children at 2, June 27, 2005, www.ftc.gov/os/comments/COPPArulereview/516296-00021.pdf.

[9]/a>Jack Calfee Fear of Persuasion: A New Perspective on Advertising and Regulation, 59 (1997).

[10] Federal Trade Commission to Launch Advertising Literacy Campaign National Program Gives 'Tweens' Ages 8 to 12 Skills to Recognize, Understand Advertising, April 26, 2010, www.ftc.gov/opa/2010/04/admongo.shtm.

[11] See, e.g., onguardonline.gov; NetCetera: Chatting With Kids About Being Online, onguardonline.gov/pdf/
tec04.pdf; You Are Here: Where Kids Learn to be Smarter Consumers, ftc.gov/youarehere/.

PFF TechCast #3: Media Vouchers & Postal Subsidies as Media Reinvention Tools

athierer@pff.org (The Progress & Freedom Foundation)

In this latest PFF TechCast, Berin Szoka and I discuss the two latest installments in our ongoing "Wrong Way to Reinvent Media" series. These two recent installments dealt with "media vouchers" and expanded postal subsidies as methods of assisting struggling media enterprises or promoting more hard news. In this 7-minute podcast, PFF's press director Mike Wendy chats with us about these proposals and we argue that they both raise a variety of practical and principled concerns that weigh against their adoption by policymakers.

MP3 file: PFF TechCast #3 - Media Vouchers & Postal Subsidies (4/27/2010)

PFF TechCast #2: "Saving the Media" through Broadcast Spectrum Taxes

mwendy@pff.org (The Progress & Freedom Foundation)

In this TechCast, Adam Thierer discusses the second essay in a series, entitled, "The Wrong Way to Reinvent Media, Part 2: Spectrum Taxes to Subsidize Public Media."

MP3 file: PFF TechCast #2 - Saving the Media Through Broadcast Spectrum Taxes (4/5/2010)

PFF TechCast #1: Proposals to Have Government "Save Media"

athierer@pff.org (The Progress & Freedom Foundation)

PFF recently started a new "TechCast" podcast series and the topic for one of our first episodes was about the new series of essays that we have coming out about "The Wrong Way to Reinvent Media." In this series, we're examining proposals that would have the government play a greater role in sustaining struggling media enterprises, "saving journalism," or promoting more "public interest" content. We're concerned about the prospect of central planning for media or a "public option" for the press.

Berin Szoka and I recently sat down with PFF's press director Mike Wendy to chat about our concerns in this brief 5-minute podast:

MP3 file: PFF TechCast #1 - Overview of Wrong Way to Reinvent Media Series (3-28-2010)

Transcript of 7/27 PFF Event on Child Safety, Privacy, and Free Speech

athierer@pff.org (The Progress & Freedom Foundation)

On July 27th, The Progress & Freedom Foundation hosted a Capitol Hill panel discussion entitled "Online Child Safety, Privacy, and Free Speech: An Overview of Challenges in Congress & the States." The event featured remarks from:

Parry Aftab, Executive Director, WiredSafety.org

Todd Haiken, Senior Manager of Policy, Common Sense Media

Jim Halpert, Partner, DLA Piper

Berin Szoka, Senior Fellow, The Progress & Freedom Foundation

We've just released the transcript of the event, which I have also pasted down below the fold in a Scribd document reader. Also, the audio for this event can be heard by clicking below:

Download mp3

Here is the full event description:

Online child safety, privacy, and free speech remain hotly debated issues at both the federal and state level. Bills introduced in Congress to address cyberbullying concerns propose either educational initiatives or a criminalization approach. Access to objectionable content also remains a concern and a new, government-mandated task force is looking into those issues. Meanwhile, state officials, including many state attorneys general, continue to explore age verification mandates for social networking sites and some have considered building on the federal Children's Online Privacy Protection Act (COPPA) to expand "parental notification" mandates. The Federal Trade Commission (FTC) has recently announced an expedited review of COPPA to see if it is keeping up with new developments. The FTC is also exploring child safety in virtual worlds. New concerns about "sexting," or the sending of sexual explicit images over mobile devices, has also raised new concerns led some lawmakers to ponder penalties.

How serious are these concerns? Is legislation or regulation needed to address them? What free speech issues are at stake? Should Congress take the lead or leave it to the States to experiment with different models? These and other issues were discussed by a panel of leading experts in the field of online safety and privacy policy.

Transcript PFF Online Child Safety Privacy Hill Event (7-27-2009)