Since the FTC proposed a Do Not Track list last year, an actual “Do Not Track Me Online Act of 2011″ has been drafted, the state of California has jumped into the game with its own legislation — and an update to the Children’s Online Privacy Protection Act of 1998, entitled the “Do Not Track Kids Act of 2011” has been initiated.
Is it possible that a uniform standard will emerge from all three sets of legislation? Don’t bet on it… which leads us to:
Problem #3: How do you comply with Do Not Track legislation?
The simple answer to this question: Nobody knows — not even the people writing the legislation.
Rather than defining what “Do Not Track Me” actually means, the House bill, introduced by Rep. Jackie Speier, gives the Federal Trade Commission 18 months upon passage of the law to develop standards for companies to follow when tracking online users of their web portals.
In fact, establishing standards could prove a major sticking point for both the Federal and California statutes. In a related article from the online portal Ars Technica, a reader with the user name “taswyn” sums up the problem with these laws as effectively as anyone in the 100+ comment thread:
“The real issue here isn’t the privacy, or the implications for any one website. The problem with a bill like this is actually one of infrastructure.”
Touché, taswyn! He/she continues:
“What many people fail to realize is that the advertising they are seeing on a given site isn’t FROM that site. So whom do you opt out with? Is that site somehow supposed to now communicate this with any advertisers who are sharing page space on that site?”’
In other words… let’s say you’ve opted out of a website’s tracking features, and while visiting the site, you click on an ad. The ad is most likely hosted on a different website unrelated to the site with the opt-out agreement. Is the ad subject to or exempt from the opt-out requirements of the site — and who is responsible in either case?
In fact, markup on the California legislation carries a “support if amended” statement from the Electronic Frontier Foundation (EFF), which focuses on this specific shortcoming of the California bill (and is a problem with the proposed Federal statute as well):
“We are particularly troubled by the (California) bill’s failure to clearly distinguish between first parties and third parties. A ‘first party’ is a website a user knowingly visits and thus has a direct relationship with. A ‘third party,’ such as a cross-domain advertising company, is often embedded within a first party site so that consumers may not even realize that the third-party tracking company is present, and thus cannot protect themselves.”
EFF supports a browser-based solution that applies to all online activities, rather than making Do Not Track the responsibility of individual websites, many of which are barely supported by the advertising revenues they presently earn.
But at least the Federal statute mandates the FTC develop specific guidelines to be followed. The California bill is particularly troublesome in its lack of specifics regarding how to comply with the law:
“This bill does not contain language providing for how the opt-out method might functionally work. It is presumed that the Attorney General, through the regulatory process, would determine this.”
Really? The California State Attorney General is going to figure out how to make the opt-out function work? Hm… does that mean someone would have to be sued for failure to comply before we all know what compliance actually looks like?
Taswyn also astutely notes another major problem with the California law: if your website user opts out, you somehow have to NOT log their presence in your server logs. The legislation states:
“This bill would define ‘covered information’ to mean any of the following that is transmitted online: the online activity of the individual such as the Internet Web sites and content from those sites accessed; the date and hour of online access; the computer and geolocation from which online information was accessed; and the means by which information was accessed, such as a device, browser, or application…”
Apart from the question of how to properly maintain a server with incomplete logs, or who the responsible party would be in the event web hosting is subcontracted, this specification in the law would theoretically enable a malicious entity to opt out of tracking, then attack your website with impunity, because you cannot identify the source of the attack via your server logs.
Finally, the Federal statute imposes the following limitations:
“The bill would exempt government agencies, stores with information on fewer than 15,000 customers, or those who collect data on fewer than 10,000 people over a one-year period.’’
Presumably these exemptions were intended to give boot-strap online enterprises a pass on Do Not Track obligations (and don’t expect the government to live by its own rules!). But this is yet another shortcoming of currently proposed law that would be more effectively addressed with browser-based solutions. How would you know, as a visitor to a website, if they were exempt from Do Not Track obligations? For that matter, what would happen to a small-scale website who unwittingly crosses the line of having too many customers? Would they be subject to harassment by trial attorneys trolling for a class-action suit?
Do Not Track legislation is a well-intended effort to protect the rights of consumers. But without some degree of “tracking,” the Internet cannot function properly — and anyone who is obliged to obey a Do Not Track law should have some reasonable expectation of knowing how to comply. As written, the California law would leave even nonprofit, non-commercial websites potentially exposed to class-action lawsuits — and the rules for the federal statute have yet to be determined. A responsible statute should take into account the realities of how the Internet functions, deal directly with the issue of hidden third-party information gatherers, and clearly define the means by which one can operate within the law.
