Marissa’s Internet Law Blog

A few posts back, I described what Google can find out about its users by itself. That is not the full picture, however. By combining its data with the data of other parties, Google can find out even more about its users. Understanding how Google can combine its information with other companies is helpful in understanding why many privacy advocates oppose the merger with DoubleClick.

First of all, although Google executives have claimed otherwise, IP addresses can be personally identifiable. ISPs such as Comcast and AOL collect customers’ personal info, such as their names, addresses, and credit card numbers, in order to provide them with Internet access and give them an IP address, so they know which individual has each IP address. Universities and workplaces typically record individuals’ IP addresses as well, and in the case of changing IP addresses keep track of what users were assigned particular IP addresses at particular times. Obtaining access to the records of both Google and an ISP would enable someone to view people’s entire search histories, identifiable by name.

The possibility of this happening is not as insignificant as one may think. For example, AOL accidentally published the IP addresses and search records of 658,000 users last year, and the New York Times was able to link some of the records to individual people.

Coming up next … what data does DoubleClick collect, and what happens if this is combined with Google’s data?

Source:

Olsen, Stefanie. “Google draws privacy complaint to FTC.” CNET News.com. 20 April 2007. 20 Dec. 2007 <http://www.news.com/Google-draws-privacy-complaint-to-FTC/2100-1024_3-6177819.html?tag=st.nl>.

I thought I should also mention that yesterday, along with its decision on Google/DoubleClick, the FTC released a set of recommendations for companies in regard to what the FTC terms online behavioral advertising – the tracking of Internet users’ behavior, including what they search for, what they click on, what sites they visit, and what documents they view. The principles, which were passed unanimously by the FTC, are not legally binding but are merely suggestions so that the online-advertising industry can self-regulate in order to protect consumers’ privacy. The FTC is still seeking comments on its recommendations from interested parties, so the recommendations are subject to change:

1. Any site that collects user data for behavioral-advertising purposes should have a clear, prominently displayed privacy policy and should give users the ability to opt out of providing data.
2. Sites that collect user data for behavioral advertising should keep the data secure and should delete it once it is no longer useful for legitimate business or law-enforcement purposes.
3. When sites change their privacy policies, they should not use data for purposes other than those stated in the first privacy policy without users’ express consent.
4. Sites should not collect “sensitive data,” which includes information on medical conditions and children’s online activities, for behavioral advertising without users’ express consent. The FTC says that it is still trying to come up with a specific definition of sensitive data and is considering banning the collection of sensitive data outright.  

I think that adopting these principles would be a great step toward protecting privacy rights online. It is an especially good idea to allow users to opt out of behavioral tracking; it seems to me that all websites should provide this choice. It would be great if the market could be relied upon to agree to and enforce principles such as these, and I think the FTC should give the advertising industry a chance to regulate itself. However, the incentive to gather as much data as possible in order to produce the most effective advertising may make it impossible for companies to stick to an agreement that limits their data-gathering powers. In that case, Commissioner Harbour may be right – a legislative solution could be the only way to protect people’s privacy. Source: 

“FTC Staff Proposes Online Behavioral Advertising Privacy Principles.” FTC.gov. 20 Dec. 2007. 21 Dec. 2007 <http://www.ftc.gov/opa/2007/12/principles.shtm>.

Phil kindly pointed out that several European organizations have filed a letter to the European Commission urging them to block the Google-DoubleClick merger. (1) Unlike the FTC, which says that is only considers the effects on competition when deciding on the legality of mergers, the EC takes into account both competition and privacy concerns. In addition to bringing up concerns about competition, the letter stated that “privacy issues may be highly relevant to such analysis in some circumstances, including where a merger combines two of the world’s largest data bases of consumer preferences.” (2)

According to the letter, the merger would greatly increase Google’s and DoubleClick’s ability to track users by combining Google’s search data with DoubleClick’s extensive record of users’ web-surfing habits. Another interesting point the letter brought up was that if the deal created a monopoly, Google-DoubleClick would be less motivated to respect privacy. Especially in
Europe, companies try to develop new ways to give users choices about their privacy as a way to be more appealing than their competitors. However, “post-merger, there is a danger that Google will lose any incentive to continue innovating in this area due to its hugely dominant position in online advertising. It will be under considerably less competitive pressure to improve – or even maintain – the poor quality of its current privacy practices.” (2)

Finally, the authors of the letter raised the point that the merger may facilitate price discrimination. If Google-DoubleClick is able to track users’ shopping habits, then it would be able to advertise different prices for the same product – perhaps charging low prices to lure frugal shoppers and taking advantage of impulsive buyers by charging them more. (2)

Sources: 

1. “European lobby rejects Google-DoubleClick merger.” CNET News.com. 20 Dec. 2007 <http://www.news.com/European-lobby-rejects-Google-Doubleclick-merger/2100-1030_3-6223610.html?tag=sas.email>.

2. “Further observations on the proposed acquisition of DoubleClick to Google.” BEUC.org. 18 Dec. 2007. 20 Dec. 2007 <http://docshare.beuc.org/docs/2/OHAFOCHBJKFHDGEDCFFJFCJFPDB39DWYTK9DW3571KM/BEUC/docs/DLS/2007-01174-01-E.pdf>.