STATEMENT OF THE Daniel L. Jaffe BEFORE THE Comments on Consumer
Information Privacy April 15, 1997 INTRODUCTION The Association of National Advertisers, Inc. (ANA) appreciates the opportunity to provide comments on consumer privacy issues on the Global Information Infrastructure (GII). We were pleased to be able to participate in last year's public workshop on these important issues. The 1996 Staff Report Consumer Privacy on the Global Information Infrastructure is an excellent summary of the issues discussed. We hope to have the chance to take part in the Commission's follow-up Workshop on June 11-13. These workshops are an example of the FTC playing a critical role in focusing a governmental spotlight on key consumer and business issues. We are in the midst of a vast media transformation. No one knows with precision how the new media will evolve. But today's new frontiers of technology--with their broad interactive capacity--provide an unprecedented opportunity for an information revolution. This revolution can provide both business and consumers the ability to make the marketplace more efficient, effective, and competitive. Economists have long recognized the role of advertising in providing information to consumers. The advertising community asked Nobel Laureates Dr. Kenneth Arrow and the late Dr. George Stigler to prepare a study on the importance of advertising to the economy and consumers. The study, which was developed with Lexecon Inc., concluded: "The role of information in enhancing consumer welfare is widely recognized in economics. In fact, according to a recent study by Ippolito and Mathios of the FTC, '(i)n markets where conditions are changing rapidly, the flow of information to consumers becomes a primary determinant of welfare.' (Ippolito and Mathios, Information, Advertising and Health Claims: A Study of the Cereal Market, Federal Trade Commission unpublished paper, November 1989). In the modern economy, advertising provides information about products and services. By providing information in an efficient (i.e., cost-effective) manner, advertising helps the economy to function smoothly -- it lowers prices and aids new products and even firms to enter the marketplace. In short, advertising is a powerful tool of competition: competition of one product against another and competition of one firm against another." Lexecon Inc., Economic Analysis of Proposed Changes in the Tax Treatment of Advertising Expenditures, August 1990. Interactive media truly has the potential to create an information revolution in the marketplace. At relatively little cost, companies can have access to the global economy, yet also maintain the flexibility to interact with consumers individually. Interactive media will also increase consumer sovereignty over the advertising, entertainment and educational material they receive. Consumers will be able to get more of what they want, when they want it, and avoid what they don't want. Interactive media is much more consumer driven than traditional marketing, where the consumer plays a more passive role. In 1994, we joined with our sister association, the American Association of Advertising Agencies (AAAA), to form CASIE, the Coalition for Advertising Supported Information and Education. The goal of CASIE is to create an environment where consumers have the broadest array of high-quality media options at the lowest possible cost. We believe that advertising revenue must continue to be a key funding source for information and entertainment in the evolving media world, if the Internet is to fulfill its promise. In ANA's view, there are multiple market and other forces that will transform the Global Information Infrastructure from a seemingly uncharted information jungle into an area where the public, utilizing common sense, can travel safely, to its enormous benefit. First and foremost, the economic self-interest of business will play a major role in the privacy area to assure the public of fair treatment. Failure of the business community in this area will drastically limit the use of the Internet and undermine the interactive media as a significant marketing tool. Second, self-regulatory efforts by CASIE, the Children's Advertising Review Unit of the Council of Better Business Bureaus (CARU), and many other groups will help accelerate this process. It is important to note that self-regulation is a long term, on-going effort and that we are still relatively early in the process. Third, educational efforts by business, government, and consumer groups will provide members of the public with a far greater awareness and ability to protect themselves. Fourth, the public's experience with the information media is growing exponentially. This sophistication will lead to increasing demands for the development of business norms and policies as it has in all other media. Fifth, technological tools already provide the public with unprecedented controls over what comes in and out of the home by interactive media and these capacities will continue to grow. As described below, we have joined with the Internet Privacy Working Group (IPWG) to further enhance parental empowerment options. Sixth and finally, the government and our traditional self-regulatory systems will see to it that there will be enforcement of norms of truth and accuracy in online advertising and marketing. One caveat is worth noting. Unlike earlier media forms, the Internet as a broad information and marketing tool has exploded on the scene in a manner that is virtually unprecedented. In light of its global nature, however, there is no reason to believe that the ability to impose self-regulatory norms on this system will be any less arduous than has been true for the media that have preceded it. Those who demand instantaneous results under the threat of immediate government regulation ignore our experience with every other media. SESSION ONE: COMPUTERIZED DATA BASES CONTAINING SENSITIVE CONSUMER IDENTIFYING INFORMATION The Commission has asked for comments on the use of computerized data bases that contain what consumers may perceive to be sensitive identifying information, often referred to as "look-up services." The Federal Reserve Board has just submitted a report to Congress which discusses many of the issues raised in the Commission's Request for Comment. See: Report to the Congress Concerning the Availability of Consumer Identifying Information and Financial Fraud, (Submitted to the Congress pursuant to section 2422 of the Economic Growth and Regulatory Paperwork Reduction Act of 1996; March 1997). The Report notes that the availability of information and the free-flow of data are cornerstones of both our democratic society and the free market economy. It describes the core challenge facing everyone who cares about these issues, industry, privacy groups and the government: "Striking the proper balance between a desire for absolute privacy and a legitimate need for access to information, even if it intrudes into personal matters, is an old and troubling dilemma. This problem has been made more immediate by the dramatic pace of technological change and its capacity to significantly increase the dissemination of personal information about individuals." The Fed Report describes how reference services gather and use information and notes that the most common users include law firms, private investigators and law enforcement agencies. We noted that the Commission's Notice Requesting Public Comment stated that the agency's study of "look-up services" would not address data bases used primarily for direct marketing purposes. While some of our member companies' marketing and research databases may contain personally identifiable information, such as name and address, it generally would not include the kinds of "sensitive" information described in the Fed's Report. This is a relatively new issue for ANA and we are still gathering information from our members about what value, if any, these services would have for their marketing or research purposes. SESSION TWO: CONSUMER ONLINE PRIVACY Information Collection and Use: The development of the cybermarketplace is of critical interest to our member companies for two different reasons: as another advertising medium and as a marketing tool. It has been estimated that advertisers spent $301 million on advertising on the World Wide Web in 1996. This is a substantial increase over the $60 million which was spent on the Web in 1995. While these numbers are increasing, they are still very small compared to the more than $60 billion spent on national broadcast and print media. However, growth projections for Internet advertising are impressive. A major consulting firm recently estimated that online ad spending will reach the $5 billion mark by the year 2000. Clearly, advertising is on the Internet to stay and holds the promise of being a significant source of funding for new media systems and content. As we stated last year, the Internet is not yet a major selling vehicle for most national advertisers. While the vast majority of our members have created websites, many are still "works in progress" as the companies experiment with this new medium. Some companies are providing "electronic coupons" to those who visit their website. Some build brand identity by allowing visitors to download their latest advertisement for use as a screen saver. One major package shipping company, for example, provides a valuable service by allowing customers to access its shipment tracking system through the website to follow their packages. The actual sale of goods or services over the GII may be an objective for many national advertisers, but meaningful sales volumes for most are still months or years away. Self-Regulation: The business community understands that the tremendous opportunities of the Internet will not be realized unless the public feels secure in entering and utilizing the global interactive marketplace. For this reason, CASIE last year announced a set of goals for privacy in marketing on interactive media. The text of these goals is attached to our statement. The key principles underlying these goals are consumer notice and consumer sovereignty over the collection and use of "personal" non-public individual information collected by interactive technology. CASIE believes that personal information ought to be used by a marketer to determine how it can effectively respond to a consumer's needs. We believe that if the marketer seeks personal information by interactive electronic communications, it ought to inform the consumer whether the information will be shared with others. We also believe that before a marketer shares this personal information with others, the consumer ought to be offered an option to request that personal information not be shared. Upon receiving such a request, the marketer ought to keep such personal information confidential and not share it. We believe consumers ought to have the ability to obtain a summary of what personal information about them is on record with a marketer that has solicited them by interactive electronic communication. In addition, the consumer ought to be offered the opportunity to correct personal information, request that such information be removed from the marketer's database or request that the marketer no longer solicit the consumer. As noted earlier, the Internet is still very much a "work in progress" for most national advertisers. Most are using the Internet as a communications tool for talking with current and potential customers: to provide product information, to conduct consumer research, to build brand or corporate identity. While some ANA member companies are collecting personally identifiable information from consumers, most are not. For that reason, many of our members are still in the process of developing privacy policies for online marketing. Most of those members, of which we are aware, that collect personally identifiable information have told us that they are following either the spirit or the letter of the CASIE guidelines, by providing consumers with notice and the chance to "opt out" of having the information shared with others. Of those companies which are collecting e-mail addresses from their visitors, the vast majority state that they will not disclose those e-mail addresses to anyone outside of the company. The CASIE goals complement the privacy policies adopted by other industry groups, such as the Direct Marketing Association, the Interactive Services Association and the Information Industry Association. At the time we issued the CASIE privacy statement, we emphasized that due to the embryonic nature of interactive media, it was premature for industry or for government to try to impose rigid rules or requirements in this area. We noted that the CASIE goals were intended to spark a discussion among all members of the interactive community to determine appropriate and effective ways to protect the privacy of consumers. The Public Workshop planned for June 10-13 by the Commission is an example of such an on-going dialogue. We believed then and we believe now that self-regulation and consumer empowerment are the best approach to these issues. Therefore, we would oppose the FTC, the Congress or any other governmental entity stepping in at this time to impose specific, rigid rules for privacy in the online marketing area. Given the rapid pace of change that continues in this area, any government restriction which was tied to a particular technology could quickly become obsolete. Also, the FTC already has powerful authority to act where online information collection policies are unfair, false, or deceptive, such as where a company misrepresented its privacy policies. Thus, there is no need for a whole new regulatory regime. Even if the government were to try to impose comprehensive rules, they would often not be able to reach large segments of the information universe. Almost a third of the websites and even more of the computer connections on the World Wide Web currently are of foreign origin or are foreign-based. This is just one of the many reasons why self-regulation and consumer empowerment are likely to be the only truly effective means of consumer protection in the interactive media. Finally, it is important to note that over-regulation of cybermarketing by the FTC or any other governmental body would raise potential First Amendment considerations. For example, the Center for Media Education has urged the Commission to adopt a rule prohibiting direct interaction online between children and product spokescharacters. As we will discuss below, it is not currently possible for a website operator to be certain, in most cases, about the age of those who visit the site. One major lesson from the CDA case, ACLU v. Reno, 929 F. Supp. 824 (E.D. Pa. 1996), was that speech on the Internet has substantial First Amendment protection. Indeed, Judge Dalzell concluded that: "the Internet deserves the broadest possible protection from government-imposed, content-based regulation." Id. at 881. The U.S. Supreme Court has made it clear that truthful, nondeceptive commercial speech cannot be banned or restricted unless the restriction "directly and materially advances" a "substantial governmental interest" and is "narrowly tailored" to "reasonably fit" that interest. See Central Hudson Gas and Electric Corporation v. Public Service Commission of New York, 447 U.S. 557 (1980). As the Supreme Court stated in Zauderer v. The Office of Disciplinary Counsel, 105 S.Ct. 2265 (1985): "Our recent decisions involving commercial speech have been granted in the faith that the free flow of commercial information is valuable enough to justify imposing on would-be regulators the cost of distinguishing the truthful from the false, the helpful from the misleading, and the harmless from the harmful." Id. at 2279. The Constitution entrusts parents, not government, with the primary responsibility for supervising the exposure of children to various types of speech. The proper role of government is to encourage the development of tools to support parents in their decision-making. Technological Developments: As described in the 1996 FTC Staff Report, consumers already have a variety of technologies available to help them safely navigate the Internet, including the Platform for Internet Content Selection (PICS). ANA is a member of the Internet Privacy Working Group (IPWG) and is working closely with others to develop another technological solution to privacy concerns. IPWG is a broad cross-section of public interest groups and private industry groups which are engaged in commerce and communication on the Internet. IPWG is working with the World Wide Web Consortium to develop a technical platform -- the Platform for Privacy Preferences (P3) -- that would enable consumers to make more choices about the flow of their personal information on the Internet. PICS and other current technologies are important tools, but they operate primarily as a blocking or filtering process, resulting in a "take it or leave it" approach to privacy issues. This approach may be appropriate where a parent does not want a child to access any information from a site. However, there may be cases where a parent is willing to allow some access, but not total access to all information on a site. The goal of the IPWG project is a more transactional approach, to make it possible for Internet users and website operators to negotiate privacy considerations, much as they might negotiate other matters. The plan for the P3 platform will facilitate automated discussions between users and websites about their respective privacy interests and policies. If individuals are truly empowered to fully protect their privacy interests online, they will be much more likely to seek out the broadest range of information, services and products on the Internet. It must be remembered that in the vast majority of circumstances in the interactive media environment, communications do not appear on a person's computer screen uninvited. This is a medium in which consumers have a vast amount of sovereignty. Furthermore, through P3 and a whole range of other computer software mechanisms, consumers increasingly will have knowledge and control over where they will go and what they will find in the global information environment. SESSION THREE: CHILDREN'S ONLINE PRIVACY Self-Regulation: One major positive development since last year's workshop is the adoption of new CARU guidelines which specifically address information collection from kids. The Children's Advertising Review Unit (CARU) of the Council of Better Business Bureaus (CBBB) is the industry's self-regulatory body which promotes responsible children's advertising practices. CARU has just released a new edition of the "Self-Regulatory Guidelines for Children's Advertising" which contains new guidelines for interactive electronic media. A copy of the new CARU Guidelines is attached to our statement. The advertising community has always realized that children are not miniature adults and deserve protections geared toward their special needs. The Children's Advertising Guidelines have been in existence since 1972, when they were first published by ANA to encourage advertising practices sensitive to the special nature of children. ANA and other industry groups worked for over a year to develop the new CARU guidelines. We believe that they represent a balanced approach and ANA will be encouraging all of our member companies to follow these new guidelines for online marketing. We look forward to input from the FTC, consumer groups and others on how well the new guidelines work in the marketplace. Not all commercial websites contain a direct selling message; they may provide valuable information to children. For example, the site of one major toothpaste brand discusses healthy snacks and the essentials of tooth care. One food company provides kids with information on the importance of a well-balanced diet incorporating five servings of fruits and vegetables each day. One toy company site provides "Netiquette 101," a lesson on etiquette on the Net. It may not be possible to draw a simple or precise line between commercial and noncommercial content on many sites. One of the most controversial issues in this area is collecting personally identifiable information from a child. The new CARU guidelines provide that marketers who collect identifiable information online "should make reasonable efforts, in light of the latest available technology, to ensure that parental permission is obtained." However, some have argued that a marketer must first obtain written or otherwise "verifiable" consent online from the parent. While the impetus for this requirement is clear, there are currently serious technical problems with implementing such a requirement in many instances. First, in most instances there is no way to precisely define what is a "children's" website. While some sites may be of great interest to children, such as sites for toys, CDs or trading cards, they may also attract a substantial adult audience. Conversely, sites that some may define as adult-oriented, such as for movies or automobiles, may attract a substantial number of young visitors as well. Second, there is currently no way for a site operator to positively verify the age of a visitor, or to verify that any consent being given online is truly that of the parent and not a child or another person. The very real obstacles to age verification on the Internet were perhaps best discussed in the opinion of the three-judge panel of the U.S. District Court in Pennsylvania which struck down the Communications Decency Act. See ACLU v. Reno, 929 F. Supp. 824 (E.D. Pa. 1996). In what was essentially a primer on the development of the Internet, the court issued 123 paragraphs of "Findings of Fact." Regarding the obstacles to age verification, the court stated: "90. There is no effective way to determine the identity or age of a user who is accessing material through e-mail, mail exploders, newsgroups or chat rooms. . . 91. Because of similar technological difficulties, individuals posting a message to a newsgroup or engaging in chatroom discussions cannot ensure that all readers are adults . . . 92. The Government offered no evidence that there is a reliable way to ensure that recipients and participants in such fora can be screened for age." 929 F. Supp. at 845. The court also discussed the practical limitations of two options proposed by some, credit card verification or adult verification by password, concluding: "107. Even if credit card verification or adult password verification were implemented, the Government presented no testimony as to how such systems could ensure that the user of the password or credit card is in fact over 18." 929 F. Supp. at 847. Finally, as discussed in the FTC Staff Report, several privacy advocates were concerned that age verification requirements could further compromise privacy concerns. Requiring websites to verify the age of each person who visits their site could lead to the creation of a central depository of names, ages or IDs, and seriously threaten any anonymity on the Internet. In ANA's view, this challenge can be best addressed through technology such as P3, which will allow parents to set the rules that govern their children's online activities. All parents are not the same; all kids are not the same. Rather than having the government adopt a one-size-fits-all rule which treats all parents and children alike, we believe a preferable approach is empowering individual parents to make meaningful, personal decisions on privacy for their individual family. Technological Developments: One fortunate aspect of the interactive media is that through the development of new technologies, parents have more control here than in virtually any other area in being able to effectively supervise their kids. Through existing technology, parents can control access to computers. They can control the codes which are necessary to get on to computers or on to the Internet. They can control where their kids can and cannot go within the interactive environment. Parents can track where their kids have gone, even when they are not present while their kids are online, so that they can apply their values to their children's activities. And to an increasing extent, they can control what information can come into the home as well as what information can go out. Parents can block their children from releasing their name, their address, or any other numerical information including credit cards. The 1996 FTC Staff Report (pages 41-44) describes various software programs now available, such as Net Nanny, Cyber Patrol and others. All of the major online service providers have various parental control features built into their programs. The IPWG project described above, P3, should provide parents with yet another tool to protect their children online. While the Internet is still a fascinating new territory for many of us, it should not lead us into becoming information hermits and placing overly restrictive rules on the medium. If there was one lesson to be learned from the debate in the Congress over indecency on the Internet, it was that we should try to enhance parent's control rather than have the government rush in to intervene as a first resort. We must also be clear in our own minds that kids would lose a great deal if they are not exposed to the tremendous amount of information and entertainment that have always been provided through the financial support of advertising in all other media. Again, we emphasize that government should be working towards enhancing the ability of parents to control their kids and to protecting their kids on the Net as they do in all other areas. CONCLUSION Consumers and the business community share the goal of maximizing the free flow of information on the Internet. ANA is actively working with our member companies and other industry groups to develop effective privacy policies for online marketing. Last year we announced the CASIE goals, which incorporate the three key elements of a meaningful privacy policy: notice, choice and access. CASIE will continue to consider whether any changes or additions are needed to address new developments in technology and the marketplace. Working with other groups, the advertising industry has just adopted new CARU guidelines, which address the most critical issues affecting the unique characteristics of children. We continue to encourage our member companies to adopt the CASIE goals or the CARU guidelines as they become more active in cyberspace. We recognize that self-regulation, no matter how well-intended, is never enough. Self-regulation must be buttressed by parental empowerment tools, backed up by the FTC's broad powers to stop false, deceptive or unfair acts or practices. We are working closely with the Internet Privacy Working Group (IPWG) to develop technological "solutions" which will enable parents to enjoy the full potential of the Internet while still protecting their family's privacy interests. In our view, the universe of commercial websites can be divided into three distinct categories. Many sites are developed by companies which market products or services which are primarily of interest to adults, such as financial services or home repair products. For such sites, the privacy policy should be notice, choice and access. The ability for adults to negotiate privacy issues under a technology such as P3 should help make that notice and choice even more meaningful. A second category would be those sites which are of interest to both adults and children, such as companies which sell toys, music and video products and certain food products. There is no simple way to precisely define a "children's website" but those which attract substantial numbers of children present an important challenge. For these sites, the privacy policy should be strong self-regulation, such as the CARU guidelines, plus effective technologies which empower parents to protect their children online. A third category would be sites for products which have age restrictions for sale. National advertisers believe that advertising for adult products should be targeted only to adults. We oppose marketing in any medium, including online, which illegally targets children. However, we also believe that the First Amendment protections for commercial speech apply just as forcefully in the online world as other media. Therefore, any governmental effort to restrict online marketing of such "adult" products must meet the Central Hudson test. We commend the Commission for holding these follow-up hearings. There has been meaningful progress since last year in both self-regulation efforts and technology. Once again, we urge the Commission to give all interested parties more time to work together on real private-sector solutions, before attempting to step in to impose a regulatory regime that is highly likely to undermine the cybermarketplace. We look forward to working with you on these crucial issues to our society and to the business and consumer community. The Association of National Advertisers, Inc. (ANA) is the industry's oldest trade association and the only organization exclusively dedicated to serving the interests of corporations that advertise regionally and nationally. The Association's membership is a cross-section of American industry, consisting of manufacturers, retailers and service providers. Representing more than 5,300 separate advertising entities, these member companies market a wide array of products and services to consumers and other businesses. |