Publishings

Washington, DC: The Center for Digital Democracy (CDD), along with U.S. PIRG, Consumer Watchdog, and Public Citizen, called on the Federal Trade Commission to launch an investigation into the impact on the American public of growing consolidation in consumer offline and online data sources and digital marketing applications. The groups also asked for the FTC to hold a public workshop focused on ensuring Americans receive 21st century safeguards protecting their privacy in online transactions, and a truly competitive marketplace.The letter comes after the approval by the Department of Justice of the “Big Data”-driven acquisition by the Oracle Corporation of data broker Datalogix. The merger—announced in late December and approved just three weeks later—would create, in Oracle’s words, “the world’s most valuable data cloud” for digital marketing, connecting and unifying “a consumer’s various identities across all devices, screens and channels.” The deal is the second recent major data broker acquisition by Oracle, which purchased leading online consumer information firm BlueKai last year. The Oracle/Datalogix transaction should have triggered involvement by the FTC, given its expertise on the digital data industry, the groups noted.The letter to FTC Chairwoman Ramirez also underscored that the Oracle/Datalogix merger raised serious privacy and consumer concerns, which required scrutiny by the Bureau of Consumer Protection as well. The combined companies’ datasets include financial, racial, location, and other sensitive data, as well as issues involving the EU/U.S. Safe Harbor agreement and the Google and Facebook Consent Decree settlements. The merger also implicates a number of consumer-protection matters, such as financial marketing and auto sales, where the FTC has a congressional mandate to protect the public.The group’s letter to the FTC (attached below) provides an inside look at the role of consumer data in today’s digital marketplace, in which companies not only amass enormous amounts of information on consumers’ online and offline activities, but exchange that information with partners and affiliates for the purposes of analytical scrutiny and personalized targeting. “This transaction,” the letter explains, “highlights the crosscutting dimensions of the contemporary ‘Big Data’ digital marketplace, where competition and consumer-protection issues are intertwined.”“The American public deserves to know how the consolidation and use of their information affects their daily lives,” the letter concludes, “from the prices they pay and the services they are offered to what this transaction means for their privacy. We urge the FTC to develop a more effective approach to identifying new problems and threats to competition and consumer protection in the Big Data era.”“The Oracle/Datalogix deal reflects the digital data ‘arms race’ underway where companies are amassing powerful and detailed sets of information to track and target a consumer anywhere, anytime,” explained Jeff Chester, CDD’s executive director. “Control over an individual’s information, and the capabilities to use it effectively in today’s Big Data era, are falling into fewer hands. Unfortunately, these critical mergers suffer from ‘premature approval syndrome,’ sanctioned by regulators without adequate analysis and discussion. As the country’s chief regulatory agency protecting privacy and the online consumer marketplace, the FTC needs to show greater leadership by fostering 21st Century safeguards.”“Our letter also urges antitrust authorities to update their market analysis to reflect that digital markets aren’t the same as markets for groceries or steel,” said Ed Mierzwinski, consumer program director for U.S. PIRG. “21st century markets need a 21st century analysis that takes into account the unique ways that fewer, bigger firms leverage even greater market power over consumer data through partnerships and joint ventures.”“The Oracle/Datalogix deal is an example of how powerful companies are amassing unprecedented amounts of data, distorting traditional markets, limiting competition and consumer control,” said John M. Simpson, Consumer Watchdog’s Privacy Project director. “The FTC needs to act quickly and decisively to ensure its regulatory procedures keep pace with the threats of 21st century data-driven markets.”“As evidenced now by Oracle’s acquisition of Datalogix, a handful of Data Titans hope to aggregate personal and private data about everyone, so they know where we go, what we do, whom we see, what we want, what we think and what we say,” said Rob Weissman, president of Public Citizen. “The marketers’ intrusion on our privacy is vastly outpacing public protections, or even public awareness. Consumer protection authorities need to take a very hard look at the Oracle deal and industry concentration more generally. There’s no reason for us to be racing toward a dystopian future of total surveillance.”

We await to review the text of proposed privacy bills announced today by President Obama. Next month will mark the third (link is external)anniversary of the promise by the White House to release "Consumer Privacy Bill of Rights" legislation. The "Bill of Rights" for privacy is supposed to empower an individual to have serious control over how their data is gathered and used. While the "Bill of Rights" incorporates high-minded principles, we fear that at the end of the day legislation will sanction our ever-growing data collection status quo. Today, Americans face a greater loss of their privacy due the unchecked and growing use of commercial (link is external) surveillance (link is external)technologies, which now afflicts us regardless of whatever device (link is external) we use (and with most applications (link is external)). Rather than lead on privacy, U.S. companies are aggressively expanding their sophisticated and pervasive data mining activities on individuals, groups, and communities (link is external). Whether we are online or off, (link is external) our finances, (link is external) geolocation, ethnicity/race (link is external), health (link is external)concerns and much more are secretly gathered and used without meaningful consent--let alone our awareness. A set of invisible practices operate that assess, score and take advantage of all of this online and offline data. So far, the only tangible result of the President's privacy promise has been online data lobbyist-dominated "stakeholder" meetings at the Commerce Department. This process has failed to develop even a modest form of more effective self-regulation, let alone truly provide privacy protection. If the President's bill relies on these flawed stakeholder proceedings to develop privacy safeguards, it will not bring any change and merely allow ubiquitous data collection to further flourish. We also believe that an unannounced but intended audience for today's Administration plan is to remove a serious obstacle for an U.S.EU trade deal, known as TTIP. U.S. data giants see the TTIP (link is external)as a powerful way to expand their market in Europe without having to run afoul of the EU's stronger data protection rules (under the guise of "free flow of data," the TTIP would enable U.S. companies to engage in all sorts of practices without worrying about EU privacy regulators). The TTIP deal also includes a regulatory "poison pill" called "regulatory convergence." Before the FTC or other consumer protection agency could create any new regulation, it would have to be reviewed by a new EU/US council. This would enable corporate lobbyists to have additional opportunities to weaken proposed rules even before they were made public. New regulations would face a new hurdle, having to demonstrate they wouldn't negatively impact corporate trade profits. The EU should not accept as only a promise that the U.S. will protect the privacy of Americans. Even if the Obama bill is a good one, its congressional path ahead is a hard political road, with an uncertain outcome. The EU should be prudent and wait. On data breach, we are wary of preempting more effective state laws--which is high on the data industry's political agenda in 2015. The most promising development may be a commitment by the White House to seek a national bill protecting the privacy of K-12 students. CDD intends to play an active role on this and all the other proposals.

In December, CDD urged the FTC to reject the verifiable parental consent mechanism for COPPA (Children's Online Privacy Protect Act) proposed by AgeCheq. The comments are attached. Ensuring meaningful parental consent so their child's data can be gathered and used requires a robust and effective system. Parents need to understand precisely what data is collected and by what means; how it is to be used--now and in the future--as well as the business models and online marketing practices that can affect them. CDD and its attorneys at Georgetown Law Center found a range of problems with AgeCheq's submission. The commission should decline approving its parental system for COPPA. Yesterday, the commission announced (link is external)it agreed with CDD and rejected Agecheq's proposal. Eric Null, Staff Attorney at the Institute for Public Representation, Georgetown Law Center, which represented CDD, said that "We are pleased that the FTC followed CDD's recommendation to reject AgeCheq's application for a verifiable parental consent mechanism. This is a true victory for parents and children and sends the message that future applicants must ensure their system meets the COPPA standards."

Statement of Jeff Chester, executive director, CDD With personal information on every U.S. individual, their families, community and workplace the "currency" in today's digital economy, the frenzy of dealmaking (link is external)in the databroker business continues as Oracle acquires (link is external)Datalogix (link is external). Through the data (link is external) it gathers on what we buy (link is external), and with its relationship with Facebook (link is external)and other powerful marketers, Datalogix consists of a online treasure trove of data on Americans. The Oracle (link is external) deal announced today follows its recent acquisition (link is external) as well of Bluekai, (link is external) which holds reams (link is external)of information (link is external) on consumers. (link is external) CDD calls on the Federal Trade Commission to closely scrutinize the proposed deal. It must examine the impact on competition and protect the privacy of Americans. Given the FTC's 20-year consent decree with Facebook, and the role that Datalogix plays (link is external) with the social network, it also must review whether the deal requires additional safeguards under that decree. Both Oracle (link is external) and Datalogix (link is external)are members of the EU/US Data Protection Safe Harbor program and the commission must examine how this pending databroker/consumer targeting acquisition impacts that program. The growing consolidation of information on every American and whatever we do--regardless of location, time of day, whether we are online or off--should trigger action, as well as soul searching by both policymakers and the public. Do we want a society where a very powerful few data barons are able to gather and profit from our information without an individual having any ability to protect their privacy? ****** PS: This summary (link is external)via Adexchanger is useful to see the impact and intention of this deal: Datalogix aggregates and provides insights on over $2 trillion in consumer spending from 1,500 data partners across 110 million households to provide purchase-based targeting and drive more sales. Over 650 customers, including 82 of the top 100 US advertisers such as Ford and Kraft, as well as 7 of the top 8 digital media publishers such as Facebook and Twitter use Datalogix to enhance their media. Oracle and Datalogix's Data as a Service cloud solutions will provide marketers and publishers with the richest understanding of consumers across both digital and traditional channels based on what they do, what they say, and what they buy. This will enable leading brands to personalize and measure every customer interaction and maximize the value of their digital marketing. The combination fundamentally transforms marketing automation from executing campaigns to being able to correctly identify consumers, target them accurately with digital campaigns, allow marketers to measure which campaigns and channels are effective, and optimize how they reach consumers and spend their campaign resources. The addition of Datalogix represents a further extension of Oracle's Public Cloud strategy to combine IaaS, PaaS, SaaS and Data as a Service on a common cloud and to transform SaaS business applications and processes by integrating data within these applications. More information can be found at http://www.oracle.com/datalogix (link is external). Supporting Quotes "The addition of Datalogix to the Oracle Data Cloud will provide data-driven marketers the most valuable targeting and measurement solution available," said Omar Tawakol, group vice president and General Manager of Oracle Data Cloud. "Oracle will now deliver comprehensive consumer profiles based on connected identities that will power personalization across digital, mobile, offline and TV." "Datalogix's mission is to help the leading consumer marketers connect digital media to the offline world, where over 93 percent of consumer spending occurs," said Eric Roza, CEO, Datalogix. "We are thrilled to join Oracle and extend the value Oracle Data Cloud brings to marketers and publishers."

Consumer, Child Health, and Privacy Groups Urge Federal Trade Commission to Investigate and Bring Action Against Topps for Violating Children’s Privacy Rights through its Child-directed Website Candymania.com and its #RockThatRock Contest Washington, DC: The Center for Digital Democracy (CDD), through its counsel the Institute for Public Representation, along with the American Academy of Child and Adolescent Psychiatry, Campaign for a Commercial Free Childhood, Center for Science in the Public Interest, Consumer Action, Consumer Federation of America, Consumers Union, Consumer Watchdog, Rudd Center for Food Policy and Obesity, and United Church of Christ, today asked the Federal Trade Commission (FTC) to investigate and take enforcement action against The Topps Company, Inc., for violating the Children’s Online Privacy Protection Act (COPPA) Rule in connection with its child-directed website Candymania and its online contest #RockThatRock. Topps, a candy and trading-card company owned by former Disney CEO Michael Eisner, uses its child-directed website Candymania.com and social media to promote Ring Pop, a candy that appeals to children. The #RockThatRock contest, which ran in Spring 2014, encouraged children to post photos of themselves wearing Ring Pops on Facebook, Twitter, and Instagram for a chance to have their photo used in a music video with tween band R5. Of the photographs collected, Topps used several that depicted children clearly under 13 in the video. The video is available on both Candymania and YouTube and has been viewed almost 900,000 times. Long after the contest ended, Topps continued to display children’s photos and contact information submitted using the #RockThatRock hashtag on the Ring Pop Facebook page. Topps made no effort to provide notice to parents about the information collected or to obtain advance, verifiable parental consent as required by the COPPA Rule. Additionally, Topps violated the COPPA Rule by failing to post its children’s privacy policy in a prominent manner, failing to provide a complete and understandable privacy policy, conditioning a child’s participation in the contest on disclosing more information than was reasonably necessary, and retaining children’s personal information for longer than reasonably necessary. “Topps and its partners cynically sought to bypass COPPA’s key safeguard that parents must first be told about a company’s data collection practices before their child’s information is gathered,” explained Jeff Chester, CDD’s executive director. "This is a textbook study of how online marketers are so eager to use Facebook and other social media to promote their products to friends and even strangers, they ignore this key law designed to protect consumer privacy online. Companies such as Topps need to carefully review all their digital marketing practices to make sure they are adhering to COPPA, and also are marketing their products in a responsible manner. The FTC must do more, however, to ensure that COPPA is effectively enforced. It must devote more resources to protect the privacy of children, and begin examining contemporary digital data-driven practices more thoroughly.” Angela J. Campbell, Co-Director of the Institute for Public Representation, which drafted the request, emphasized that “Topps is in violation of provisions of the COPPA Rule that the FTC adopted nearly two years ago to update and strengthen children’s privacy protections,” in two significant ways. First, Topps is collecting photographs of young children, even though the FTC decided to include photographs within the definition of “personal information” requiring parental notice and collection due to the privacy and safety concerns. Second, Topps is using social media to collect and post children’s personal information from which Topps reaps commercial benefits. The Commission amended the COPPA rule to clarify that a child-directed website was responsible for information collected by third parties on its behalf or from which it benefits. Campbell urged the FTC to take action to show that it is serious about enforcing the updated COPPA Rule. In addition to the privacy concerns of Topps’ marketing and data-collection practices, this case comes at a time of heightened concern over the health effects of candy and other unhealthy foods on children. Earlier this month, 41 members of the Food Marketing Workgroup (link is external) (including CDD, Center for Science in the Public Interest, and the American Heart Association) wrote five candy companies—including Topps—to ask them to adopt strong policies on food marketing to children. As the groups’ letter points out, “obesity has tripled in children and adolescents over the past decades. Currently, more than one in three children and teens are overweight or obese.”

For months, CDD has been in contact with the Federal Trade Commission over the actual efficacy of the so-called "Safe Harbors" programs established to address children's privacy thru the Children's Online Privacy Protection Act (COPPA). We have major concerns about how these programs are structured, and whether they meaningfully ensure privacy of young people. We have asked, via FOIA, for a detailed documentation on how the COPPA Safe Harbors operate. The FTC has not--to date--provided the information parents and the public require. CDD will ensure, however, that there is meaningful accountability by both the FTC and its COPPA Safe Harbor companies. The commission cannot look the other way on this issue, even if some of the Safe Harbor companies prefer to operate in a non-transparent mannner. Among the companies we have asked for information include: kidsSafe Seal Program; Aristotle International; Children's Advertising Review Unit; Entertainment Software Rating Board; PRIVO; and TRUSTe.

The Children's Online Privacy Protection Act (COPPA), a federal law my NGO led the campaign for back in the mid-1990's, was designed to ensure that parents (or the responsible adult) be able to make meaningful decisions about commercial data collected from a child (thru age 12). It's based on a concept requiring serious (read honest) and full disclosure of data collection and use practices, with prior affirmative consent (informed opt-in) before any collection occurs. Given the powerful array (link is external)of digital marketing techniques focused on collecting our information, and the need to ensure that parents have federal safeguards for the children's privacy, COPPA means that online marketing companies and their partners need to act in a highly responsbile, transparent and truly privacy appropriate manner.We are concerned that some in the online marketing industry want to create an easy "one-stop shopping" process that encourages parents to approve data collection for their child. Kids are a very lucrative market, spending (link is external)and influencing many billions a year. Some companies view COPPA as an obstacle to their plans to generate profits by online marketing to kids. Despite claims of respecting privacy (and which can also be viewed by examining the commercial market targeting adolescents), the default most marketers have adopted is full non-stop personalized data collection and real-time targeting. But COPPA makes such practices, commonplace in the digital ad industry, much harder to do. In part, it's because under the law they have to actually explain first what they intend to do and get permission. That approach is anathema to most in the online marketing business.When we learned that the National Institute for Standards and Technology (NIST, a division of the Department of Commerce) gave a federal $1.6 million grant (link is external)to Privo (link is external)designed to create a "parent consent at Internet scale" system for COPPA we were concerned. Privo's partners in its grant include "one of the world's largest toy companies" as well as Verizon (link is external). CDD, through our attorneys at the Institute for Public Representation, Georgetown Law Center, filed a FOIA request. The public needs to know how Privo's (link is external) system will operate; whether it's really designed to help parents make meaningful decisions; what role does the major toy company and Verizon (which has expanded (link is external) its own data targeting apparatus) play.NIST redacted nearly all of the Privo related documents, failing to provide the public the information and accountability necessary (especially when it's about the privacy of children). Today, we filed an Appeal and intend to pursue our legal options. (See attachment below.) More details coming.

Through the terrfic work of Public Citizen, CDD submitted this Amicus brief today in what's called the Wyndham case. Wyndham and its allies are challenging the much needed role of the FTC to protect Americans from data breaches and related online harms. That they are afraid of having a consumer protection agency do its job says a great deal about them. The brief is attached.

[excerpt from attached letter] Dear Chairwoman Ramirez: We urge the FTC to review its decision of September 24, 2014, providing “early termination” of the “Big Data” acquisition by Alliance Data Systems of Conversant (formerly ValueClick). We are deeply concerned that the commission failed to examine sufficiently the consequences to competition—and to privacy—of the consolidation of two powerful sets of consumer data. This merger reflects the continuing consolidation of the consumer data marketplace, an issue that the FTC must address. The Alliance/Conversant deal also raises serious privacy concerns, including with its intended goal of further unleashing powerful tracking technologies that follow individuals across all of their devices and applications. Both companies’ play leading roles providing data for financial services targeting, and Conversant is at the forefront of online lead-generation practices. The commission’s approval of this transaction without appropriate safeguards directly undermines its role as the country’s chief privacy regulator. The FTC cannot, on the one hand, express concern about the discriminatory and privacy implications of “Big Data” and the invisible role of databrokers, but at the same time silently consent to expanded commercial surveillance of the American people... The failure of the commission to address key consumer protection issues with this acquisition underscores the need for a greater commitment by the FTC to tackle the competition and privacy issues of today’s data-driven digital marketing era. We specifically urge the commission to launch a formal review of “Big Data” consolidation. The level of commercial data gathering on Americans is unprecedented, growing daily without respite, and is ending up in the hands of fewer companies... In addition, this transaction illustrates the dramatic and unfettered growth of so-called “cookie-less” cross-screen/device-tracking...The commission should not wait until American privacy is further undermined through the dramatic growth of these new “cookie-less” commercial tracking practices. Action is required now

Apple iPhone/mobile payments era poses threats and opportunities for consumers, especially those financially at risk Washington: Two leading consumer organizations told the Consumer Financial Protection Bureau (CFPB) today to issue rules so consumers can use mobile financial services without placing their privacy at risk or exposing themselves to new forms of predatory lending and other unfair practices. The groups—U.S. PIRG and the Center for Digital Democracy (CDD)— submitted comments to the agency as part of its inquiry on mobile financial services. They called for a series of safeguards on mobile and other digital financial applications, including on data collection, online financial marketing, mobile payments and other key applications. “The CFPB has a short window to ensure that the public receives the necessary consumer safeguards, especially for financial applications and their privacy, as they increasingly rely on mobile devices for banking, payments, credit applications, shopping, e-commerce, and other services,” explained Ed Mierzwinski, Consumer Program Director for U.S. PIRG. “Otherwise, unfair business practices will become entrenched in the marketplace and hard to stop.” The introduction yesterday of Apple’s mobile payment system is just the latest development transforming how Americans save and spend their money in the digital era. The Internet is quickly becoming the foundation for banking and other financial services, from mobile deposits, online loans, and digital payments. Financial services companies will spend $6.20 billion in 2014 promoting lending, credit cards and related services, a figure that is predicted to grow to $9.57 billion by 2018. $2.2 billion was spent this year for mobile financial marketing targeting consumers. Mobile payments and other digital financial services are integrated into a broad set of online industry marketing practices, which require CFPB action, explained the groups. Industry practices described in the filing as requiring CFPB action include the following: Data collection and profiling, The use of real-time location, How “apps” and other digital financial applications are designed to trigger consumer behavior, The special targeting of multicultural groups, including African Americans and Hispanics, and, How “Big Data” technologies raise privacy and other consumer protection concerns. The growing use of “lead generation” on mobile devices, where a consumer’s data can be stealthily collected and sold to credit card, banking and other financial companies so they can be targeted with offers. the use of data profiles and location to micro-target consumers in real-time with payday loans and other costly financial products. “Contemporary mobile practices that take advantage of the powerful capabilities of online financial marketing raise questions about whether consumers will well-served in the long-run, said Jeff Chester, CDD executive director. For example, economically vulnerable consumers—or any other American on a budget—could be bombarded with highly sophisticated offers urging them to spend that take advantage of their data, buying habits, family composition, ethnicity and more. Without fair rules, such practices could undermine their ability to protect their financial security. That’s why we call on the CFPB to take action now,” he explained. “Without question, the convenience and power of mobile devices and applications provide financially at risk, unbanked, and other vulnerable consumers greater opportunities to save money on banking transactions and payments, have additional ways to build financial resources, make more effective decisions on purchasing,” Mierzwinski concluded. “But few consumers understand or can effectively control how mobile and other digital financial products actually operate; as a result we believe they also pose serious risks unless safeguards are enacted.” **** U.S. PIRG is the non-profit, non-partisan federation of state Public Interest Research Groups. The PIRGs are public interest advocacy organizations that take on powerful interests on behalf of their members. On the web at www.uspirg.org (link is external) The Center for Digital Democracy (CDD) addresses contemporary digital marketing and privacy issues, including their impact on public health, children and youth, and financial services. On the web at www.democraticmedia.org In March, U.S. PIRG and CDD released the report “Big Data Means Big Opportunities and Big Challenges: Promoting Financial Inclusion and Consumer Protection in the “Big Data” Financial Era.” It is available at http://www.uspirg.org/reports/usf/big-data-means-big-opportunities-and-big-challenges (link is external).

Washington, DC: The key framework that is supposed to protect EU citizens’ privacy when their data is collected by U.S. companies—known as the U.S.-EU Safe Harbor—is failing to provide them the safeguards that were promised, according to a complaint filed today by a leading U.S. consumer privacy group—the Center for Digital Democracy (CDD). The complaint, filed at the U.S. Federal Trade Commission (FTC), details how these companies are compiling, using, and sharing EU consumers’ personal information without their awareness and meaningful consent, in violation the Safe Harbor framework. Overseen by the U.S. Department of Commerce, the Safe Harbor is based on a voluntary “self-certification” process, in which companies that promise to provide clear “notice” (of their data-collection practices and data uses) and “choice” (giving consumers the opportunity to “opt out” of practices they did not previously agree to) are then allowed to collect information from European consumers without strictly following the EU’s higher data-protection standards. The EU has itself recognized that the current Safe Harbor regime is inadequate, and has called for its revision. CDD’s filing at the FTC, which is the agency that is supposed to ensure that the Safe Harbor system protects EU consumers’ privacy, calls for an investigation of 30 companies involved in data profiling and online targeting, including data brokers that have compiled vast amounts of sensitive information on individual consumers; data management platforms that allow their corporate clients to analyze their own consumer information and combine it with outside data sources to produce detailed marketing insights; and mobile marketers that track devices and tie them to user profiles in order to identify the most profitable consumers for personalized advertising. “The U.S. is failing to keep its privacy promise to Europe,” said Jeff Chester, CDD’s executive director. “Instead of ensuring that the U.S. lives up to its commitment to protect EU consumers, our investigation found that there is little oversight and enforcement by the FTC. The Big Data-driven companies in our complaint use Safe Harbor as a shield to further their information-gathering practices without serious scrutiny. Companies are relying on exceedingly brief, vague, or obtuse descriptions of their data collection practices, even though Safe Harbor requires meaningful transparency and candor. Our investigation found that many of the companies are involved with a web of powerful multiple data broker partners who, unknown to the EU public, pool their data on individuals so they can be profiled and targeted online.” Although the companies cited for FTC investigation differ in their various approaches to data collection for the purposes of profiling and targeting individual consumers, the filing identified five broad concerns that illustrate the inadequacy of the Safe Harbor regime: (1) the failure of Safe Harbor declarations and required privacy policies in particular to provide accurate and meaningful information to EU consumers; (2) an overall lack of candor from the companies about the nature of their data collection apparatus, including their networks of data broker partners and even their corporate affiliations; (3) the general failure to provide meaningful opt-out mechanisms that EU consumers can find and use to remove themselves fully from privacy-harming data collection and processing; (4) the myth of “anonymity” at a time when marketers—armed with vast amounts of details about consumers’ personal needs and interests, employment and social status, location and income—do not need-to-know one’s name in order to track and target that particular individual online; and (5) the false claim made by several companies named in the complaint that they act as “data processors” on behalf of others, when in fact they play a central role in bringing the power of their Big Data-driven services to bear on consumer profiling and targeting. As CDD Legal Director Hudson Kingston explained, “CDDs complaint describes the systemic failure of the Safe Harbor to function as it was intended. Companies are flouting standards that the Department of Commerce agreed to and the Federal Trade Commission pledged to enforce. Safe Harbor has to be overhauled to make sure it actually works; until that time, it should be suspended. We call on the FTC to investigate and sanction the companies named in our complaint. The fundamental privacy right of 500 million Europeans has been ignored and must be acknowledged and protected going forward.” “The U.S. and EU are currently negotiating a trade agreement that will enable U.S. companies to gather even more data on Europeans,” Chester added. “Reform of Safe Harbor is urgently required before it becomes a ‘Get Out of Protecting Privacy’ card used by American companies under the forthcoming Transatlantic Trade and Investment Partnership (T-TIP).” The 30 companies cited in CDD’s filing include Acxiom, Adara Media, Adobe, Adometry, Alterian, AOL, AppNexus, Bizo, BlueKai, Criteo, Datalogix, DataXu, EveryScreen Media, ExactTarget, Gigya, HasOffers, Jumptap, Lithium, Lotame, Marketo, MediaMath, Merkle, Neustar, PubMatic, Salesforce.com, SDL, SpredFast, Sprinklr, Turn, and Xaxis. The Center for Digital Democracy is a nonprofit group working to protect the public in the digital era from unfair practices that threaten their privacy, especially in the financial and health sectors. --30--

"Amazon’s policies of making it simple for children to accidentally spend hundreds of dollars in a “kids” app, and its apparent refusal to refund the money to complaining parents, are irresponsible and unfair. Today’s FTC action shows that consumers who have been charged for their kids unauthorized in-app purchases should not have to foot the bill. Amazon’s failure to deal fairly with people who purchased its devices and use its apps suggests it places making money as quickly as possible over serving the interests of their consumers. As Amazon gears up to release a new phone, and expands its impact on the mobile industry and consumers, the FTC’s complaint should serve as a wake-up call for better corporate ethics.” Hudson B. Kingston Legal Director Center for Digital Democracy

As part of the Children's Online Privacy Protection Act (COPPA), the federal law protecting the digital privacy of kids 12 and under (and which empowers parents or other key caregivers to control the data collected from children), a so-called "Safe Harbor" system was created. The theory being that companies joining a FTC approved Safe Harbor regime, which is commited to ensuring meaningful compliance with COPPA, is an effective way to have companies follow the law. Yesterday was the deadline for Safe Harbor reports to be submitted to the FTC, and the first once since the new stronger safeguards on COPPA (covering multiple devices and applications, for example), went into effect. CDD has many concerns about how COPPA Safe Harbor is working, which we have explained to the FTC. Our legal and research team is focusing on how these Safe Harbor systems actually operate--so expect to see this issue heat up in next year. We requested all the Safe Harbor reports, including from the: kidSAFE Seal Program, Aristotle International Inc., Children’s Advertising Review Unit (CARU), Entertainment Software Rating Board (ESRB), Privacy Vaults Online, Inc. (PRIVO), and TRUSTe. Here's a statement from Eric Null, staff attorney at the Institute for Public Representation at Georgetown University Law Center. Eric serves as counsel to CDD: "The safe harbor annual reports provide vital information about the conduct of the COPPA safe harbor programs. Without seeing these reports, parents and the public will remain uninformed about how effective the safe harbors are at protecting children against harmful online data practices. Jeff Chester, CDD's executive director, explained that this work is part of our ongoing "Unsafe Harbor" consumer and privacy protection initiative, which is also examining how the U.S. protects the privacy of European citizens through a Safe Harbor program operated by the Department of Commerce.

The Federal Trade Commission has issued a powerful and disturbing privacy wake-up call. The report reveals the largely invisible Big Data-driven complex that regularly spies on every American, comprehensively following our activities both online and off. It delivers a critical “black eye” to the data-broker industry, which has cynically expanded its surveillance on Americans without regard to their privacy. Unlike the White House’s Big Data reports issued earlier this month, the FTC study provides a much more realistic—and chilling—analysis of an out-of-control digital data collection industry. However, the commission’s calls for greater transparency and consumer control are insufficient. The real problem is that data brokers—including Google and Facebook—have embraced a business model designed to collect and use everything about us and our friends—24/7. Legislation is required to help stem the tide of business practices purposefully designed to make a mockery of the idea of privacy for Americans.******Here are the key findings from the FTC report that illustrate how the data industry requires major reform:VIII. FINDINGS AND RECOMMENDATIONS This report reflects the information provided in response to the Orders issued to nine data brokers, information gathered through follow-up communications and interviews, and information gathered through publicly available sources. Based primarily on these materials about a cross-section of data brokers, the Commission makes the following findings and recommendations: A. Findings 1. Characteristics of the Industry ⊲⊲ Data Brokers Collect Consumer Data from Numerous Sources, Largely Without Consumers’ Knowledge: Data brokers collect data from commercial, government, and other publicly available sources. Data collected could include bankruptcy information, voting registration, consumer purchase data, web browsing activities, warranty registrations, and other details of consumers’ everyday interactions. Data brokers do not obtain this data directly from consumers, and consumers are thus largely unaware that data brokers are collecting and using this information. While each data broker source may provide only a few data elements about a consumer’s activities, data brokers can put all of these data elements together to form a more detailed composite of the consumer’s life. ⊲⊲ The Data Broker Industry is Complex, with Multiple Layers of Data Brokers Providing Data to Each Other: Data brokers provide data not only to end-users, but also to other data brokers. The nine data brokers studied obtain most of their data from other data brokers rather than directly from an original source. Some of those data brokers may in turn have obtained the information from other data brokers. Seven of the nine data brokers in the Commission’s study provide data to each other. Accordingly, it would be virtually impossible for a consumer to determine how a data broker obtained his or her data; the consumer would have to retrace the path of data through a series of data brokers. ⊲⊲ Data Brokers Collect and Store Billions of Data Elements Covering Nearly Every U.S. Consumer: Data brokers collect and store a vast amount of data on almost every U.S. household and commercial transaction. Of the nine data brokers, one data broker’s database has information on 1.4 billion consumer transactions and over 700 billion aggregated data elements; another data broker’s database covers one trillion dollars in consumer transactions; and yet another data broker adds three billion new records each month to its databases. Most importantly, data brokers hold a vast array of information on individual consumers. For example, one of the nine data brokers has 3000 data segments for nearly every U.S. consumer. ⊲⊲ Data Brokers Combine and Analyze Data About Consumers to Make Inferences About Them, Including Potentially Sensitive Inferences: Data brokers infer consumer interests from the data that they collect. They use those interests, along with other information, to place consumers in categories. Some categories may seem innocuous such as “Dog Owner,” “Winter Activity Enthusiast,” or “Mail Order Responder.” Potentially sensitive categories include those that primarily focus on ethnicity and income levels, such as “Urban Scramble” and “Mobile Mixers,” both of which include a high concentration of Latinos and African Americans with low incomes. Other potentially sensitive categories highlight a consumer’s age such as “Rural Everlasting,” which includes single men and women over the age of 66 with “low educational attainment and low net worths,” while “Married Sophisticates” includes thirty-something couples in the “upper-middle class . . . with no children.” Yet other potentially sensitive categories highlight certain health-related topics or conditions, such as “Expectant Parent,” “Diabetes Interest,” and “Cholesterol Focus.” ⊲⊲ Data Brokers Combine Online and Offline Data to Market to Consumers Online: Data brokers rely on websites with registration features and cookies to find consumers online and target Internet advertisements to them based on their offline activities. Once a data broker locates a consumer online and places a cookie on the consumer’s browser, the data broker’s client can advertise to that consumer across the Internet for as long as the cookie stays on the consumer’s browser. Consumers may not be aware that data brokers are providing companies with products to allow them to advertise to consumers online based on their offline activities. Some data brokers are using similar technology to serve targeted advertisements to consumers on mobile devices.

Statement from Hudson Kingston, CDD Legal Director: CDD filed comments with the FTC on a proposed new COPPA safe harbor that would be run by iKeepSafe. The COPPA Rule allows entities that want to become a safe harbor to apply to formally certify that “operators” covered by the law are complying with all of its requirements. As such, it is imperative that each safe harbor ensure compliance by participating companies. CDD’s comments outline two major deficiencies in the application: the application, far from proving that the safe harbor will be properly staffed and show the requisite expertise and technical skill needed to do the job, suggests that this safe harbor is incapable of doing the job, since it does not demonstrate necessary expertise and institutional capacity to apply COPPA; secondly, the application is not as stringent as the COPPA Rule because it weakens operators’ legal duties and potentially muddles key regulatory standards. Such changes in operators’ COPPA duties making them less stringent or ambiguous suggests a safe harbor could be planning to provide lesser protection than the law—the COPPA Rule forbids such backsliding. “FTC should not approve safe harbor applications unless it is absolutely clear that the proposed safe harbor will provide equal or better protection of children’s information than the COPPA Rule, and this proposed system would fall far short of the standard,” said CDD’s legal director, Hudson Kingston. “Unless the existing and new safe harbors are held to an exacting standard the law will be undercut by inadequate enforcement—as the agency responsible for COPPA, FTC must not allow self regulation to work against its intended purpose.” and from Jeff Chester: Beyond the technical matters we raise in the attached comments, I also want to point out a few other issues. First, iKeepSafe claims on its website they "partner" (link is external)with the Federal Trade Commission. Here's what they say: NATIONAL GOVERNMENT PARTNERS FEDERAL TRADE COMMISSION (FTC) iKeepSafe is a contributor to the FTC’s NetCetera and a member of the Ad Council’s Internet Safety Coalition. As if somehow the Ad Council is the same as the FTC! Such a statement is misleading to parents. It's also noteworthy to point to their "corporate partners," (link is external) many of whom are major digital data collection companies with a stake in the youth targeting industry. They include AOL, (link is external) ATT, (link is external) Comcast, (link is external) Facebook (link is external), Fox (link is external), Google (link is external), McDonald's (link is external), Verizon (link is external)and Yahoo (link is external).

General Mills has changed its privacy policy (link is external) to say, according (link is external) to the New York Times, so consumers now "give up their right to sue the company if they download coupons, “join” it in online communities like Facebook, enter a company-sponsored sweepstakes or contest or interact with it in a variety of other ways.Instead, anyone who has received anything that could be construed as a benefit and who then has a dispute with the company over its products will have to use informal negotiation via email or go through arbitration to seek relief, according to the new terms posted on its site." General Mills uses a wide range of digital media, including Facebook (link is external), mobile marketing (link is external), apps, (link is external) digital discount (link is external)coupons, contests (link is external) to help schools (Boxtops for Education), YouTube (link is external), Twitter, (link is external) specialized "target" marketing to Hispanics (link is external) and more as part of its marketing campaigns. Is it now saying that if a consumer wants to take advantage of any of the online offers that General Mills deliberately promotes, they must give up their consumer rights? And have you looked at its privacy (link is external)policy, where even teens can be targeted online, and which acknowledges that its partners may track you using behavioral eavesdropping tactics? However, this incident helps to uncover how food marketing companies are engaged in largely stealth digital tactics that unfairly collect our information, including from young people. Here are key and revealing excerpts from the General Mills privacy policy: Information we collect We may collect information about you (and the computer or device you use to access our Site) in a variety of ways: You may directly provide information to us You may choose to allow a social networking service to share information with us We may gather other information when you visit our Site or other services, or when you view our online ads We may obtain additional information about you from other sources where permitted by law... Information from social networking services If you choose to access or make use of third-party social networking services (such as Facebook or Twitter), we may receive personal information about you that you have made available to those services, including information about your contacts on those services. For example, some social networking services allow you to push content from our Site to your contacts or to pull information about your contacts so you can connect with them on our Site. Some social networking services also will facilitate your registration or log-in for our Site or enhance or personalize your experience on our Site. Your decision to use a social networking service will always be voluntary. However, you should make sure you are comfortable with the information social networking services may make available to our Site by visiting those services’ privacy policies. Information we gather when you visit our Sites, or when you view our online ads When you visit or use our Sites, or when you view our online ads, we may use cookies, web beacons, or other technologies to collect information about your computer or device and your online activity. The following are examples of the types of information we may collect in this way: Device type (such as desktop, tablet, or mobile device) Browser type (such as Internet Explorer) Operating system (such as Windows) IP address, MAC address, device ID, installed fonts, or similar information Websites or online services you visit before or after our Site Your interaction with our Site (such as the links you click and the pages and items you view) Whether you open or forward our emails or click on elements within these emails Information we may obtain from other sources We may obtain information about you from other sources, such as public databases, other brands and groups within General Mills, data aggregators, and other commercially available sources. This information may include: Name Email address Social networking user IDs Postal address Phone number Age Gender Demographic information Marital status and number and age of children Income level Purchasing behavior Interests, hobbies, and product preferences Interactions with media or advertising Publicly observable activities (such as blogs and online postings) Other information that has been collected by other brands or businesses within the General Mills family of companies... Cookies used for online behavioral advertising – and your choice to opt out Third parties that are involved in serving other companies’ advertising on our sites, or that are involved in determining which advertisements to show you on third-party websites, may use cookies to collect information about your online activities, such as the advertisements you have seen or the websites or pages you have visited, in order to draw inferences about what advertising might be relevant to you. These third parties may use the information gathered through these cookies to show you advertising they believe to be most relevant to you when you visit other websites not belonging to us. This practice is called “online behavioral advertising.” You have the ability to opt out of allowing these third parties to use cookies for online behavioral advertising by clicking here (link is external).

The Federal Trade Commission's Bureau of Consumer Protection sent a letter (link is external) to Facebook and Whatsapp [attached] requiring the companies to honor the latter's privacy promises (no advertising, highly limited data collection etc). Facebook is in the process of acquiring Whatsapp. The Electronic Privacy Information Center (EPIC) and CDD sent (link is external) two letters to the FTC urging the commission to address the privacy implications of the pending merger. The FTC's letter states that [excerpt]: WhatsApp has made a number of promises about the limited nature of the data it collects, maintains, and shares with third parties -promises that exceed the protections currently promised to Facebook users. We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC's order against Facebook. Jeff Chester CDD's executive Director said: "We believe that despite claims that they would preserve Whatsapp's more privacy-friendly approach, the ultimate plan was to expand its mobile data collection practices and fully integrate it into Facebook. Facebook's future depends on its ability to successfully grow its mobile advertising, commerce, and payment applications. It did not spend $19 billion without planning to reap huge financial rewards by turning Whatsapp into an effective monetization machine for Facebook. The FTC is to be commended for sending a very strong signal that they will hold Facebook and Whatsapp accountable for their promises. The commission's action has likely spoiled, for now, the plans Facebook has developed to turn its $19b shopping spree into even more digital gold for themselves." News reports say that the FTC has approved Facebook's deal with Whatsapp. But the commission's letter clearly connects the privacy concerns that EPIC and CDD raised that should be addressed in its merger review.