Sign In
    Wisconsin Lawyer
    February 01, 2001

    Wisconsin Lawyer February 2001: A Primer on Online Privacy

    A Primer on Online Privacy

    Internet users often disclose (both voluntarily and involuntarily) large amounts of personal data. Governmental entities, companies, and consumers have questioned what legal constraints exist to the gathering, storing, and use of computer users' personal information that is collected via the Internet. Here is a brief look at how personal data is collected, distributed, and monitored and the efforts to regulate and enforce the collectors of such data.

    Sidebars:

    by John L. Barlament

    A Primer on Online PrivacyOver the past several years, tens of millions of United States citizens have flocked to the Internet for both personal and business reasons. While much of the law governing online privacy has yet to be written, some general principles have emerged.

    First, the United States federal government and several states have taken differing positions on how consumers' online privacy can best be protected. This jurisdictional conflict could lead to problems for businesses that collect user data over the Internet.

    Second, in contrast to the United States' quiltwork of privacy laws, the European Union (EU) has implemented a standardized policy for collecting, distributing, and monitoring consumer information. The EU's explicit guidelines will force many U.S. companies with European operations or sales to conform to these guidelines, or at least a "safe harbor" version of these guidelines.

    Finally, the federal government's most significant attempt to regulate the collection of consumer information over the Internet, the Children's Online Privacy Protection Act (COPPA), has been ignored by many companies and has been onerous for those companies that have attempted to comply with it.

    How Data is Collected

    When computer users surf the World Wide Web (the Web), they may not surf alone. Internet service providers (ISPs), advertising companies, and companies that create and host Web sites use a variety of techniques to gather consumer information.

    Voluntarily provided information. Many ISPs and Web sites voluntarily request that users provide information about themselves for purposes of registration, participation in a survey or contest, or to make purchases. This information often includes the user's name, postal address, email address, age, and credit card information.

    Clickstream data. Many online services collect information when a user visits their site or the Web generally. This information can provide a virtual map of the user's travels through the Web and often includes information about the sites the user has visited, purchases the user has made, and the ads to which the user responded.

    IP address. When a user connects to the Internet, the user's ISP assigns the user's computer an Internet Protocol address (IP address). The IP address allows the user's computer to communicate with other computers on the Web. IP addresses often are gathered automatically by Web sites that the user visits. Thus, most companies that have a Web site collect some information about a user, although gathering the IP address does not raise significant privacy concerns because the IP address typically does not provide personally identifiable information.

    Cookies. "Cookies" are small bits of data that a Web page requests a "browser" (the software that allows the computer to surf the Web) to store on a user's computer. Cookies allow a Web site to remember users by storing files on their computers with a record of prior visits. This can be useful for consumers, because cookies allow the Web site to recognize users so that the users do not have to reinput certain data (such as names and passwords). Generally, cookies are not used to transmit the actual identity of the user.

    Web bugs. So-called "Web bugs" (also known as "clear GIFs") are a more advanced form of cookie. A Web bug is a nearly invisible graphic on a Web page or in an email message that is designed to monitor who is reading the Web page or email message. Some Internet advertising companies have created a network of Web sites on which to place Web bugs. The Web bugs can monitor a user as the user moves from site to site within the network.1 With Web bugs, once a computer user discloses personal information to any site in the Web bug network, that personal information could be shared with any other Web site in the Web bug network. Web bugs raise more privacy concerns than cookies because users often are unaware that they are potentially being monitored as they move from site to site. DoubleClick, a leading Internet advertiser, is said to have placed Web bugs on more than 60,000 different Web pages.2

    John L. BarlamentJohn L. Barlament, Duke 1997, is an associate in the Milwaukee office of Michael Best & Friedrich LLP. He practices in employee benefits and e-business.

    Who Watches the Web Watchers?

    The current system of regulating the collection of information online is a turf war of four competing parties: the federal government, industry leaders who urge self-regulation, state governments, and private individuals.

    Federal government and industry leaders in harmony. The Federal Trade Commission (FTC) recently endorsed a set of advertising industry self-regulatory guidelines developed with the Network Advertising Initiative, an association that includes most of the leading online advertising companies.3 The core principles of these guidelines are:

    1) Notice - Data collectors must disclose their information practices before collecting personal data from consumers;

    2) Choice - Consumers must be given options with respect to whether and how personal information collected from them may be used for purposes beyond those for which the information was provided;

    3) Access - Consumers should be able to review the data collected about them;

    4) Security - Data collectors must take reasonable steps to ensure that information collected from consumers is accurate and secure from unauthorized use; and

    5) Enforcement - The use of a reliable mechanism to identify and impose sanctions for noncompliance with these practices.4

    These principles have been harshly criticized by two leading privacy organizations.5 One of the main concerns of these organizations is that the principles often require individuals to "opt-out" of online profiling. Opting out of online profiling places a burden on computer users to affirmatively state that they do not want their personal information to be monitored or shared. The opt-out standard often is preferred by online advertising companies. The other standard, "opt-in," requires Web site operators to receive express permission from users before gathering or using the users' personal information.

    Even though the FTC has strongly supported industry self-regulation, the FTC has called for "backstop" legislation to ensure that consumers' privacy is protected online. Many members of Congress seem to agree that privacy legislation is needed; several privacy bills have been introduced recently.6 Until "backstop" (or broader) legislation is enacted, the scope of federal regulation and industry self-regulation will remain somewhat unclear.

    State and private individuals' efforts. State efforts to regulate the collection of users' information also is muddled. Wisconsin, like most states, has not passed laws specifically designed to protect the gathering and dissemination of personal data over the Internet. State attorneys general and private citizens have been eager to categorize certain Internet information-gathering techniques as violations of existing law. For example, Michigan's Attorney General has likened the placement of cookies on consumers' hard drives to "spying and wiretapping" and the use of Web bugs as a violation of Michigan's Consumer Protection Act.7 Additionally, at least one lawsuit filed by a private individual has accused Netscape (a subsidiary of America Online) of "eavesdropping" in violation of the federal Electronic Communications Privacy Act and the Computer Fraud and Abuse Act by using a cookie and other software to monitor users' downloads of particular files.8 Other individuals have brought lawsuits based on trespass, invasion of privacy, consumer protection, and anti-stalking laws.9

    Further action by states, including Wisconsin, could be occurring shortly. Gov. Tommy Thompson has appointed a task force on privacy that is reviewing some of the issues relating to online privacy.10 An official report from the task force is expected in early 2001.

    You have zero privacy anyway. Get over it.

    - Scott McNealy, CEO, Sun Microsystems (1999).

    Toysmart.com raises issues on effectiveness of regulation. The recent Toysmart.com controversy vividly illustrates the problems that can arise when industry self-regulation, federal agencies, and state attorneys general all become involved in the regulation of Internet privacy. Toysmart was an Internet-based retailer (with a significant ownership interest by The Walt Disney Company (Disney)) that sold games, books, and children-related toys. Toysmart experienced financial difficulty and filed for bankruptcy protection.11 While in business, Toysmart collected a great deal of personal information from its customers, including names, addresses, billing information, shopping preferences, and the names and birth dates of customers (including children). Toysmart's privacy policy had been approved by TRUSTe, a leader in the self-regulation industry and an organization that awards licenses to Web sites that satisfy its privacy policies. Toysmart's privacy policy stated that personal information would "never" be shared with a third party. Upon filing for bankruptcy, however, Toysmart quickly found that one of its largest assets was its customer list. Toysmart proposed to the bankruptcy court that the customer list be sold as a separate asset to pay creditors, despite the fact that Toysmart had promised to never sell the data to a third party.

    The FTC, TRUSTe, and attorneys general from 42 states (including Wisconsin) quickly petitioned the bankruptcy court to stop the sale of the personal information.12 The FTC negotiated with Toysmart and reached an agreement, whereby Toysmart would be allowed to sell the customer data if the data was sold with the company's name and Web site. The new owner of the data also had to engage in a similar business and agree to abide by Toysmart's privacy pledge.13 However, this settlement with the FTC did not resolve the concerns of the state attorneys general or TRUSTe.14 The attorneys general filed a motion with the bankruptcy court, insisting that Toysmart customers be notified before the sale of the data and given the chance to remove their information from the list. A subsidiary of Disney offered to purchase the customer list for $50,000 and then destroy the list.15 It is not clear whether this offer will satisfy the bankruptcy court, TRUSTe, or the state attorneys general.

    The upside of the Toysmart situation is that it clearly demonstrates a willingness on behalf of the federal government, states, and the industry's self-regulation organizations to attempt to protect consumer information. However, significant issues are raised by the Toysmart situation. How effective can TRUSTe be in bringing a lawsuit against a bankrupt corporation? What rights do Web users have to enforce a privacy policy that they may not even have seen or been aware of? When can businesses modify their Web site privacy policies? And, finally, should businesses be required to successfully navigate the laws of all 50 states (not to mention foreign jurisdictions) when they gather customer information online? Or, should a national, standardized law be implemented?

    The European Union Intervenes

    While various entities in the United States argue over who should regulate consumer data gathered over the Web, the European Union (EU) has already adopted a strong, standardized position on collecting, processing, and storing personal data that is transmitted via electronic means (which includes more than just information that is gathered over the Internet). European Union Directive 95/46/EC (the "Directive") was passed to aid and ensure the smooth transmission of personal data across national borders. The regulations under the Directive include:

    1) Personal data must be collected for specified, explicit, and legitimate purposes;

    2) Special categories of data (such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and health or sex life) require the data subject's explicit consent before the data can be shared with a third party or used in a manner for which it was not originally collected;

    3) The data collector must provide certain explanatory information to the data subject when the data is collected; and

    4) The data subject must be allowed to review and modify incorrect data.

    United States businesses noted that the Directive's jurisdiction section was broad enough to include them if they had any operations or sales in the EU. In an effort to help United States businesses comply with these requirements, the Commerce Department negotiated a "safe harbor" agreement with the EU.16 Under the safe harbor agreement, United States corporations can self-certify that they will comply with the Directive's requirements. United States corporations that currently collect or exchange personal data from EU member states had to comply with the safe harbor provisions by Nov. 1, 2000, or face the possibility that any electronic exchange of personal data from the EU to the United States will violate the Directive.

    It may be difficult for United States corporations conducting business in the EU to isolate U.S.-derived personal data from EU-derived personal data. These corporations may decide to adopt data protection standards for all personal data, not just EU-derived personal data. If so, the EU will have, in essence, caused many United States companies to conform to standards it considers adequate.

    The Federal Government Gets Serious: COPPA

    The right to be left alone - the most comprehensive of rights, and the right most valued by a free people.

    - Justice Louis Brandeis, Olmstead v. U.S., 277 U.S. 438 (1928)(in dissent).

    One area in which the federal government has followed the lead of the EU and passed strong rules is in the collection of children's personal information. Congress passed the Children's Online Privacy Protection Act (COPPA) in October 1998 to restrict how commercial Web site operators gather information from children under age 13. The FTC's rules implementing COPPA became effective April 21, 2000.

    COPPA places significant burdens on Web sites that are directed or targeted to children (including those that have a portion of their site targeted to children) and on general audience Web sites that have "actual knowledge" that they are dealing with a child or that a child is disclosing personal information.17 If a Web site falls under COPPA's rules, the Web site operator must obtain "verifiable parental consent" from the child's parent before collecting, using, or disclosing the child's personal information.

    The FTC has suggested methods for obtaining verifiable parental consent, including:

    1) providing a consent form that can be printed out, signed by the parent, and returned by postal mail or facsimile;

    2) requiring a parent to use a credit card to demonstrate adult status;

    3) having a parent call a toll-free number staffed by trained personnel to determine if the person is an adult;

    4) verifying a parent's digital signature using public key technology; and

    5) email approval accompanied by a PIN or password obtained through one of the above methods.18 Additionally, until April 21, 2002, companies that will be using a child's personal information for internal purposes may obtain consent using a parent's email address so long as this is coupled with an additional verification step such as a follow-up telephone call, letter, or email.

    COPPA offers limited exceptions to its parental consent requirements. No parental consent is required if the child's personal information is:

    1) contact information collected for the sole purpose of obtaining parental consent;

    2) contact information used on a one-time basis to respond to a specific request of the child;

    3) contact information used to respond on a repetitive basis to a single request and not for any other use (for example, if a child merely signs up for an email newsletter and the child's email address is not used for any other purpose); or

    4) certain other limited exceptions.19

    These rules can be costly to comply with, and they carry significant civil penalties: up to $11,000 per violation. The FTC recently issued a reminder that children's privacy issues are a "priority" for it.20 An FTC survey of sites that collect personally identifiable information from children found that one-half of these sites have "substantial compliance problems."21 The FTC filed a complaint against Toysmart for its collection of personal information from children, and it is likely that the FTC will increase its enforcement of COPPA.

    Conclusion

    The issues surrounding electronic collection, storage, and use of personal data collected through the Internet will only continue to grow. While the federal government has taken a strong position on protecting children's personal data, it remains to be seen whether other personal data will be regulated by the federal government, states, the computer or advertising industries, or outside influences such as the EU.

    Endnotes

    1 Robert O'Harrow Jr., "Fearing a Plague of 'Web Bugs,'" Washington Post, http://www.washingtonpost.com/wp-srv/business/feed/a60184-1999nov13.htm (Nov. 13, 1999); Dave Methvin, "Are You Being Bugged?," Winmag.com, http://www.winmag.com/fixes/webbugs.htm (Sept. 21, 1999).

    2 Electronic Privacy Information Center, Network Advertising Initiative: Principles Not Privacy, http://www.epic.org/privacy/internet/NAI_analysis.html (July 2000).

    3 Keith Perine, "FTC Approves Privacy Plan," The Industry Standard, http://www.thestandard.com/article/display/0,1151,17211,00.html (July 27, 2000).

    4 FTC, Online Profiling: Report to Congress, Part Two, Recommendations, http://www.ftc.gov/os/2000/07/onlineprofiling.htm (July 2000).

    5 Supra, note 2.

    6 The Electronic Privacy Information Center monitors many of these bills. See http://www.epic.org/privacy/bill_track.html.

    7 Chet Dembeck, "Online Privacy Inside and Out," EcommerceTimes, http://www.ecommercetimes.com/news/articles2000/000425-1a.shtml (April 25, 2000); Ann Harrison, "Michigan Charges Web Sites with Privacy Violations," Computer World, http://www.cnn.com/2000/TECH/computing/06/19/mich.web.idg/index.html (June 19, 2000).

    8 Keith Perine, "Lawsuit Says You Can't Escape Netscape," The Standard, http://www.thestandard.com/article/display/0,1151,16622,00.html (July 7, 2000).

    9 Charles L. Kerr, Oliver Metzger, "Online Privacy: Emerging Issues," 607 PLI/Pat 29 (June, 2000). So far, no published cases have reached the merits of these complaints by private individuals.

    10 Governor Announces Privacy Task Force Members, http://www.wisgov.state.wi.us/news/ap_detail.asp?prid=29 (Aug. 3, 1999).

    11 Elizabeth Blakely, "After the Toysmart Debacle," EcommerceTimes, http://www.ecommercetimes.com/news/articles2000/000725-1.shtml (July 25, 2000).

    12 See In re: Toysmart.com LLC (Br. Mass.) (Case No. 0013995-CJK), http://www.naag.org/features/Toysmart.htm; Jennifer Heldt Powell, "Customer Info Fight in Court," Boston Herald, http://www.bostonherald.com/business/technology/toy07212000.htm (July 21, 2000); Linda Rosencrance, "Web Privacy Organization Seeks to Block Toysmart Sale," Computer World, http://www.computerworld.com/cwi/story/frame/0,1213,NAV47_STO46729,00.html (July 6, 2000).

    13 FTC Announces Settlement With Bankrupt Web Site, Toysmart.com, Regarding Alleged Privacy Policy Violations. http://www.ftc.gov/opa/2000/07/toysmart2.htm (July 21, 2000); Heldt Powell, FTC Says Toysmart.com Can Sell Customer Data, http://www.bostonherald.com/business/technology/toys07222000.htm (July 22, 2000).

    14 Brian Krebs, Newsbytes, States Formally Object to Toysmart Settlement with FTC, http://www.newsbytes.com/pubNews/00/153220.html (Aug. 4, 2000).

    15 Settlement Made in Toysmart Case to Protect Customer Names, http://www0.mercurycenter.com/svtech/news/breaking/merc/docs/047839.htm (Jan. 9, 2001).

    16 See International Trade Administration Electronic Commerce Task Force, http://www.ita.doc.gov/td/ecom/menu.html (July 27, 2000).

    17 16 C.F.R. § 312.3 (1999).

    18 See id. at § 312.5(b).

    19 See id. at § 312.5(c).

    20 FTC, Web Sites Warned to Comply With Children's Online Privacy Law http://www.ftc.gov/opa/2000/07/coppacompli.htm (July 17, 2000).

    21 Id.


Join the conversation! Log in to comment.

News & Pubs Search

-
Format: MM/DD/YYYY