A Primer on Online Privacy
Internet users often disclose (both voluntarily and involuntarily)
large amounts of personal data. Governmental entities, companies, and
consumers have questioned what legal constraints exist to the gathering,
storing, and use of computer users' personal information that is
collected via the Internet. Here is a brief look at how personal data is
collected, distributed, and monitored and the efforts to regulate and
enforce the collectors of such data.
Sidebars:
by John L. Barlament
Over
the past several years, tens of millions of United States citizens have
flocked to the Internet for both personal and business reasons. While
much of the law governing online privacy has yet to be written, some
general principles have emerged.
First, the United States federal government and several states have
taken differing positions on how consumers' online privacy can best be
protected. This jurisdictional conflict could lead to problems for
businesses that collect user data over the Internet.
Second, in contrast to the United States' quiltwork of privacy laws,
the European Union (EU) has implemented a standardized policy for
collecting, distributing, and monitoring consumer information. The EU's
explicit guidelines will force many U.S. companies with European
operations or sales to conform to these guidelines, or at least a "safe
harbor" version of these guidelines.
Finally, the federal government's most significant attempt to
regulate the collection of consumer information over the Internet, the
Children's Online Privacy Protection Act (COPPA), has been ignored by
many companies and has been onerous for those companies that have
attempted to comply with it.
How Data is Collected
When computer users surf the World Wide Web (the Web), they may not
surf alone. Internet service providers (ISPs), advertising companies,
and companies that create and host Web sites use a variety of techniques
to gather consumer information.
Voluntarily provided information. Many ISPs and Web
sites voluntarily request that users provide information about
themselves for purposes of registration, participation in a survey or
contest, or to make purchases. This information often includes the
user's name, postal address, email address, age, and credit card
information.
Clickstream data. Many online services collect
information when a user visits their site or the Web generally. This
information can provide a virtual map of the user's travels through the
Web and often includes information about the sites the user has visited,
purchases the user has made, and the ads to which the user
responded.
IP address. When a user connects to the Internet, the user's
ISP assigns the user's computer an Internet Protocol address (IP
address). The IP address allows the user's computer to communicate with
other computers on the Web. IP addresses often are gathered
automatically by Web sites that the user visits. Thus, most companies
that have a Web site collect some information about a user, although
gathering the IP address does not raise significant privacy concerns
because the IP address typically does not provide personally
identifiable information.
Cookies. "Cookies" are small bits of data that a Web page
requests a "browser" (the software that allows the computer to surf the
Web) to store on a user's computer. Cookies allow a Web site to remember
users by storing files on their computers with a record of prior visits.
This can be useful for consumers, because cookies allow the Web site to
recognize users so that the users do not have to reinput certain data
(such as names and passwords). Generally, cookies are not used to
transmit the actual identity of the user.
Web bugs. So-called "Web bugs" (also known as "clear GIFs")
are a more advanced form of cookie. A Web bug is a nearly invisible
graphic on a Web page or in an email message that is designed to monitor
who is reading the Web page or email message. Some Internet advertising
companies have created a network of Web sites on which to place Web
bugs. The Web bugs can monitor a user as the user moves from site to
site within the network.1 With Web bugs,
once a computer user discloses personal information to any site in the
Web bug network, that personal information could be shared with any
other Web site in the Web bug network. Web bugs raise more privacy
concerns than cookies because users often are unaware that they are
potentially being monitored as they move from site to site. DoubleClick,
a leading Internet advertiser, is said to have placed Web bugs on more
than 60,000 different Web pages.2
John L. Barlament,
Duke 1997, is an associate in the Milwaukee office of Michael Best &
Friedrich LLP. He practices in employee benefits and e-business.
Who Watches the Web Watchers?
The current system of regulating the collection of information online
is a turf war of four competing parties: the federal government,
industry leaders who urge self-regulation, state governments, and
private individuals.
Federal government and industry leaders in harmony.
The Federal Trade Commission (FTC) recently endorsed a set of
advertising industry self-regulatory guidelines developed with the
Network Advertising Initiative, an association that includes most of the
leading online advertising companies.3 The
core principles of these guidelines are:
1) Notice - Data collectors must disclose their information practices
before collecting personal data from consumers;
2) Choice - Consumers must be given options with respect to whether
and how personal information collected from them may be used for
purposes beyond those for which the information was provided;
3) Access - Consumers should be able to review the data collected
about them;
4) Security - Data collectors must take reasonable steps to ensure
that information collected from consumers is accurate and secure from
unauthorized use; and
5) Enforcement - The use of a reliable mechanism to identify and
impose sanctions for noncompliance with these practices.4
These principles have been harshly criticized by two leading privacy
organizations.5 One of the main concerns of
these organizations is that the principles often require individuals to
"opt-out" of online profiling. Opting out of online profiling places a
burden on computer users to affirmatively state that they do not want
their personal information to be monitored or shared. The opt-out
standard often is preferred by online advertising companies. The other
standard, "opt-in," requires Web site operators to receive express
permission from users before gathering or using the users' personal
information.
Even though the FTC has strongly supported industry self-regulation,
the FTC has called for "backstop" legislation to ensure that consumers'
privacy is protected online. Many members of Congress seem to agree that
privacy legislation is needed; several privacy bills have been
introduced recently.6 Until "backstop" (or
broader) legislation is enacted, the scope of federal regulation and
industry self-regulation will remain somewhat unclear.
State and private individuals' efforts. State
efforts to regulate the collection of users' information also is
muddled. Wisconsin, like most states, has not passed laws specifically
designed to protect the gathering and dissemination of personal data
over the Internet. State attorneys general and private citizens have
been eager to categorize certain Internet information-gathering
techniques as violations of existing law. For example, Michigan's
Attorney General has likened the placement of cookies on consumers' hard
drives to "spying and wiretapping" and the use of Web bugs as a
violation of Michigan's Consumer Protection Act.7 Additionally, at least one lawsuit filed by a
private individual has accused Netscape (a subsidiary of America Online)
of "eavesdropping" in violation of the federal Electronic Communications
Privacy Act and the Computer Fraud and Abuse Act by using a cookie and
other software to monitor users' downloads of particular files.8 Other individuals have brought lawsuits based
on trespass, invasion of privacy, consumer protection, and anti-stalking
laws.9
Further action by states, including Wisconsin, could be occurring
shortly. Gov. Tommy Thompson has appointed a task force on privacy that
is reviewing some of the issues relating to online privacy.10 An official report from the task force is
expected in early 2001.
You have zero privacy anyway. Get over it.
- Scott McNealy, CEO, Sun Microsystems (1999).
Toysmart.com raises issues on effectiveness of
regulation. The recent Toysmart.com controversy vividly
illustrates the problems that can arise when industry self-regulation,
federal agencies, and state attorneys general all become involved in the
regulation of Internet privacy. Toysmart was an Internet-based retailer
(with a significant ownership interest by The Walt Disney Company
(Disney)) that sold games, books, and children-related toys. Toysmart
experienced financial difficulty and filed for bankruptcy protection.11 While in business, Toysmart collected a
great deal of personal information from its customers, including names,
addresses, billing information, shopping preferences, and the names and
birth dates of customers (including children). Toysmart's privacy policy
had been approved by TRUSTe, a leader in the self-regulation industry
and an organization that awards licenses to Web sites that satisfy its
privacy policies. Toysmart's privacy policy stated that personal
information would "never" be shared with a third party. Upon filing for
bankruptcy, however, Toysmart quickly found that one of its largest
assets was its customer list. Toysmart proposed to the bankruptcy court
that the customer list be sold as a separate asset to pay creditors,
despite the fact that Toysmart had promised to never sell the data to a
third party.
The FTC, TRUSTe, and attorneys general from 42 states (including
Wisconsin) quickly petitioned the bankruptcy court to stop the sale of
the personal information.12 The FTC
negotiated with Toysmart and reached an agreement, whereby Toysmart
would be allowed to sell the customer data if the data was sold with the
company's name and Web site. The new owner of the data also had to
engage in a similar business and agree to abide by Toysmart's privacy
pledge.13 However, this settlement with the
FTC did not resolve the concerns of the state attorneys general or
TRUSTe.14 The attorneys general filed a
motion with the bankruptcy court, insisting that Toysmart customers be
notified before the sale of the data and given the chance to remove
their information from the list. A subsidiary of Disney offered to
purchase the customer list for $50,000 and then destroy the list.15 It is not clear whether this offer will
satisfy the bankruptcy court, TRUSTe, or the state attorneys
general.
The upside of the Toysmart situation is that it clearly demonstrates
a willingness on behalf of the federal government, states, and the
industry's self-regulation organizations to attempt to protect consumer
information. However, significant issues are raised by the Toysmart
situation. How effective can TRUSTe be in bringing a lawsuit against a
bankrupt corporation? What rights do Web users have to enforce a privacy
policy that they may not even have seen or been aware of? When can
businesses modify their Web site privacy policies? And, finally, should
businesses be required to successfully navigate the laws of all 50
states (not to mention foreign jurisdictions) when they gather customer
information online? Or, should a national, standardized law be
implemented?
The European Union Intervenes
While various entities in the United States argue over who should
regulate consumer data gathered over the Web, the European Union (EU)
has already adopted a strong, standardized position on collecting,
processing, and storing personal data that is transmitted via electronic
means (which includes more than just information that is gathered over
the Internet). European Union Directive 95/46/EC (the "Directive") was
passed to aid and ensure the smooth transmission of personal data across
national borders. The regulations under the Directive include:
1) Personal data must be collected for specified, explicit, and
legitimate purposes;
2) Special categories of data (such as racial or ethnic origin,
political opinions, religious or philosophical beliefs, trade union
membership, and health or sex life) require the data subject's explicit
consent before the data can be shared with a third party or used in a
manner for which it was not originally collected;
3) The data collector must provide certain explanatory information to
the data subject when the data is collected; and
4) The data subject must be allowed to review and modify incorrect
data.
United States businesses noted that the Directive's jurisdiction
section was broad enough to include them if they had any operations or
sales in the EU. In an effort to help United States businesses comply
with these requirements, the Commerce Department negotiated a "safe
harbor" agreement with the EU.16 Under the
safe harbor agreement, United States corporations can self-certify that
they will comply with the Directive's requirements. United States
corporations that currently collect or exchange personal data from EU
member states had to comply with the safe harbor provisions by Nov. 1,
2000, or face the possibility that any electronic exchange of personal
data from the EU to the United States will violate the Directive.
It may be difficult for United States corporations conducting
business in the EU to isolate U.S.-derived personal data from EU-derived
personal data. These corporations may decide to adopt data protection
standards for all personal data, not just EU-derived personal data. If
so, the EU will have, in essence, caused many United States companies to
conform to standards it considers adequate.
The Federal Government Gets Serious: COPPA
The right to be left alone - the most comprehensive of rights,
and the right most valued by a free people.
- Justice Louis Brandeis, Olmstead v. U.S., 277 U.S.
438 (1928)(in dissent).
One area in which the federal government has followed the lead of the
EU and passed strong rules is in the collection of children's personal
information. Congress passed the Children's Online Privacy Protection
Act (COPPA) in October 1998 to restrict how commercial Web site
operators gather information from children under age 13. The FTC's rules
implementing COPPA became effective April 21, 2000.
COPPA places significant burdens on Web sites that are directed or
targeted to children (including those that have a portion of their site
targeted to children) and on general audience Web sites that have
"actual knowledge" that they are dealing with a child or that a child is
disclosing personal information.17 If a Web
site falls under COPPA's rules, the Web site operator must obtain
"verifiable parental consent" from the child's parent before collecting,
using, or disclosing the child's personal information.
The FTC has suggested methods for obtaining verifiable parental
consent, including:
1) providing a consent form that can be printed out, signed by the
parent, and returned by postal mail or facsimile;
2) requiring a parent to use a credit card to demonstrate adult
status;
3) having a parent call a toll-free number staffed by trained
personnel to determine if the person is an adult;
4) verifying a parent's digital signature using public key
technology; and
5) email approval accompanied by a PIN or password obtained through
one of the above methods.18 Additionally,
until April 21, 2002, companies that will be using a child's personal
information for internal purposes may obtain consent using a parent's
email address so long as this is coupled with an additional verification
step such as a follow-up telephone call, letter, or email.
COPPA offers limited exceptions to its parental consent requirements.
No parental consent is required if the child's personal information
is:
1) contact information collected for the sole purpose of obtaining
parental consent;
2) contact information used on a one-time basis to respond to a
specific request of the child;
3) contact information used to respond on a repetitive basis to a
single request and not for any other use (for example, if a child merely
signs up for an email newsletter and the child's email address is not
used for any other purpose); or
4) certain other limited exceptions.19
These rules can be costly to comply with, and they carry significant
civil penalties: up to $11,000 per violation. The FTC recently issued a
reminder that children's privacy issues are a "priority" for it.20 An FTC survey of sites that collect
personally identifiable information from children found that one-half of
these sites have "substantial compliance problems."21 The FTC filed a complaint against Toysmart
for its collection of personal information from children, and it is
likely that the FTC will increase its enforcement of COPPA.
Conclusion
The issues surrounding electronic collection, storage, and use of
personal data collected through the Internet will only continue to grow.
While the federal government has taken a strong position on protecting
children's personal data, it remains to be seen whether other personal
data will be regulated by the federal government, states, the computer
or advertising industries, or outside influences such as the EU.
Endnotes
1 Robert O'Harrow Jr.,
"Fearing a Plague of 'Web Bugs,'" Washington Post, http://www.washingtonpost.com/wp-srv/business/feed/a60184-1999nov13.htm
(Nov. 13, 1999); Dave Methvin, "Are You Being Bugged?," Winmag.com, http://www.winmag.com/fixes/webbugs.htm
(Sept. 21, 1999).
2 Electronic Privacy
Information Center, Network Advertising Initiative: Principles Not
Privacy, http://www.epic.org/privacy/internet/NAI_analysis.html
(July 2000).
3 Keith Perine, "FTC Approves
Privacy Plan," The Industry Standard, http://www.thestandard.com/article/display/0,1151,17211,00.html
(July 27, 2000).
4 FTC, Online Profiling:
Report to Congress, Part Two, Recommendations, http://www.ftc.gov/os/2000/07/onlineprofiling.htm
(July 2000).
5 Supra, note 2.
6 The Electronic Privacy
Information Center monitors many of these bills. See http://www.epic.org/privacy/bill_track.html.
7 Chet Dembeck, "Online
Privacy Inside and Out," EcommerceTimes, http://www.ecommercetimes.com/news/articles2000/000425-1a.shtml
(April 25, 2000); Ann Harrison, "Michigan Charges Web Sites with Privacy
Violations," Computer World, http://www.cnn.com/2000/TECH/computing/06/19/mich.web.idg/index.html
(June 19, 2000).
8 Keith Perine, "Lawsuit Says
You Can't Escape Netscape," The Standard, http://www.thestandard.com/article/display/0,1151,16622,00.html
(July 7, 2000).
9 Charles L. Kerr, Oliver
Metzger, "Online Privacy: Emerging Issues," 607 PLI/Pat 29 (June, 2000).
So far, no published cases have reached the merits of these complaints
by private individuals.
10 Governor Announces
Privacy Task Force Members, http://www.wisgov.state.wi.us/news/ap_detail.asp?prid=29
(Aug. 3, 1999).
11 Elizabeth Blakely,
"After the Toysmart Debacle," EcommerceTimes, http://www.ecommercetimes.com/news/articles2000/000725-1.shtml
(July 25, 2000).
12 See In re:
Toysmart.com LLC (Br. Mass.) (Case No. 0013995-CJK), http://www.naag.org/features/Toysmart.htm;
Jennifer Heldt Powell, "Customer Info Fight in Court," Boston
Herald, http://www.bostonherald.com/business/technology/toy07212000.htm
(July 21, 2000); Linda Rosencrance, "Web Privacy Organization Seeks to
Block Toysmart Sale," Computer World, http://www.computerworld.com/cwi/story/frame/0,1213,NAV47_STO46729,00.html
(July 6, 2000).
13 FTC Announces Settlement
With Bankrupt Web Site, Toysmart.com, Regarding Alleged Privacy Policy
Violations. http://www.ftc.gov/opa/2000/07/toysmart2.htm
(July 21, 2000); Heldt Powell, FTC Says Toysmart.com Can Sell Customer
Data, http://www.bostonherald.com/business/technology/toys07222000.htm
(July 22, 2000).
14 Brian Krebs, Newsbytes,
States Formally Object to Toysmart Settlement with FTC, http://www.newsbytes.com/pubNews/00/153220.html
(Aug. 4, 2000).
15 Settlement Made in
Toysmart Case to Protect Customer Names, http://www0.mercurycenter.com/svtech/news/breaking/merc/docs/047839.htm
(Jan. 9, 2001).
16 See International Trade
Administration Electronic Commerce Task Force, http://www.ita.doc.gov/td/ecom/menu.html
(July 27, 2000).
17 16 C.F.R. § 312.3
(1999).
18 See id. at
§ 312.5(b).
19 See id. at
§ 312.5(c).
20 FTC, Web Sites Warned to
Comply With Children's Online Privacy Law http://www.ftc.gov/opa/2000/07/coppacompli.htm
(July 17, 2000).
21 Id.
Wisconsin
Lawyer
