The Federal Trade Commission’s cross-device report has few practical recommendations on what consumers can do to navigate the tangled web of cross-device privacy controls – or the lack thereof.
Although the staff report, issued Monday, is a notable public statement on the space, it cleaves to the commission’s historical party line on tracking.
The FTC said companies that engage in cross-device tracking should be transparent about their data collection practices; supply consumer opt-out mechanisms; provide heightened protection for what the FTC considers to be sensitive data, including financial, health and children’s information; and maintain reasonable security of whatever data is collected.
FTC Commissioner Maureen Ohlhausen acknowledged that the FTC’s latest report doesn’t deviate in any material way from the commission’s pre-existing stance on behavioral advertising or “alter the FTC’s longstanding privacy principles.”
It “simply discusses their application in the context of a new technology,” Ohlhausen said in a written statement, and doesn’t appear to impose any requirements on marketers, publishers or platforms that weren’t already laid out in the FTC’s report on self-regulation principles for online behavioral advertising that came out in 2009, when ad tech was primarily cookie-based.
The report is based on insights gathered during and after the FTC’s cross-device workshop in November 2015, as well as a recently released study from OTech, (the FTC’s Office of Technology Research and Investigation) that examines the data practices and privacy policies of 100 popular websites.
Although the FTC calls for more robust notice and choice, it shares few practical recommendations on how to provide those things in a cross-device environment – the back-end mechanisms of which are challenging to understand, especially from a consumer perspective.
As soon-to-be former FTC Chairwoman Edith Ramirez put it at the 2015 workshop, tracking is an increasingly “sophisticated and complex enterprise, involving a multiplicity of players as companies seek to link customer behavior across a wide range of connected devices.”
That complexity makes disclosure a tricky endeavor. OTech’s study, which was released in early January, found that it was almost impossible to tell whether a company that collects data about a user across different devices is using that data to enable cross-device tracking and targeting.
In that study, which the FTC relies on heavily in its own report, OTech found that although most of the policies it looked at reserved broad rights to allow third parties to collect and use anonymized or hashed browser data, including IP address and unique cookie identifiers, the vast majority of the policies contained little or no explicit discussion of cross-device tracking or whether consumers had the ability to opt out of it.
The FTC’s solution is for companies engaging in the practice to be transparent, “truthfully disclose their tracking activities,” “offer consumers choices about how their cross-device activity is tracked,” “simplify consumer choices wherever possible,” respect those choices once made and “continue to reassess technical limitations.”
But that still puts most of the onus on the consumer to navigate a vast and complex ecosystem populated by ad tech companies and third-party players they’ve likely never heard of.
Ad industry trade groups, like the Digital Advertising Alliance and the Network Advertising Initiative, are trying to provide consumer choice options, and the FTC is still, as it’s always been, a proponent of self-regulation.
Starting in February, for example, the DAA, will require that when a consumer opts out of seeing behaviorally targeted ads on one device, data from that opted-out device is not allowed to be used to target ads on other devices. It’s a move lauded by the FTC.
But if consumers don’t want to be tracked across devices at all, they will still have to opt out device by device and device graph by device graph. And the fact of the matter is that even a highly motivated consumer will have trouble managing their privacy preferences in that manner.
The FTC advises companies to provide “meaningful information” to consumers about cross-device to help them decide “whether to use existing opt-outs, whether to attempt to silo their activities or whether to stop using a website, app or service altogether.”
Frankly, that’s asking a lot of consumers. It’s the paradox of choice. Too much choice can be overwhelming and lead a person to ultimately make no choice at all.
“It’s the Wild West in terms of managing this and coming at it from the user perspective,” said Brienna Pinnow, director of product marketing at Experian Marketing Services, in a previous interview with AdExchanger. “How can the consumer understand this ecosystem if we ourselves are struggling with the best way to do it?”
