Prepared Statement of
The Federal Trade Commission
"Online Profiling: Benefits and Concerns"

Before the

Committee on Commerce, Science, and Transportation
United States Senate

Washington, D.C.

June 13, 2000

Mr. Chairman and Members of the Committee, I am Jodie Bernstein, Director of the Bureau of Consumer Protection of the Federal Trade Commission.⁽¹⁾ I appreciate this opportunity to discuss the Commission's report on profiling issued today.⁽²⁾ The report describes the nature of online profiling, consumer privacy concerns about these practices, and the Commission's efforts to date to address these concerns. The Commission is not making any recommendations at this time.

As it has in other areas, the Commission has encouraged effective industry self-regulation, and the network advertising industry has responded with drafts of self-regulatory principles for our consideration. As discussed further in this testimony, there are real challenges to creating an effective self-regulatory regime for this complex and dynamic industry, and this process is not yet complete. The Commission will supplement this report with specific recommendations to Congress after it has an opportunity to fully consider the self-regulatory proposals and how they interrelate with the Commission's previous views and recommendations in the online privacy area.

I. Introduction and Background

A. FTC Law Enforcement Authority

The FTC's mission is to promote the efficient functioning of the marketplace by protecting consumers from unfair or deceptive acts or practices and to increase consumer choice by promoting vigorous competition. As you know, the Commission's responsibilities are far-reaching. The Commission's primary legislative mandate is to enforce the Federal Trade Commission Act ("FTCA"), which prohibits unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce.⁽³⁾ With the exception of certain industries and activities, the FTCA provides the Commission with broad investigative and law enforcement authority over entities engaged in or whose business affects commerce.⁽⁴⁾ Commerce on the Internet falls within the scope of this statutory mandate.

B. Privacy Concerns in the Online Marketplace

Since its inception in the mid-1990's, the online consumer marketplace has grown at an exponential rate. Recent figures suggest that as many as 90 million Americans now use the Internet on a regular basis.⁽⁵⁾ Of these, 69%, or over 60 million people, shopped online in the third quarter of 1999.⁽⁶⁾ In addition, the Census Bureau estimates that retail e-commerce sales were $5.2 billion for the fourth quarter of 1999, and increased to $5.3 billion for the first quarter of 2000.⁽⁷⁾

At the same time, technology has enhanced the capacity of online companies to collect, store, transfer, and analyze vast amounts of data from and about the consumers who visit their Web sites. This increase in the collection and use of data, along with the myriad subsequent uses of this information that interactive technology makes possible, has raised public awareness and consumer concerns about online privacy.⁽⁸⁾ Recent survey data demonstrate that 92% of consumers are concerned (67% are "very concerned") about the misuse of their personal information online.⁽⁹⁾ The level of consumer unease is also indicated by a recent study in which 92% of respondents from online households stated that they do not trust online companies to keep their personal information confidential.⁽¹⁰⁾ To ensure consumer confidence in this new marketplace and its continued growth, consumer concerns about privacy must be addressed.⁽¹¹⁾

C. The Commission's Approach to Online Privacy - Initiatives Since 1995

Since 1995, the Commission has been at the forefront of the public debate concerning online privacy.⁽¹²⁾ The Commission has held public workshops; examined Web site information practices and disclosures regarding the collection, use, and transfer of personal information; and commented on self-regulatory efforts and technological developments intended to enhance consumer privacy. The Commission's goals have been to understand this new marketplace and its information practices, and to assess the costs and benefits to businesses and consumers.⁽¹³⁾

In June 1998 the Commission issued Privacy Online: A Report to Congress ("1998 Report"), an examination of the information practices of commercial sites on the World Wide Web and of industry's efforts to implement self-regulatory programs to protect consumers' online privacy.⁽¹⁴⁾ The Commission described the widely-accepted fair information practice principles of Notice, Choice, Access and Security. The Commission also identified Enforcement - the use of a reliable mechanism to provide sanctions for noncompliance - as a critical component of any governmental or self-regulatory program to protect privacy online.⁽¹⁵⁾ In addition, the 1998 Report presented the results of the Commission's first online privacy survey of commercial Web sites. While almost all Web sites (92% of the comprehensive random sample) were collecting great amounts of personal information from consumers, few (14%) disclosed anything at all about their information practices.⁽¹⁶⁾

Based on survey data showing that the vast majority of sites directed at children also collected personal information, the Commission recommended that Congress enact legislation setting forth standards for the online collection of personal information from children.⁽¹⁷⁾ The Commission deferred its recommendations with respect to the collection of personal information from online consumers generally. In subsequent Congressional testimony, the Commission referenced promising self-regulatory efforts suggesting that industry should be given more time to address online privacy issues. The Commission urged the online industry to expand these efforts by adopting effective, widespread self-regulation based upon the long-standing fair information practice principles of Notice, Choice, Access, and Security, and by putting enforcement mechanisms in place to assure adherence to these principles.⁽¹⁹⁾ In a 1999 report to Congress, Self-Regulation and Privacy Online, a majority of the Commission again recommended that self-regulation be given more time.⁽²⁰⁾

On May 22, 2000, the Commission issued its third report to Congress examining the state of online privacy and the efficacy of industry self-regulation. Privacy Online: Fair Information Practices in the Electronic Marketplace ("2000 Report") presented the results of the Commission's 2000 Online Privacy Survey, which reviewed the nature and substance of U.S. commercial Web sites' privacy disclosures, and assessed the effectiveness of self-regulation. In that Report, a majority of the Commission concluded that legislation is necessary to ensure further implementation of fair information practices online and recommended a framework for such legislation.⁽²¹⁾

II. Online Profiling

On November 8, 1999, the Commission and the United States Department of Commerce jointly sponsored a Public Workshop on Online Profiling.⁽²²⁾ As a result of the Workshop and public comment, the Commission learned a great deal about what online profiling is, how it can benefit both businesses and consumers, and the privacy concerns that it raises.

A. What is Online Profiling?

More than half of all online advertising is in the form of "banner ads" displayed on Web pages - small graphic advertisements that appear in boxes above or to the side of the primary site content.⁽²³⁾ Often, these ads are not selected and delivered by the Web site visited by a consumer, but by a network advertising company that manages and provides advertising for numerous unrelated Web sites.

In general, these network advertising companies do not merely supply banner ads; they also gather data about the consumers who view their ads. This is accomplished primarily by the use of "cookies"⁽²⁶⁾ which track the individual's actions on the Web.⁽²⁷⁾ The information gathered by network advertisers is often, but not always, anonymous, that is, the profiles are frequently linked to the identification number of the advertising network's cookie on the consumer's computer rather than the name of a specific person. In some circumstances, however, the profiles derived from tracking consumers' activities on the Web are linked or merged with personally identifiable information.⁽²⁸⁾

Once collected, consumer data is analyzed and can be combined with demographic and "psychographic"⁽²⁹⁾ data from third-party sources, data on the consumer's offline purchases, or information collected directly from consumers through surveys and registration forms. This enhanced data allows the advertising networks to make a variety of inferences about each consumer's interests and preferences. The result is a detailed profile that attempts to predict the individual consumer's tastes, needs, and purchasing habits and enables the advertising companies' computers to make split-second decisions about how to deliver ads directly targeted to the consumer's specific interests.

The profiles created by the advertising networks can be extremely detailed. A cookie placed by a network advertising company can track a consumer on any Web site served by that company, thereby allowing data collection across disparate and unrelated sites on the Web. Also, because the cookies used by ad networks are generally persistent, their tracking occurs over an extended period of time, resuming each time the individual logs on to the Internet. When this "clickstream" information is combined with third-party data, these profiles can include hundreds of distinct data fields.⁽³⁰⁾

Although network advertisers and their profiling activities are nearly ubiquitous,⁽³¹⁾ they are most often invisible to consumers. All that consumers see are the Web sites they visit; banner ads appear as a seamless, integral part of the Web page on which they appear and cookies are placed without any notice to consumers.⁽³²⁾ Unless the Web sites visited by consumers provide notice of the ad network's presence and data collection, consumers may be totally unaware that their activities online are being monitored.⁽³³⁾

B. Profiling Benefits and Privacy Concerns

Network advertisers' use of cookies ⁽³⁴⁾ and other technologies to create targeted marketing programs can benefit both consumers and businesses. As noted by commenters at the Public Workshop, targeted advertising allows customers to receive offers and information about goods and services in which they are actually interested.⁽³⁵⁾ Businesses clearly benefit as well from the ability to target advertising because they avoid wasting advertising dollars marketing themselves to consumers who have no interest in their products.⁽³⁶⁾ Additionally, a number of commenters stated that targeted advertising helps to subsidize free content on the Internet.⁽³⁷⁾

Despite the benefits of targeted advertising, there is widespread concern about current profiling practices. The most consistent and significant concern expressed about profiling is that it is conducted without consumers' knowledge.⁽³⁸⁾ The presence and identity of a network advertiser on a particular site, the placement of a cookie on the consumer's computer, the tracking of the consumer's movements, and the targeting of ads are simply invisible in most cases.

The second most persistent concern expressed by commenters was the extensive and sustained scope of the monitoring that occurs. Unbeknownst to most consumers, advertising networks monitor individuals across a multitude of seemingly unrelated Web sites and over an indefinite period of time. The result is a profile far more comprehensive than any individual Web site could gather. Although much of the information that goes into a profile is fairly innocuous when viewed in isolation, the cumulation over time of vast numbers of seemingly minor details about an individual produces a portrait that is quite comprehensive and, to many, inherently intrusive.⁽³⁹⁾

For many of those who expressed concerns about profiling, the privacy implications of profiling are not ameliorated in cases where the profile contains no personally identifiable information.⁽⁴⁰⁾ First, commenters feared that companies could unilaterally change their operating procedures and begin associating personally identifiable information with non-personally identifiable data previously collected.⁽⁴¹⁾ Second, these commenters objected to the use of profiles--regardless of whether they contain personally identifiable information--to make decisions about the information individuals see and the offers they receive. Commenters expressed concern that companies could use profiles to determine the prices and terms upon which goods and services, including important services like life insurance, are offered to individuals. ⁽⁴³⁾

C. Online Profiling and Self Regulation: the NAI Effort

The November 8th workshop provided an opportunity for consumer advocates, government, and industry members not only to educate the public about the practice of online profiling, but to explore self-regulation as a means of addressing the privacy concerns raised by this practice. In the Spring of 1999, in anticipation of the Workshop, network advertising companies were invited to meet with FTC and Department of Commerce staff to discuss their business practices and the possibility of self-regulation. As a result, industry members announced at the Workshop the formation of the Network Advertising Initiative (NAI), an organization comprised of the leading Internet Network Advertisers - 24/7 Media, AdForce, AdKnowledge, Avenue A, Burst! Media, DoubleClick, Engage, and MatchLogic - to develop a framework for self-regulation of the online profiling industry.

In announcing their intention to implement a self-regulatory scheme, the NAI companies acknowledged that they face unique challenges as a result of their indirect and invisible relationship with consumers as they surf the Internet. The companies also discussed the fundamental question of how fair information practices, including choice, should be applied to the collection and use of data that is unique to a consumer but is not necessarily personally identifiable, such as clickstream data generated by the user's browsing activities and tied only to a cookie identification number.⁽⁴⁴⁾

Following the workshop, the NAI companies submitted working drafts of self-regulatory principles for consideration by FTC and Department of Commerce staff. Although efforts have been made to reach a consensus on basic standards for applying fair information practices to the business model used by the network advertisers, this process is not yet complete. The Commission will supplement this report with specific recommendations to Congress after it has an opportunity to fully consider the self-regulatory proposals and how they interrelate with the Commission's previous views and recommendations in the online privacy area.

III. Conclusion

The Commission is committed to the goal of ensuring privacy online for consumers and will continue working to address the unique issues presented by online profiling. I would be pleased to answer any questions you may have.

1. The Commission vote to issue this testimony was 5-0, with Commissioner Swindle concurring in part and dissenting in part. Commissioner Swindle's separate statement is attached to the testimony.

2. My oral testimony and responses to questions you may have reflect my own views and are not necessarily the views of the Commission or any individual Commissioner.

3. 15 U.S.C. § 45(a).

4. The Commission also has responsibility under 45 additional statutes governing specific industries and practices. These include, for example, the Truth in Lending Act, 15 U.S.C. §§ 1601 et seq., which mandates disclosures of credit terms, and the Fair Credit Billing Act, 15 U.S.C. §§ 1666 et seq., which provides for the correction of billing errors on credit accounts. The Commission also enforces over 30 rules governing specific industries and practices, e.g., the Used Car Rule, 16 C.F.R. Part 455, which requires used car dealers to disclose warranty terms via a window sticker; the Franchise Rule, 16 C.F.R. Part 436, which requires the provision of information to prospective franchisees; the Telemarketing Sales Rule, 16 C.F.R. Part 310, which defines and prohibits deceptive telemarketing practices and other abusive telemarketing practices; and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312.

In addition, on May 12, 2000, the Commission issued a final rule implementing the privacy provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq. The rule requires a wide range of financial institutions to provide notice to their customers about their privacy policies and practices. The rule also describes the conditions under which those financial institutions may disclose personal financial information about consumers to nonaffiliated third parties, and provides a method by which consumers can prevent financial institutions from sharing their personal financial information with nonaffiliated third parties by opting out of that disclosure, subject to certain exceptions. The rule is available on the Commission's Web site at <http://www.ftc.gov/os/2000/05/index.htm#12. See Privacy of Consumer Financial Information, to be codified at 16 C.F.R. pt. 313.

The Commission does not, however, have criminal law enforcement authority. Further, under the FTCA, certain entities, such as banks, savings and loan associations, and common carriers, as well as the business of insurance, are wholly or partially exempt from Commission jurisdiction. See Section 5(a)(2) and (6)a of the FTC Act, 15 U.S.C. § 45(a)(2) and 46(a). See also The McCarran-Ferguson Act, 15 U.S.C. § 1012(b).