Before the

FEDERAL TRADE COMMISSION
Washington, D.C. 20580

WRITTEN COMMENT OF

TIME WARNER INC.

PUBLIC WORKSHOP ON CONSUMER INFORMATION PRIVACY
CONSUMER PRIVACY 1997-COMMENT, P954807

Date: April 15, 1997

INTRODUCTION AND SUMMARY

Time Warner Inc. ("Time Warner") is pleased to present these comments in response to the Notice issued by the Federal Trade Commission ("FTC")⁽¹⁾ to express views and share experiences regarding recent developments in providing online services. As the FTC stated in its Notice, "Sessions Two and Three are intended to update the Commission on the current status of the collection, compilation, sale, and use of personal information online, and on self-regulatory efforts and technological developments since June 1996."⁽²⁾

These comments provide a sampling of the practices and purposes underlying the collection and use of personal information online by our Time Warner Web sites. The comments also highlight self-regulatory efforts made by our sites to address privacy issues of concern to consumers and policy makers, and out of our own sense of responsibility to users and their children.

We believe that education is the best way to protect the privacy interests of consumers online. By contrast, outright government prohibitions on the collection, disclosure or use of personal information would dramatically set back the development of commerce online with the consequent adverse impact on the potential of this breathtaking new medium for the distribution of information. The FTC's efforts have encouraged Time Warner to take more concrete measures to address consumer privacy online, and we are finding electronically, as in the tangible world, that consumer education and consumer choice can resolve many of these issues. We are confident that society can best be served through a proper balancing of legitimate privacy interests and the promising opportunities provided by the development of Internet Web sites and services.

Time Warner supports over 190 sites and services. Of our more than 190 individual Web sites, very few collect personal information from site visitors. Many of our Web sites collect aggregate information from users, as contrasted with personally identifying information. A few of our sites, however, do collect personally identifying information, which is used for limited purposes, such as online sales transactions or contests. Other Web sites collect personally identifying information through voluntary online surveys. Thus, consumers may exercise choice as to whether or not to access information or services that require the provision of personally identifying information. E-mail communications sent by our sites to individual users are generally optional newsletters or updates specifically requested by the user.

Several popular Time Warner Web sites, including Pathfinder and Warner Bros. Online, provide notice of their online collection practices and policies. Other of our individual sites provide supplemental notices to raise consumer awareness that disclosure of personal information in public forums could compromise consumer privacy. Again, we believe that consumer education is the best way to safeguard consumer privacy interests online.

On the issue of children's privacy online, we are aware that the collection and use of information from children is of particular concern; however, very few Time Warner Web sites collect personal information from children. Some of the information collected by our sites from children is done in the form of surveys designed to solicit non-identifying information regarding children's interests and preferences. These surveys are meant to solicit aggregate, as contrasted with personally identifying information from children. We also collect personally identifying information from children for other very limited purposes, such as contests or newsletters. For example, an e-mail address would be necessary to deliver a Web site newsletter requested by the child. Of the few Web sites frequented by children that do collect personally identifying information, almost all encourage or advise children to ask a parent before providing personal information online.

As our responses to these questions will bear out, Time Warner is sensitive to the issue of privacy online and has taken significant steps to respect and protect the privacy interests of our users, notably including children. We are also committed to the indispensable steps of consumer education and industry awareness. Indeed, we are working to ensure that all of our Web sites comply with good privacy policy. This is why we actively support and cooperate with the work of the Direct Marketing Association and other industry groups to address these issues responsibly.

Session Two: Consumer Online Privacy

2.1 What kinds of personal information are collected by commercial Web sites from users who visit those sites and how is such information subsequently used? Among other things, is clickstream data being collected and tied to personally identifying information?

Time Warner supports over 190 individual Internet Web sites, including its Pathfinder network and Warner Bros. Online multiplex site. Although clickstream data is often automatically collected in order to determine site activity levels, Time Warner Web sites and Road Runner service (available only to certain cable subscribers) do not tie such data to personally identifying information. For example, Time Warner's Pathfinder and Warner Bros. Online sites routinely collect information such as the number of site visitors, duration of visits, the areas visited by users and the amount of pageviews generated in specific content areas, but do not tie such data to personally identifying information. Time Warner's recently launched Road Runner service also collects aggregate usage data but does not tie such information to individual users. Thus, personally identifying information is not collected as a matter of course.

Nevertheless, some Time Warner Web sites collect personally identifying information through voluntary disclosure by users. These sites solicit and collect a very limited amount of personally identifying information from users depending upon the individual site and purpose underlying the information collection. For instance, information such as a user's e-mail address may be collected if the consumer requests that he/she be put on a Web site mailing list in order to receive notification of new information. Warner Bros. Records and Atlantic Records, for example, provide users with the option of joining a mailing list of individuals who automatically receive information regarding new releases and online events. Pathfinder offers a similar e-mail service entitled "Compass," which provides users with the highlights of new content features appearing on Pathfinder.

The Pathfinder network provides access to a number of popular Time Warner Web sites, such as S.I. (Sports Illustrated) Online, People, and Money. Pathfinder visitors are not required to provide personally identifying information. Thus, users are free to browse the Pathfinder Web sites in relative anonymity. If, however, the user desires access to additional services or customized information, he/she is asked to become either a member or subscriber and provide a very limited amount of personally identifying information. Users seeking to post messages to bulletin boards must become a Pathfinder member, whereas users seeking access to personalized news and information must subscribe to Pathfinder Personal Edition. Users applying for membership, purchasing a subscription to Pathfinder Personal Edition, or purchasing a product are asked to provide their full name, address, e-mail address, and date of birth. In addition, purchasing users are asked to provide a credit card number, expiration date and billing address to ensure payment for services rendered.

Warner Bros. Online provides an entry point to a number of popular Warner Bros. Web sites, such as Warner Bros. Animation, Warner Bros. Studio (or Warner Bros. Movies), and Warner Bros. Records. Users are not required to provide personally identifying information in order to access and browse the Warner Bros. Online Web sites. A limited amount of personally identifying information may be collected if a user chooses to enter an online contest or game, receive an online newsletter, or send a WebCard to a fellow user; however, such activities are purely optional.

Time Warner Web sites supporting sales transactions collect the personally identifying information necessary to complete the sales transaction and deliver the product. For example, the Warner Bros. Online Studio Store permits users to purchase Warner Bros. products online. The Warner Bros. Online Studio Store collects the personal information necessary to complete the purchase and deliver the item(s). In addition, Entertainment Media Services, Inc. ("EMS") provides direct fulfillment services to users visiting Time Warner record label Web sites. In order to purchase a product, EMS requires that a user provide a name, billing address and shipping address, telephone number, and e-mail address in order to purchase a music selection. Because such Web site services require credit verification and product delivery, it is necessary to obtain some personally identifying information from purchasing users.

Time Warner Web sites also collect user information through voluntary survey questionnaires. Pathfinder, for example, offers users a chance to win a free T-shirt if the user will complete a survey questionnaire. A vast majority of the survey questions, such as questions concerning Internet usage, online interests and employment information are designed to solicit general information on user demographics. Such information is subsequently used in the aggregate to determine who is using the service and the interests of those using the service so that Pathfinder can best service the needs and wants of users visiting Pathfinder Web sites. Other individual sites, such as DC Comics, also utilize voluntary survey questionnaires. DC Comics' Helix Web site, for example, has a "Reader Survey" that contains questions relating to the Helix comic series. In addition, the EMS Web site asks users to complete a voluntary survey questionnaire. The personal information obtained by EMS is used to better target future promotions and new product releases.

2.2 To what extent is the collection, compilation, sale or use of personally identifying, as opposed to aggregate, personal information important for marketing online and for market research? What privacy concerns, if any, are raised by the collection or use of aggregate personal information in this context?

The collection and compilation of personally identifying information is critical to marketing online if Web site owners engage in marketing practices that are targeted to individuals. As the FTC staff recently noted, "subscriber profiling" is one type of marketing used to target individual users. Public Workshop on Consumer Privacy on the Global Information Infrastructure, Staff Report, Bureau of Consumer Protection, Federal Trade Commission at 7 (Dec. 1996). Subscriber profiling is "the creation of individual profiles based upon subscribers' usage and purchasing patterns, in order to advertise to subscribers." Id.

Some Time Warner Web sites use personally identifying information to perform individual advertising. These Web sites, however, collect much of this personally identifying information via voluntary subscriber surveys, not from tracking usage or purchasing patterns. For example, the Entertainment Media Services site, which is a transaction and fulfillment system that connects to Time Warner record label sites, contains a survey that elicits personally identifying information that is used to target future promotions and new product releases.

Personally identifying information is important to marketing online in that it can be used to determine individual product preferences. Such preferences can be used by Web sites to ensure that consumers receive information only about products in which they would likely be interested.

Significant marketing research can be accomplished by using personally identifying information in the aggregate. For example, the Pathfinder site has occasionally conducted user surveys as part of a sweepstakes. The information is subsequently used in the aggregate for marketing research, audience research, and advertising research. Names are often collected in surveys to prevent the duplication of information.

Privacy concerns are generally limited to personally identifiable information. There are no privacy concerns where information is aggregated so that individuals cannot be identified. See 18 U.S.C. § 2710(a)(3) (excluding aggregate data from the scope of video privacy protection provisions); 47 U.S.C. § 222 (c)(3) (not requiring customer approval for telecommunications carrier use of aggregate customer data); id. § 551 (a)(2) (excluding aggregate data from the scope of cable TV subscriber privacy provisions). Cf. The Direct Marketing Association Guidelines for Personal Information Protection (defining "personal data" as information that "is linked to an individual on a file").

2.3 What are the risks, costs, and benefits of collection, compilation, sale, and use of personal consumer information in this context?

The collection and use of personally identifying information results in significant benefits to online consumers. Time Warner Web sites are able to offer consumers the benefits of newsletter services and updates only if personally identifying information is collected. Also, Web sites can offer users the convenience of entering a sweepstakes and receiving award notification online only if personally identifying information is provided.

In addition, the collection and use of personally identifying information may be used to better target the marketing of future promotions and new product releases to specific individuals who have enjoyed Time Warner sites or purchased Time Warner products or services in the past. Personally identifying information regarding such individuals can be used to compile marketing lists for future reference and use. These lists ensure that consumers are notified of promotions and new products or services in which they would be interested. In addition, these lists spare consumers from receiving promotional material for products or services in which they exhibited no interest. These marketing lists can also result in cost savings to Web site owners since they limit marketing only to those individuals who are most likely to be interested in such products and services.

The ability to identify individuals who post information on Web site bulletin boards and in chat areas also benefits both Web site owners and consumers alike in that it allows Web site owners to identify users who post illegal or violative information. Only personally identifying information permits Web site owners to properly assign responsibility for violative acts, thereby preventing Web site owners from falsely accusing users of improper conduct.

2.5 How many commercial Web sites collect, compile, sell, or use personal information? Of these, how many give consumers notice of their practices regarding the collection and subsequent use of personal information? With respect to such Web sites, describe (1) how and when such notice is given, (2) the content of such notice, and (3) the costs and benefits, for both consumers and commercial Web sites, of providing such notice.

Most of the Time Warner Web sites that collect personally identifying information through voluntary disclosure already provide notice of their practices at the point of data collection. For example, Entertainment Media Services notifies users at the top of its survey page, and Warner Bros. Records notifies its users at the top of the mailing address sign-on page. In addition, Pathfinder offers users a chance to win a free T-shirt if the user will complete a survey questionnaire. The official rules accompanying that survey/contest state that "[e]xcept as required by law, Pathfinder will not share entrant information with any third parties. Pathfinder may contact entrants in the future with offers we feel may be of interest." The HBO Site offers users an opportunity to submit comments, jokes, and poems that, along with a user's name and e-mail address, may be posted on the Web site; a notice next to the "submit" button states that the information provided may be used by HBO in any manner. Thus, many Web sites are aware of privacy concerns and are already attempting to educate consumers about the collection and use of personally identifying information online.

Time Warner is continuing its efforts to ensure that users visiting affiliated Web sites receive notice of the site's online practices regarding the collection and subsequent use of personal information. Many Internet users access Time Warner Web sites via the Warner Bros. Online multiplex site or the Pathfinder network. Both the Warner Bros. Online and Pathfinder sites contain notices regarding the collection of personal information and the subsequent use of such collection. The detailed privacy notice provided by Warner Bros. Online, for example, contains information concerning the Web site's collection practices, the purposes underlying information collection, and the subsequent use of collected information. This notice can be found one screen away from the Warner Bros. Online home page at www.warnerbros.com.

In addition, Pathfinder members and subscribers receive notice regarding the collection and use of personal information via the Pathfinder Subscriber's and Member's Agreement. The Pathfinder "sign-up" sheet attaches a copy of the Pathfinder Subscriber's and Member's Agreement. Paragraph 14 of the Agreement provides that personal data collected online by Time Warner will be used only "in connection with the Online Services and will not be given to others." Pathfinder is also in the process of reviewing its current notice in order to ensure that the notice provided is sufficiently prominent and effective.

Moreover, some individual Time Warner Web sites contain privacy notices. CNN's "Feedback" option, for example, clearly states that CNN "may share your comments with our users by posting them on one of our feedback pages. We won't use your name or address, however, without your permission." The site then provides a box the user must check in order to give authorization to CNN to use the name and e-mail address provided on the Web site or other CNN network.

2.6 Of the commercial Web sites that collect, compile, sell, or use personal information, how many provide consumers choice with respect to whether and how their personal information is to be collected and subsequently used by those sites? With respect to these Web sites, describe (1) what choices are provided to consumers and how such choices are exercised; and (2) the costs and benefits, for both consumers and commercial Web sites, of providing such choices.

Consumers visiting Time Warner Web sites are not required to provide personally identifying information in order to access most of the information and entertainment on those sites. Thus, consumers may exercise choice as to whether or not to access information or services that require the provision of personally identifying information.

Personally identifying information is collected only when the consumer makes an affirmative decision to access additional Web site features or purchase additional services. For example, Pathfinder requires the collection of personally identifying information only when a consumer is seeking access to additional features or services, such as the ability to post messages to bulletin boards.

Time Warner record label sites, such as Atlantic Records and Warner Brothers Records, typically offer users the opportunity to receive a newsletter or updates about artists, album release information, and tour dates. In order to receive these newsletters or updates, a user must furnish an e-mail address. Receiving these services, however, is purely optional, thereby allowing users to choose whether their personally identifying information is collected.

2.8 Of the commercial Web sites that collect, compile, sell, or use personal information, how many have procedures to maintain the security of personal information collected from consumers online, and what are those procedures?

Time Warner sites employ numerous procedures to maintain the security of personal information collected from users. Pathfinder uses password protection to secure information, as well as a transmission encryption system to secure areas that contain private information. Other sites, such as Warner Bros. Online, Warner Bros. Records, and Atlantic Records operate firewall* protected servers to ensure information security. Moreover, Web sites supporting sales transactions, like Electronic Media Services, typically use both firewall protected servers and password protection.

Individual Time Warner Web sites have also adopted in-house policies and procedures to maintain the security of personal information collected from consumers online. For example, Warner Bros. Online has a policy specifically prohibiting the release of any personal information, including users' e-mail addresses, to third parties.

Procedures regarding the retention of personal information vary among Web sites. For instance, Warner Brothers Records purges user information after he/she asks to be dropped from a specific list, whereas Entertainment Media Services purges credit card dates after each order.

2.20 How many commercial entities have implemented the Principles for Unsolicited Marketing E-mail presented at the June 1996 Workshop by the Direct Marketing Association and the Interactive Services Association?

Unsolicited e-mail marketing is not a widespread practice among Time Warner Web sites, but most of the units that engage in e-mail communications with users satisfy key elements of the Principles for Unsolicited Marketing E-mail. DC Comics and Time Warner record label sites, such as Atlantic Records and Warner Bros. Records, typically offer users the opportunity to receive a newsletter or updates about artists, album release information, and tour dates. Users must choose to receive these services. Most of the Web sites engaging in e-mail communications with users provide consumers with an opportunity to opt out from future solicitations.

Furthermore, Time Warner Web sites providing access to chat areas or bulletin boards often inform individuals using these areas that information they voluntarily disclose in these areas may result in unsolicited messages to them by others. For example, Pathfinder's Subscriber's and Member's Agreement states that personal information disclosed in online bulletin boards, chatrooms and other interactive areas can be collected and used by third parties. Such notice is primarily intended to make consumers aware that providing personally identifying information in public forums could have additional privacy implications. The HBO site offers users an opportunity to submit comments, opinions, jokes, poems, and stories which may be posted on the Web site. In order to make a submission, users are asked to provide a name and e-mail address. Next to the "submit" button is a notice warning users that posted e-mail addresses may result in the receipt of unsolicited messages from third parties.

Session Three: Children's Online Privacy

3.1 What kinds of personal information are collected by children's commercial Web sites from children who visit those sites and how is such information subsequently used? Among other things, is clickstream data being collected and tied to personally identifying information about children; is information being collected from children to create lists for sending unsolicited e-mail?

Children's Web sites supported by Time Warner sometimes solicit a limited amount of personal information from children online. First, although clickstream data is often automatically collected in order to determine site activity levels, children's Web sites do not tie such data to personally identifying information. Second, the majority of personal information collected by these Web sites is done in the form of surveys designed to solicit non-identifying information regarding children's interests and hobbies. Such information is subsequently used in the aggregate to determine site demographics. Finally, in other instances, information such as a child's name, age and e-mail address are sometimes requested by Web sites.

Time Warner Web sites frequented by children collect personally identifying information for very limited purposes. For instance, information such as a user's e-mail address may be collected if the child requests that he/she be put on a Web site mailing list in order to receive notification of new information. DC Comics for example, provides users with the option of receiving a DC Comics newsletter. In order to deliver the newsletter, however, DC Comics must receive a e-mail address. S.I. (Sports Illustrated) for Kids collects information from children entering the "fantasy leagues." Because such leagues provide users with updates regarding team standings and player statistics, it is necessary to obtain an e-mail address and name from the user entering the league.

In addition, the S.I. for Kids Web site collects personally identifying information so that S.I. for Kids can contact children whose survey responses have been selected for publication in S.I. for Kids magazine. Specifically, S.I. for Kids recently conducted an online survey entitled "Kids Debate: Do Skateboarders Still Rule?" The survey asked children whether they had an opinion on this subject and provided an area for comment. In addition, personally identifying information such as the child's name, e-mail address, age, town and state was requested in order to maintain contact with the user in the event that the comments are included in the S.I. for Kids publication. The survey states that such information is not released to third parties.

3.5 How many children's commercial Web sites collect, compile, sell, or use children's personal information? Of these, how many give parents notice of their practices regarding the collection and subsequent use of personal information? With respect to such Web sites, describe (1) how and when such notice is given; (2) the content of such notice; and (3) the costs and benefits, for both parents and children's commercial Web sites, of providing such notice.

Of the over 190 Time Warner Web sites available on the Internet, very few knowingly collect information from children.

Because many of these Web sites are accessed via Warner Bros. Online or Pathfinder, parents and children are provided with a notice describing Time Warner's practices regarding the collection and subsequent use of personal information. In addition to the Pathfinder notice, some individual Pathfinder Web sites contain notices regarding the collection and use of personal information. For example, the S.I. for Kids Web site contains a survey including questions soliciting personally identifying information. Questions soliciting personally identifying information, however, are clearly marked with an asterisk that references a privacy notice. The notice states: "Be sure to ask your parents for permission before you send any personal information over the Internet. We need your hometown and phone number so we can contact you if we decide to put your answer in the magazine. We will not give your personal information to anybody else." Warner Bros. Online also reminds children to ask their parents for permission before signing up for the site's e-mail newsletter. Thus, children visiting these Web sites are encouraged to obtain parental consent before providing any personally identifying information.

Time Warner Web sites frequented by children may sometimes support sales transactions. DC Comics' Web site, for example, offers subscription sales to users over the Internet. In order to prevent unauthorized sales to children, DC Comics provides a notice encouraging children to have an adult supervisor review the information the child provides before purchasing a subscription online.

The benefit of providing such notices for children and parents is the provision of information. The provision of information is the only way parents can engage in informed decision-making on behalf of their children. Unless a parent is made aware that information is being collected, and is informed as to a Web site's information collection practices and purposes, they will be unable to decide whether the provision of information is safe and in the child's best interest. For children, the privacy notices remind children to act responsibly when providing information online by consulting with a parent.

* A "firewall" is computer software that allows messages coming from outside the system to be read and, at the same time, prevents such messages from harming the system through the delivery of viruses or by other destructive means.

1. Federal Trade Commission, Public Workshop on Consumer Information Privacy, "Notice Requesting Public Comment and Announcing Public Workshop," 62 Fed. Reg. 10,271 (Mar. 6, 1997) ("Notice").

2. Id.