Not As Private as you Think

Not As Private As You Think
Andy Greenberg, 09.25.08, 06:00 PM EDT
Users' confusion about their online privacy raises questions about whether the private sector will adequately protect personal data.

The Daily Number: 57

News for just over half of all Americans who use the Web: Companies don't need to let you know if they're watching you online.

A report published Thursday by the Consumer Reports National Research Center shows that 57% of Web users mistakenly believe that before monitoring their online browsing, companies are legally required to identify themselves, spell out why they're collecting data and who they intend to share it with. Sixty-one percent believe what they do online is "private and not shared without their permission," and 43% of users incorrectly believe that a court order is required to monitor Web-browsing activities.

That doesn't mean users aren't concerned about online privacy. Seventy-two percent of respondents to Consumer Reports' poll said they were troubled by the idea that their behavior is tracked by companies. Fifty-three percent of users said they were uncomfortable with Internet firms merely using their e-mail content or browsing history to show them more relevant ads.

That mix of concern and ignorance could have broad implications for the Web's advertising regulations. Companies that sit on mountains of users' Web-browsing data, including search engines, ad networks and Internet service providers, argue that self-regulation and competition are better than new laws for safeguarding privacy online. But if consumers aren't aware of how their data move around the Web, companies have little incentive to compete over privacy standards, advocates contend.

The newest chapter in the debate between laws and self-regulation: whether Internet service providers should be legally prevented from selling data to advertisers. That data-selling practice has come under scrutiny since Redwood City, Calif.-based NebuAd began partnering with ISPs, including Charter Communications (nasdaq: CHTR - news - people ), Embarq (nyse: EQ - news - people ) and WOW, using the providers' massive collection of user-browsing data to better target and place Web ads. (See "Broadband Indiscretions.")

NebuAd's innovative ad tactics offer broadband providers a lucrative new revenue stream, but have raised flags with lawmakers who see it as a new method of tracking that's more invasive than the data collection schemes of search engines and ad networks. (See "Senate Grills Wiretapping Ad Firm.")

In a hearing Thursday before the Senate's Committee on Commerce, Energy and Transportation, representatives from broadband providers AT&T (nyse: T - news - people ), Time Warner (nyse: TWX - news - people ) and Verizon Communications (nyse: VZ - news - people ) argued that NebuAd's indiscretions mean ISPs need more self-regulation, not new laws. The three providers reassured lawmakers that none of them have partnered with ad firms or plan to sell Web-browsing data. Verizon and Time Warner also laid out proposed frameworks of self-regulatory rules that require ISPs to ask permission to track user behavior and create standards of security for how the information is stored.

But Gigi Sohn, an attorney with the advocacy group Public Knowledge, told senators that wasn't enough. Competition, she pointed out, hasn't been particularly strong between ISPs, many of whom hold near-monopolies on entire regions. Some providers that partnered with NebuAd in particular, she argued, served rural areas and had practically no competitors. "Can I be the skunk at the self-regulatory party?" she asked. "This notion that there's going to be this competitive pressure … I'm dubious."

Sen. Byron Dorgan, D-N.D., who chaired the hearing, seemed to waiver between supporting new legislation and self-regulation. But he pointed to the Consumer Reports research as evidence that Web users might not be able to discern which broadband providers adhere to privacy standards and which don't.

Dorgan, who sat in on Wednesday's hearings on Wall Street's meltdown and the current bailout plan, said it served as a reminder that self-regulatory measures aren't always enough.

"This reminds me of last night's discussion about 'firewalls,' " Dorgan said. In the case of that system's self-regulation, he remarked, "It turns out the firewalls weren't so fireproof."