Long-running industry negotiations over meaningful online privacy rules may be on the verge of collapse.
After months of occasionally constructive discussions to define what it should mean when consumers flip on a "do not track" switch in Web browsers, advertising lobbyists threw the talks into disarray last week by advancing an outlandish proposal.
During sessions in Amsterdam organized by the World Wide Web Consortium W3C, an Internet standards body, the Digital Advertising Alliance and Association of National Advertisers pushed to exempt from the rules all online marketing and advertising – the issue at the heart of the debate.
The industry had been digging in its heels on various technical issues for months, but the brazenness of the latest move casts doubt on its willingness to work in good faith on the process. What the precise level of damage is depends on whom you ask.
"This last-minute attack by the U.S. ad lobby has in fact derailed any hopes of a modest safeguard for users," said Jeff Chester, executive director of the Center for Digital Democracy and a participant in the W3C talks. "I think do not track is dead, but we're giving it a few weeks before conducting last rites."
Lee Tien, senior staff attorney at the Electronic Frontier Foundation, doesn't go that far. He hopes it's just hard-nose negotiations and that the talks can be salvaged.
"Sometimes you need to have people thrash around a bit to be able to move forward," said Tien, who is also involved in the W3C negotiations. "Other times they cause the process to derail."
Free speech issue?
A Digital Advertising Alliance representative explained the rationale for exempting marketing from do not track restrictions in an e-mail exchange that Chester posted online.
"Marketing fuels the world," the message said. "It is as American as apple pie and delivers relevant advertising to consumers about products they will be interested in at a time they are interested. Do Not Track should permit it as one of the most important values of civil society. Its byproduct also furthers democracy, free speech, and – most importantly in these times – JOBS."
All the major browser companies have added or plan to add do not track options, which allow users to signal that they don't want their online activity monitored. But without accepted standards, companies are basically free to interpret that request as they wish – or ignore it.
The worry is the ad industry, which has crafted a weak set of voluntary rules, might simply be waiting out the clock. The W3C group is officially scheduled to disband early next year. If no compromise is reached, it could mean the sector's own self-serving definition becomes the standard by default – at least in the United States, where regulators and legislators have continually failed to push through common sense rules. European officials are in the process of implementing far stricter privacy standards.
Regulators there were taken aback by the development last week. "Let me be frank: Standardization work is not going according to plan," Neelie Kroes, the European Commission vice president responsible for privacy issues, said in a speech on Thursday. "In fact, I am increasingly concerned. About the delay, and about the turn taken by the discussions hosted by the World Wide Web Consortium. … And I know that my colleagues across the Atlantic, at the Federal Trade Commission, feel the same."
The FTC hasn't spoken up publicly about the latest wrinkle in the talks and didn't return a call from The Chronicle.
A watered-down do-not-track option could be worse than none at all since consumers who flip it on may have the illusion of privacy, even as companies readily gather their data.
Based on the advertising trade group's self-regulation proposals and existing principles, it appears that users who turn on the do not track won't receive targeted ads. But their information could still be collected for other vaguely defined purposes, including "market research" and "product development."
In other words, companies can carry on with the most troubling part of targeted marketing – tracking online behavior – so long as they stop delivering what's arguably the one useful thing for consumers – customized ads.
Some observers say the point when the tone of the talks changed was when Microsoft announced that the next version of its Internet Explorer browser will ship with do not track turned on by default. The general consensus in the W3C talks up until then was that do not track would be an opt-in feature, and thus little used among consumers.
On Tuesday, the Digital Advertising Alliance stressed that its members would not be required to honor default do not track requests.
"Machine-driven do not track does not represent user choice; it represents browser-manufacturer choice," the organization said in a statement. "Allowing browser manufacturers to determine the kinds of information users receive could negatively impact the vast consumer benefits and Internet experiences delivered by DAA participants and millions of other Web sites that consumers value."
Privacy advocates say the one thing that could keep these companies at the table is the threat that officials will create stricter rules than the ones under discussion at the W3C.
"They completely lose any credibility if they torpedo this process," said John Simpson, an advocate at Consumer Watchdog. "It may get them a short-term victory that they think is worth having. But in the long run they will have considerably lowered the public's esteem of them and inevitably will run up against serious mandatory do-not-track standards."