Information Resellers: Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace
Published: 2013-09-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In recent years, information resellers--companies that collect and resell information on individuals--dramatically increased the collection and sharing of personal data for marketing purposes, raising privacy concerns among some in Congress. Recent growth in the use of social media, mobile applications, and other technologies intensified these concerns. GAO was asked to examine privacy issues and information resellers. This report addresses (1) privacy laws applicable to consumer information held by resellers, (2) gaps in the law that may exist, and (3) views on approaches for improving consumer data privacy.
To address these objectives, GAO analyzed laws, studies, and other documents, and interviewed representatives of federal agencies, the reseller and marketing industries, consumer and privacy groups, and others. GAO focused primarily on consumer information used for marketing purposes.
section_title: What GAO Found
paragraphs: No overarching federal privacy law governs the collection and sale of personal information among private-sector companies, including information resellers. Instead, a variety of laws tailored to specific purposes, situations, or entities governs the use, sharing, and protection of personal information. For example, the Fair Credit Reporting Act limits the use and distribution of personal information collected or used to help determine eligibility for such things as credit or employment, but does not apply to information used for marketing. Other laws apply specifically to health care providers, financial institutions, videotape service providers, or to the online collection of information about children.
The current statutory framework for consumer privacy does not fully address new technologies--such as the tracking of online behavior or mobile devices--and the vastly increased marketplace for personal information, including the proliferation of information sharing among third parties. With regard to data used for marketing, no federal statute provides consumers the right to learn what information is held about them and who holds it. In many circumstances, consumers also do not have the legal right to control the collection or sharing with third parties of sensitive personal information (such as their shopping habits and health interests) for marketing purposes. As a result, although some industry participants have stated that current privacy laws are adequate--particularly in light of self-regulatory measures under way--GAO found that gaps exist in the current statutory framework for privacy. And that the framework does not fully reflect the Fair Information Practice Principles, widely accepted principles for protecting the privacy and security of personal information that have served as a basis for many of the privacy recommendations federal agencies have made.
Views differ on the approach that any new privacy legislation or regulation should take. Some privacy advocates generally have argued that a comprehensive overarching privacy law would provide greater consistency and address gaps in law left by the current sector-specific approach. Other stakeholders have stated that a comprehensive, one-size-fits-all approach to privacy would be burdensome and inflexible. In addition, some privacy advocates have cited the need for legislation that would provide consumers with greater ability to access, control the use of, and correct information about them, particularly with respect to data used for purposes other than those for which they originally were provided. At the same time, industry representatives have asserted that restrictions on the collection and use of personal data would impose compliance costs, inhibit innovation and efficiency, and reduce consumer benefits, such as more relevant advertising and beneficial products and services. Nonetheless, the rapid increase in the amount and type of personal information that is collected and resold warrants reconsideration of how well the current privacy framework protects personal information. The challenge will be providing appropriate privacy protections without unduly inhibiting the benefits to consumers, commerce, and innovation that data sharing can accord.
section_title: What GAO Recommends
paragraphs: Congress should consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the increased market for consumer information. Any changes should seek to provide consumers with appropriate privacy protections without unduly inhibiting commerce and innovation. The Department of Commerce agreed that strengthened privacy protections could better protect consumers and support innovation.

section_title: Letter
paragraphs: Some members of Congress and others have raised privacy concerns  about the collection and use of consumers’ personal information by  information resellers—companies with a primary line of business of  collecting, aggregating, and selling personal information to third parties. In  part, their concerns stem from consumers not always knowing the nature  and extent of the information collected about them and how it is used and  shared. The information reseller industry has grown significantly in recent  years, as has the amount of consumer information that these companies  assemble and distribute. Moreover, growing use of the Internet, social  media, and mobile applications has intensified privacy concerns because  these media greatly facilitate the ability to gather increasing amounts of  personal information, track online behavior, and monitor locations and  activities.
You asked us to review privacy issues related to consumer data  collected, used, and shared by information resellers. This report  examines (1) existing federal laws and regulations relating to the privacy  of consumer information held by information resellers, (2) any gaps that  may exist in this legal framework, and (3) views on approaches for  improving consumer data privacy. This report focuses primarily on privacy  issues related to consumer information used for marketing and for  individual reference services (also known as look-up or people-search  services); it does not focus on information used for other purposes, such  as fraud prevention and eligibility for credit or employment.
To address the first and second objectives, we reviewed and analyzed  relevant federal laws, regulations, and enforcement actions, and selected  state laws. We interviewed representatives of federal agencies, trade  associations, consumer and privacy groups, and information resellers to  obtain their views on federal data privacy laws related to information  resellers, including the adequacy of consumers’ ability to access, correct,  opt out, or request deletion of information. To address the third objective,  we identified and reviewed approaches for improving consumer data  privacy through legislative, regulatory, or self-regulatory means that  federal entities—including the White House, Federal Trade Commission  (FTC), and Department of Commerce (Commerce)—or representatives of  industry, consumer, and privacy groups have advocated. We also  interviewed representatives of these entities and reviewed relevant  studies, congressional hearing records, position papers, public  comments, and other sources. Appendix I contains a more extensive  discussion of our scope and methodology.
We conducted this performance audit from August 2012 through  September 2013, in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Information resellers—sometimes also called data brokers, data  aggregators, or information solutions providers—offer several types of  products to customers that include retailers, advertisers, private  individuals, nonprofit organizations, and law enforcement and other  government agencies. Consumer reporting agencies—including the three  nationwide credit bureaus, Equifax, Experian, and TransUnion—provide  consumer reports that commonly are used to determine eligibility for  credit, employment, and insurance. Some resellers offer products that  help companies comply with legal requirements or identify, investigate,  and prevent fraudulent transactions (for example, by enabling  confirmation of a customer’s identity). Some information resellers, such  as Spokeo and Intelius, also offer individual reference services that sell  personal identifying information about consumers to individuals or  companies.
In addition, many information resellers, such as Acxiom and LexisNexis,  offer products that companies use for marketing purposes. Resellers may  focus on groups of likely customers who share common characteristics,  and therefore may have similar interests or preferences. For example,  resellers may offer information products that allow clients to target their  online advertisements and help ensure that promotional materials are  sent to the most relevant individuals. Resellers may offer retailers the  ability to add purchase and lifestyle information to their existing customer  databases. In addition, resellers may offer clients marketing lists with  contact information of prospective customers.
Resellers maintain large, sophisticated databases with information from a  variety of sources about individuals and families. The consumer  information that each reseller maintains and sells varies, but can include  names, addresses, family members, neighbors, credit histories, motor  vehicle records, insurance claims, criminal records, employment histories,  incomes, ethnicities, purchase histories, interests, and hobbies. (See  appendix II for a detailed list of examples of the types of consumer  information held by information resellers.) As shown in figure 1, resellers  obtain their information from three primary types of sources: public  records, publicly available information, and nonpublic information.
Public records, available to anyone, generally are obtained from  governmental entities. What constitutes a public record depends on  state and federal laws, but may include birth and death records,  property records, tax lien and assessor files, voter registrations,  licensing records, and court records (including criminal records,  bankruptcy filings, civil case files, and legal judgments).
Publicly available information is not found in public records, but  nevertheless is publicly available through sources such as telephone  directories, business directories, classified advertisements,  newspapers or magazines, and other materials.
Nonpublic information derives from proprietary sources. For example,  consumers may provide the information directly to businesses through  loyalty card programs at grocery or retail stores, website registrations,  warranty registrations, contests, surveys and questionnaires, and  purchase histories. Resellers (or a third party such as a website  operator acting on behalf of the reseller) also may collect nonpublic  information about consumers’ online locations and actions, including a  computer’s Internet protocol address, the browser used, activities  during a consumer’s visit to a website (such as search terms or  purchases), and activities conducted on other websites.
Consumer information can be derived from mobile networks, devices  (including smartphones and tablets), operating systems, and applications.  In addition, resellers may obtain personal information from the profile or  public information areas of websites, including social media sites such as  Facebook, LinkedIn, MySpace, and Twitter, or from information posted to  blogs or discussion forums. Depending on the context, information from  these sources may be publicly available or nonpublic.
There is limited publicly known information about the information reseller  industry as a whole. Characterizing the precise size and nature of the  industry can be difficult because definitions for resellers vary and data on  resellers often are limited or not comparable. For example, the U.S.  Census Bureau (Census) does not assign a business classification code  specific to information resellers. Instead, Census has assigned different  primary codes, including “data processing and preparation,” “direct mail  advertising services,” “credit reporting services,” and “information retrieval  services.”or other statistical information on the information resellers industry as a  whole. According to FTC and Commerce, there is no comprehensive list  or registry of companies that resell personal information. Several privacy- related organizations and websites maintain lists of information  resellers—for example, Privacy Rights Clearinghouse lists more than 250  on its website—but none of these lists claim to be comprehensive. The  Direct Marketing Association, which represents companies and nonprofits  that use and support data-driven marketing, maintains a proprietary  membership list, which it says numbers about 2,500 organizations  (although that includes retailers and others that typically would not be  considered information resellers).
Thus, Census data cannot be used to provide a reliable count  FTC has called on the information reseller industry to improve the  transparency of its practices, and in December 2012 issued orders  requiring nine information resellers to provide FTC with information about  how they collect and use data about consumers.about the nature and sources of the consumer information that  information resellers collect; how they use, maintain, and disseminate the  information; and the extent to which the companies allow consumers to  access and correct their information or opt out of having their personal  information sold. According to FTC staff, the agency expects to issue a  report with findings by the end of 2013.
The Fair Information Practice Principles (FIPPs) are a set of  internationally recognized principles for protecting the privacy and  security of personal information. A U.S. government advisory committee  first proposed the practices in 1973 in response to concerns about the  consequences computerized data systems could have on the privacy of  personal information. While the FIPPs are principles as opposed to legal  requirements, they provide a framework for balancing the need for privacy  with other interests. The Organisation for Economic Co-operation and  Development (OECD) developed a revised version of the FIPPs in 1980  that has been widely adopted (see table 1).
Many organizations and governments have used these principles, with  some variation, as best practices. In the United States, the FIPPs served  as the basis for the Privacy Act—which governs the collection,  maintenance, use, and dissemination of personal information by federal  agencies—and as the basis for many of the privacy recommendations of  agencies such as FTC and Commerce. The FIPPs also served as the  basis for a framework for consumer data privacy that the White House  issued in February 2012. This framework presents a consumer privacy bill  of rights, describes a stakeholder process to specify how the principles in  that bill of rights would apply, and encourages Congress to provide FTC  with enforcement authorities for the bill of rights.
section_title: Several Laws Apply in Specific Circumstances to Consumer Data That Resellers Hold
paragraphs: Currently, no comprehensive federal privacy law governs the collection,  use, and sale of personal information by private-sector companies. There  are also no federal laws designed specifically to address all the products  sold and information maintained by information resellers. In contrast, a  baseline privacy law exists for personal information the federal  government maintains—the Privacy Act of 1974. The act, among other  things, generally prohibits, subject to a number of exceptions, the  disclosure by federal entities of records about an individual without the  individual’s written consent and provides U.S. persons with a means to  seek access to and amend their records. Many other industrialized  countries have implemented baseline privacy laws for information held by  private-sector companies. The 28 member countries of the European  Union have implemented into their national laws the union’s 1995 Data  Protection Directive, which provides a comprehensive framework on the  protection of personal data. It states that the personal information of  European Union citizens may not be transmitted to nations outside of the  union unless those countries are deemed to have “adequate” data  protection laws.
In the United States, the federal privacy framework for private-sector  companies comprises a set of more narrowly tailored laws that govern the  use and protection of personal information—that is, the laws apply for  specific purposes, in certain situations, to certain sectors, or to certain  types of entities. The primary federal laws with regard to consumer  privacy include the following:  Fair Credit Reporting Act (FCRA). Enacted in 1970, FCRA protects the  security and confidentiality of personal information collected or used to  help make decisions about individuals’ eligibility for such products as  credit or for insurance or employment. FCRA applies to “consumer  reporting agencies” that provide “consumer reports” that contain credit  histories and other personal information and are used for eligibility  determinations. Accordingly, FCRA applies to the three nationwide  consumer reporting agencies (commonly called credit bureaus) and to  any other information resellers that resell consumer reports for use by  others. FCRA limits resellers’ use and distribution of personal data—for  example, by allowing consumers to opt out of allowing consumer  reporting agencies to share their personal information with third parties for  prescreened marketing offers. The act also allows individuals to access  and dispute the accuracy of personal data held on them. Additionally, as  amended in 2003, FCRA imposes safeguarding requirements designed to  prevent identity theft and assist identity theft victims.
Pub. L. No. 106-102, 113 Stat. 1338 (1999) (codified as amended in scattered sections  of 12 and 15 U.S.C.). institutions or that such institutions maintain. GLBA sharing and  disclosure restrictions apply to entities that fall under GLBA’s definition of  a “financial institution” or that receive nonpublic personal information from  such a financial institution. The act’s privacy provisions restrict the  sharing of nonpublic personal information collected by or acquired from  financial institutions, which include those resellers covered by GLBA’s  definition of financial institution. Under a “reuse and redisclosure”  provision, a nonaffiliated third party that receives nonpublic personal  information from a financial institution faces restrictions on how it may  further share or use the information. For example, a third party that  receives nonpublic personal information from a financial institution to  process consumers’ account transactions may not use the information for  its marketing purposes or sell it to another entity for marketing purposes.  GLBA requires financial regulators to establish appropriate standards for  financial institutions relating to administrative, technical, and physical  safeguards to ensure the security and confidentiality of customer records  and information; protect against any anticipated threats or hazards to the  security or integrity of such records; and protect against unauthorized  access to or use of such records or information that could result in  substantial harm or inconvenience to any customer.
Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in scattered sections  of 18, 26, 29, and 42 U.S.C.). including marketing. According to guidance from the Department of  Health and Human Services, the rule aims to strike a balance that permits  important uses of information in the provision of health care while  protecting patients’ privacy. With some exceptions, the rule requires an  individual’s written authorization before a covered entity—a health care  provider that transmits health information electronically in connection with  covered transactions, health care clearinghouse, or health plan—may use  or disclose that individual’s protected health information for marketing.  In addition, HIPAA requires covered entities to safeguard protected  personal health information and protect against any reasonably  anticipated unauthorized uses or disclosures of such information, among   The act does not directly restrict the use, disclosure, or  other things.resale of protected health information by information resellers or other  parties not considered HIPAA-covered entities.
Pub. L. No. 105-277, Div. C, Tit. XIII, 112 Stat. 2681-728 (1998) (codified at 15 U.S.C.  §§ 6501-6506). parental consent. Although COPPA may not directly affect information  resellers, COPPA governs information collection by operators of websites  and online services, both of which are potential sources of personal  information for resellers and other parties. COPPA would not apply to the  collection of a child’s information from the child’s parent or other adults.
Electronic Communications Privacy Act (ECPA). Among its  provisions, ECPA, which was enacted in 1986, prohibits the interception  and disclosure of electronic communications by third parties unless an  exception applies, such as one of the parties to the communication  having consented to the interception or disclosure. For example, the act  would prevent an Internet service provider from selling the content of its  customers’ e-mails and text messages to an information reseller that  wanted to use the content for marketing purposes unless the customers  had given their consent for the disclosures. However, ECPA provides  more limited protection for information that is considered to be “non- content”, such as a customer’s name and address.
15 U.S.C. § 45. Section 5 of the FTC Act, as originally enacted, only related to “unfair  methods of competition.” The Wheeler-Lea Act, passed in 1938, expanded the  Commission’s jurisdiction to include “unfair or deceptive acts or practices.” Wheeler-Lea  Amendments of 1938, Pub. L. No. 75-447, 52 Stat. 111. addition, the FTC Act’s unfairness authority could apply, even in the  absence of a privacy policy, in situations involving a likelihood of  substantial injury to consumers that is not reasonably avoidable and not  offset by countervailing benefits. In effect, FTC enforcement actions can  establish compliance requirements that companies can follow in order to  avoid future enforcement actions.
As they relate to specific types of consumer services or types of records,  other federal privacy laws that also may apply to information resellers’  practices and products include the following:  Driver’s Privacy Protection Act.  Enacted in 1994, the act generally  prohibits the use and disclosure of certain personal information in state  motor vehicle records. The act also specifies permissible uses of  personal information, and that an authorized recipient of personal  information may “resell or redisclose” the information only for purposes  permitted by law. For example, a state department of motor vehicles  cannot sell drivers’ personal information to resellers for marketing  purposes unless the department obtained consent from the individuals.
Family Educational Rights and Privacy Act. Enacted in 1974, the act  governs access to and disclosure of students’ education records to  parents, students, and third parties. Specifically, the act provides that no  federal funds shall be made available to any school or institution that has  a policy of releasing students’ education records or personally identifiable  information contained in such records (other than directory information) to  third parties such as information resellers (other than to certain parties  and for certain purposes enumerated in the statute) without written  consent from the students’ parents.36, 37 Video Privacy Protection Act. video tape service provider from knowingly disclosing personally  identifiable information concerning video rental and sales records,  including the title or subject matter of any video tapes, to third parties,  subject to exceptions. However, a provider may disclose the names and  addresses of consumers to third parties if the consumer has had the  opportunity to prohibit such disclosure. The provider also may disclose  the content of rental materials if that information will be used only to  market goods and services directly to the consumer.
20 U.S.C. § 1232g(b)(1). A student may provide consent to release education records  and personal information if he or she is 18 years of age or older or is attending a  postsecondary education institution. For students younger than 18, consent of their  parents is necessary. See 20 U.S.C. § 1232g(d).
For the purposes of this section, the term “directory information” relating to a student  includes the following: the student’s name, address, telephone listing, date and place of  birth, major field of study, participation in officially recognized activities and sports, weight  and height of members of athletic teams, dates of attendance, degrees and awards  received, and the most recent previous educational agency or institution attended by the  student. See 20 U.S.C. § 1232g(a)(5)(A).
Pub. L. No. 100-618, 102 Stat. 3195 (1988) (codified as amended at 18 U.S.C. § 2710).
Pub. L. No. 99-474, 100 Stat. 1213 (1986) (codified as amended at 18 U.S.C. § 1030). collecting personal information from a website when the collection would  violate the site’s terms of service.
Telecommunications Act. telecommunications carriers to protect the confidentiality of proprietary  information of customers. Additionally, the act prohibits carriers from  using proprietary information from other carriers for their own marketing  efforts.
Enacted in 1996, the act requires  While we did not conduct a comprehensive review of all state laws, we  identified relatively few state laws that broadly address consumer privacy  rights or regulate information resellers. Representatives of several privacy  advocacy organizations similarly noted that few state laws broadly  address information resellers or consumer privacy, such as the collection  or disclosure of personal information held by private companies.  However, some states have enacted laws designed to improve data  security and reduce identity theft, such as laws requiring consumer  notification of security breaches involving personal information.
Pub. L. No. 104-104, 110 Stat. 56 (1996) (codified as amended in scattered sections of  15 and 47 U.S.C.). consumers. California’s Shine the Light law requires certain businesses  to disclose, upon a California customer’s request, whether those  businesses have shared the customer’s personal information with third  parties for direct marketing purposes. For certain specified categories of  information, the business also must notify the requesting consumer of the  categories of information shared with a third party. Similarly, Utah’s  Notice of Intent to Sell Nonpublic Personal Information Act requires  commercial entities to disclose to consumers the types of nonpublic  personal information shared with or sold to third parties for  compensation. Massachusetts and Nevada have laws or regulations  requiring businesses to safeguard and encrypt personally identifiable  consumer data. The Massachusetts regulations establish minimum  standards for safeguarding personal information in both paper and  electronic records and cover only personal information about residents of  Massachusetts. The Nevada law generally covers any personal  information belonging to certain categories that a business maintains.
section_title: Existing Privacy Laws Have Limited Scope over Personal Data Used for Marketing
paragraphs: For consumer data used for marketing purposes, the privacy protections  provided under federal law have been limited. Although the FIPPs call for  restraint in the collection and use of personal information, the scope of  protections provided under current law has been narrow in relation to (1)  individuals’ ability to access, control, and correct their personal data; (2)  collection methods and sources and types of consumer information  collected; and (3) new technologies, such as tracking of web activity and  the use of mobile devices. However, views differ on whether privacy  protections should be expanded and if this could best be done through  legislation or self-regulation.
subsections: section_title: Laws Provide Individuals Limited Ability to Access, Control, and Correct Their Personal Data
paragraphs: Current federal privacy laws generally do not provide individuals the  universal right to access, control, or correct personal information that  resellers and private-sector companies use for marketing purposes. The  “collection limitation” and “openness” principles of the FIPPs state that  individuals should be able to know about and consent to the collection of  their personal information, while the “individual participation” principle  states they should have the right to access that information, request  correction, and challenge the denial of those rights. However, none of the  federal statutes that we examined generally requires information resellers  to allow individuals to review their personal information in the resellers’  possession intended for marketing or information retrieval purposes,  control its use, or correct it.
In relation to data used for marketing purposes, no federal statute  provides consumers the right to learn what information is held about them  and who holds it. As noted earlier, FCRA provides individuals with rights  to access information from consumer reports used for eligibility  determinations, but does not apply to personal information used for  marketing (other than prescreened marketing offers). For example, an  information reseller we interviewed said the company generally does not  offer consumers the ability to see the personal information held about  them for purposes not covered under FCRA. Additionally, in 2006 some  resellers told us that they gave individuals opportunities to order summary  reports that disclosed personal information maintained for non-FCRA  purposes, but the extent of the information provided varied.
Consumers have limited legal rights to control what personal information  is collected, maintained, used, and shared and how. Under FCRA,  individuals can request that personal information not be shared with third  parties for marketing unsolicited prescreened credit or insurance offers.  GLBA’s privacy provisions generally limit financial institutions from  sharing nonpublic personal information with nonaffiliated third parties  without first providing certain notice and, in some cases, opt-out rights to  customers and other consumers. However, apart from these two cases,  individuals do not have a right to require that their personal information  not be collected, used, and shared for marketing purposes. Some trade  associations, information resellers, and other companies voluntarily have  developed opt-out mechanisms through which consumers can request  that their personal information be excluded from resellers’ marketing  databases. The Digital Advertising Alliance also has a program that  calls for its members to provide consumer control over what data are  collected and used for online behavioral or interest-based advertising.
No federal law that we examined provides correction rights for information  used for marketing or look-up purposes. Correction refers to consumers’  ability to have resellers and other parties correct or delete inaccurate,  incomplete, or unverifiable information. For information covered under  FCRA, consumers have the right to dispute information held by resellers  that is incomplete or inaccurate, have a claim investigated, and have any  errors deleted or corrected. However, neither FCRA nor any other federal  law that we examined provides similar correction rights for information  used for marketing or look-up purposes.
section_title: Laws Largely Do Not Address Data Collection Methods, Sources, and Types
paragraphs: The “data quality” and “purpose specification” principles of the FIPPs  state that personal information should be relevant and limited to the  purpose for which it was collected, and the “collection limitation” principle  calls for confining the collection of personal information. However, the  scope of current federal privacy laws is limited in addressing the methods  by which, or the sources from which, information resellers and private- sector companies collect and aggregate personal information, or the  types of information that may be collected for marketing or look-up  purposes.
Federal laws generally do not govern the methods resellers may use to  collect personal information for marketing or look-up purposes. Examples  of such methods include “web scraping”—sometimes called data  extraction or web data mining—in which resellers, advertisers, and other  parties use software to search the web for information about an individual  or individuals, and extract and download bulk information from a particular  website that contains consumer information. The marketing material of  one company we reviewed advertised that for a fee it would provide  information on any individual by extracting data and photographs from  social media websites, blogs, or telephone and professional directory  sites that contain e-mail addresses and other contact information. A  website’s terms-of-use may legally restrict such practices or password  protections may help prevent them. Resellers or retailers also may collect  personal information through indirect means. For example, some retailers  ask consumers to provide their zip code when using a credit card at the  time of purchase. The zip code can be combined with the name on the  credit card to determine the consumer’s address, telephone number, or  other personal information that may be held in a marketing database.
Current law generally allows resellers to collect personal information from  sources that include warranty registration cards, consumer surveys, and  retailers, and online sources such as discussion boards, social media  sites, blogs, web browsing histories, and searches. Current law does not  require disclosure to consumers when their information is collected from  these sources, including when consumers are unaware that the  information will be used for marketing purposes.
The federal laws that address the types of consumer information that can  be collected and shared for marketing and look-up purposes have limited  reach and application. Under most circumstances, information that many  people may consider very personal or sensitive legally can be collected,  shared, and used for marketing purposes. This can include information  about an individual’s physical and mental health, income and assets,  mobile telephone numbers, shopping habits, personal interests, political  affiliations, and sexual habits and orientation. For example, in 2009  testimony before Congress, a representative of the World Privacy Forum  said that some marketers maintain lists that contain information on  individuals’ medical conditions, including mental health conditions.  HIPAA provisions apply only to covered entities and not, for example, to  health-related marketing lists used by e-health websites or other  noncovered entities. Information resellers that do not qualify as covered  entities can collect and use information about consumers’ health histories  and treatments for marketing purposes. Although federal laws generally  do not restrict the types of information resellers can collect and share for  marketing, many companies voluntarily follow guidelines that recognize  that sensitive personal information merits different treatment. For  example, industry principles for online behavioral advertising call for  consent from individuals for the collection of certain sensitive personal  information—including financial account numbers, pharmaceutical  prescriptions, and medical records.
section_title: Current Law Does Not Directly Address Some Privacy Issues Raised by New Technology
paragraphs: The current privacy framework does not fully address new technologies.  Developments such as social media, web tracking technologies, and  mobile devices have enabled even cheaper, faster, and more detailed  data collection and sharing among resellers and private-sector  companies. In a 2013 report, FTC staff noted that the rapid growth of  mobile technologies provided substantial benefits to both businesses and  consumers, but also presented unique privacy challenges because  mobile devices generally were personal to an individual, almost always  on, could facilitate large amounts of data collection and sharing among  many entities, and could identify a user’s geographical location. As  shown in figure 2, the original enactment of several federal privacy laws  predate these trends and technologies.
Because these laws were enacted to protect the privacy of information  involving specific sectors rather than address specific technologies, some  have been interpreted to apply in the case of new technologies. For  example, as discussed later in this report, FTC has taken enforcement  activity under COPPA and revised the statute’s implementing regulations  to account for smartphones and mobile applications. However, online  tracking practices and mobile devices remain areas in which privacy law  has not fully addressed issues raised by new technologies.
Currently, no federal privacy law explicitly addresses the full range of  practices to track or collect data from consumers’ online activity.  Cookies—small text files placed on an individual computer by the website  that the person visits—represent a common method of tracking online  activity. The information stored in cookies allows website operators to  determine whether users are repeat visitors, and allows for the recall of  information users may have entered such as name and address, credit  card number, site settings, and purchases in a shopping cart. Information  resellers can use the information in cookies to supplement information  from their databases—matching information by individuals’ name and e- mail addresses—to augment profiles on individual consumers. Third  parties also can synchronize their cookie files with resellers’ cookie files  to obtain additional information to enhance consumer profiles. Some  advertisers use so-called third-party cookies—placed on a visitor’s  computer by a domain other than the site being visited—to track visits to  the various websites on which they advertise. Although not required by  law, some web browsers, such as Apple’s Safari and Mozilla’s Firefox,  have privacy settings that allow users to block third-party cookies or turn  on do-not-track features.voluntary on the part of website operators.
However, honoring the do-not-track setting is  Additionally, new methods of tracking consumers’ online behavior seek to  restrict consumers’ ability to prevent such tracking. For example,  according to a 2009 study, an online advertising company developed  flash cookies, which combat users’ ability to delete cookies. cookies can contain up to 25 times more data than other cookies, do not  expire at the end of a browsing session, and cannot be erased through  web browser features such as “clear history.” The study found that many  popular websites, such as Google and Facebook, had been using flash  cookies to recreate deleted cookies.
Shannon Canty, Chris Jay Hoofnagle, et al., “Flash Cookies and Privacy” (Aug. 10,  2009), available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1446862. the settlement, Google agreed to disable its use of advertising tracking  cookies.
Federal law also does not expressly prohibit “history sniffing,” which uses  software code on a webpage to record the browsing history of page  visitors. However, in 2012, FTC took an enforcement action against Epic  Marketplace, a large online advertising network, for deceptively failing to  disclose its use of history-sniffing technology.collected data about the web sites that consumers were visiting, including  sites relating to potentially sensitive topics such as impotence,  menopause, disability insurance, debt relief, and personal bankruptcy.  Epic Marketplace used this information to assign consumers into interest  segments that were used to target advertising.
In relation to collection and use of consumer data for marketing, no  federal privacy laws that we identified specifically govern mobile  applications and technologies.
Mobile applications. While various federal laws apply to activity  conducted through mobile applications or mobile technologies, no federal  law specifically governs mobile applications—software programs  downloaded onto mobile devices for uses such as providing news and  information and online banking and shopping. Application developers,  operating system developers, mobile carriers, advertisers, advertising  networks, and other third parties may collect an individual’s information  through services provided on his or her device. They may use this  information to create a user profile to tailor marketing and they may sell  information collected from these devices to third parties. FTC has taken  enforcement action against companies for use of mobile applications that  violate COPPA and FCRA. The agency has taken action under the FTC  Act in cases in which a mobile application developer collected or used  personal information in a manner inconsistent with the application’s  privacy policy. In addition, CFAA, which bans unauthorized access to  computers, also has been found to apply to mobile phones.
Location tracking.  No federal privacy laws that we evaluated, with the  exception of COPPA, expressly address location data, location-based  technology, and consumer privacy. Smartphones and other mobile  devices can provide services based on a consumer’s location. We and  others have reported that this capability engenders potential privacy risks,  particularly if companies use or share location data without consumers’  knowledge. In 2010, Commerce recommended that the Administration  review ECPA to address privacy protection of location-based services.
As noted previously, ECPA generally prohibits the interception and  disclosure of individuals’ electronic communications, but this may not  apply if location data were not deemed content. ECPA also would not  govern the interception or access of information transmitted and stored by  entities not covered by ECPA, which typically would include developers of  location-based applications. However, COPPA regulations govern the  collection of geolocation data sufficient to identify street name and the  name of a city or town from children under 13, and FTC could pursue  enforcement action if a location-based provider’s collection or use of  geolocation information violated COPPA.
Mobile payments.  No federal privacy laws that we evaluated expressly  address mobile payments. Such services, which allow individuals to  transfer money or pay for goods and services using their mobile devices,  have become increasingly prevalent. According to a survey conducted by  the Board of Governors of the Federal Reserve System, 6 percent of  smartphone users used their telephones at cash registers to pay for  purchases in 2012. A 2013 report by FTC noted that although mobile payment can be an easy and convenient way for individuals to pay for  goods and services, privacy concerns have arisen because of the number  of companies involved in the mobile payment marketplace and the large  amount of detailed personal and purchase information collected and  consolidated in the process.
section_title: Views Differ on Whether Existing Legal Framework Has Gaps and If Legislation Is Needed to Improve Privacy Protections
paragraphs: Stakeholder views have diverged on whether significant gaps in the  current legal framework for privacy exist, whether more legislation is  needed, or whether self-regulation can suffice.
The marketing and information reseller industries generally have argued  that the current framework of sector-specific laws and regulations has not  left significant gaps in consumer privacy protections, citing several  reasons. First, they have stated that the list of federal and state laws  regulating uses of personal information is extensive. Second, some  industry representatives have stated that the existing legislative and  regulatory framework generally provides adequate privacy protections— or the flexibility to address such protections—in relation to new  technologies.FTC broad authority that can apply to a range of circumstances and  technologies—as with the enforcement actions discussed earlier to  address alleged misrepresentations of a company’s privacy policy  involving web tracking and history sniffing. Third, a representative of one  reseller said that any gaps that might exist in consumer privacy protection  were a result of gaps in enforcement of existing law rather than in the  legal framework itself. Finally, some have asserted that consumers’  expectations and notion of privacy have changed in the technological  age—for example, many consumers voluntarily share private information  in public online settings—which may mitigate the need for strict privacy  controls mandated by law that would apply to all consumers.
For example, they have noted that the FTC Act grants  In contrast, privacy advocates and others have stated that the current  privacy scheme left significant gaps. In July 2010 testimony, one privacy  advocate said that the current legal framework for privacy consisted of “a  confusing patchwork of distinct standards” that resulted in gaps in privacy  protection. In a July 2011 letter to members of Congress, privacy  advocates and consumer organizations stated that the current legal  framework for privacy was inadequate, largely because laws had not  been updated to address privacy challenges arising from technological  developments. Similarly, in public comments received by Commerce in  2010, some who commented suggested that changes in technology and  business models rendered parts of the U.S. privacy policy framework out  of date. Commerce noted in its privacy report that many of the key actors  in the Internet age—including online advertisers and their data sources,  cloud computing and location-based services, and social networks— operated without specific statutory obligations to protect personal data.  Additionally, we have raised concerns about the relevance of the current  privacy framework in relation to the vast increases in the volume of  personal information collected and shared.
Industry and privacy advocates also have disagreed on the need for more  legislation or regulation and the efficacy of self-regulatory approaches to  protect privacy. Industry representatives have acknowledged the  importance of consumer privacy protections, but generally argued that  voluntary industry measures and self-regulation have mitigated the need  for additional privacy legislation. The Direct Marketing Association issued  Guidelines for Ethical Business Practice that include principles of conduct  for its members. And, as discussed earlier in this report, the Digital  Advertising Alliance has implemented a program related to online  behavioral advertising that provides consumers some control over their  information online. At a recent Senate hearing, a representative of the  alliance stated that industry self-regulation was flexible and could adapt to  rapid changes in technology and consumer expectations, whereas  legislation and government regulation could be inflexible and quickly  become outdated in an era of rapidly evolving technologies. Moreover,  the representative said that the self-regulatory program was backed by  robust industry enforcement mechanisms. Similarly, in June 2011, a  number of trade associations and business groups sent a letter to  Congress urging caution as Congress examined whether changes were  necessary to existing privacy laws. The letter argued that absent any  identifiable harm in the marketplace, privacy issues were best addressed  through industry self-regulatory programs and best practices. Specifically,  the letter noted that self-regulation and best business practices that were  technology-neutral serve as the preferred framework for enhancing  investment and competition while—at the same time—protecting  consumers’ privacy. Other stakeholders have testified that imposing  privacy protections by law or regulation—rather than through self- regulatory means—would raise compliance costs for businesses, with  these increased costs falling hardest on small operators and start-up  companies.regulatory protections in more detail later in this report.) (We discuss views about the economic effects of enhanced  In contrast, some privacy advocates and others have argued that  voluntary compliance or self-regulation is not sufficient to uniformly  protect consumer privacy rights. The World Privacy Forum issued a report  in 2011 stating that a majority of industry self-regulatory programs were  inadequate in protecting consumer privacy and failed in one or more  substantive ways. organizations formed their programs in secret, that the programs covered  only a fraction of an industry or an industry subgroup, and that self- regulatory organizations lacked the ability to enforce the guidelines or  practices among members. The Privacy Forum report cited examples of  self-regulatory efforts that were no longer in existence, such as the  Individual Reference Services Group. One academic privacy scholar  has argued that self-regulation largely affirms industry’s current and  prospective business practices, creates only narrow rights for consumers,  and does not cover new actors that may fall outside of the industry’s self- regulatory regime. The Privacy Rights Clearinghouse has argued that  self-regulation is ineffective because some companies use the “notice- and-choice model.” That is, they provide consumers with privacy policies  describing their data collection and use practices, but these policies are  often lengthy and dense, and consumers typically do not read or use  them to make informed choices. The organization has said that many  information resellers and other companies do little to inform consumers or  provide them with choices on the collection, handling, or disposition of  their data.
Robert Gellman and Pam Dixon, “Many Failures: A Brief History of Privacy Self- Regulation in the United States” (World Privacy Forum: Oct. 14, 2011).
In its March 2012 report on consumer privacy, FTC said that self- regulation could play an important role in consumer privacy but said that  there had been little self-regulation to date and it had not gone far  enough. In particular, FTC said that efforts by the information reseller  industry to establish self-regulatory rules on consumer privacy had fallen  short, noting that basic privacy concepts like transparency about the  nature of companies’ data practices and meaningful consumer control  were absent. The report acknowledged that imposing new privacy  protections would result in costs for industry, but said that additional  protections also would build consumer trust in the marketplace, which in  turn would benefit businesses. FTC’s report urged industry to accelerate  the pace of self-regulation and made several recommendations for  businesses aimed at increasing consumer choice and control and helping  to promote privacy protection.
section_title: Views Differ on Specific versus Comprehensive Approaches to Privacy Law and on Consumer Interests
paragraphs: In addition to the differing views on whether to impose additional  legislative or regulatory privacy protections, debate has focused on the  appropriate approach for any such legislation or regulation. In general,  this debate can be framed around three sets of issues, addressed below:  (1) a comprehensive versus sector-specific approach to privacy  legislation; (2) how to address consumers’ interests in accessing,  controlling, and correcting their data; and (3) the potential impact of new  regulation on consumers and commerce.
subsections: section_title: Views on a Comprehensive versus Sector-Specific Approach to Privacy Legislation
paragraphs: Debate has been ongoing about what kind of legislative approach— sectoral or comprehensive—would best effect enhanced consumer  privacy protections. As discussed previously, instead of being governed  by a comprehensive law that sets a baseline for privacy protections,  privacy in the United States is governed through a framework of subject- specific laws that apply to discreet economic sectors and protect selected  types and uses of consumers’ personal data. Such a framework is  relatively rare among nations; according to Commerce, many countries  have comprehensive privacy models under a single legal framework.
While not recommending a comprehensive federal privacy statute per se,  in 2010 Commerce’s Internet Policy Task Force recommended the  adoption of a baseline commercial data privacy framework built on an  expanded set of the FIPPs. The task force’s report solicited public  comment on whether these baseline privacy principles should be enacted  by statute or through other means. The report noted that adopting  baseline FIPPs would help fill gaps in current data privacy protections that  resulted from the current sectoral approach. Moreover, it noted that a  FIPPs-based framework might be more suitable for applying privacy  principles that could adapt to future changes in technology and other  conditions.
The 2012 White House privacy framework called on Congress to enact  baseline privacy legislation while also preserving existing sector-specific  laws. The Administration noted that the existing framework for consumer  data privacy in the United States was flexible and effectively addressed  some consumer data privacy challenges in the digital age. At the same  time, it noted that much of the personal data used on the Internet was not  subject to comprehensive federal statutory protection and that there was  a need to fill gaps across the range of environments in which individuals  have access to networked technologies. It said that baseline consumer  data privacy legislation that implemented the framework’s Consumer Bill  of Rights would provide a level playing field for companies, a consistent  set of expectations for consumers, and greater clarity and transparency  about the basis for FTC enforcement actions. At the same time, the  Administration argued that existing federal data privacy laws, such as  HIPAA and FCRA, provide effective and well-tailored privacy protections.  To avoid creating duplicative regulatory burdens, the Administration  supported exempting companies from consumer data privacy legislation  to the extent that their activities were subject to existing federal data  privacy laws. Thus, it said that baseline legislation would preserve  existing sector-specific federal laws that effectively protect personal data,  minimize the duplication of legal requirements, and provide consumers  with a clear sense of what protections they have and who enforces them.  FTC’s March 2012 privacy report also expressly called on Congress to  consider enacting baseline privacy legislation, while also urging industry  to accelerate self-regulation.
Some consumer and privacy groups and academic experts have cited  what they believe are several advantages to comprehensive privacy  legislation. First, they have said that only baseline legislation would fill  gaps in existing privacy protections and provide comprehensive  consumer privacy protections. Some consumer and privacy advocates  argued that the current sectoral privacy framework has produced highly  uneven results and many gaps in coverage. For example, the Center for  Democracy and Technology has noted that while strong privacy laws for  cable viewing and video records exist, the collection and use of much of  the data held by smartphone applications is subject only to Section 5 of  the FTC Act, which prohibits unfair or deceptive acts or practices in or  affecting commerce. Second, some advocates say that a  comprehensive law would offer uniformity—providing privacy protections  to consumers on a more reliable and consistent basis in a variety of  contexts. Comprehensive legislation also could create more uniformity to  the extent that it preempted state laws that were inconsistent with federal  policy.
Privacy advocates and some business representatives also have argued  that comprehensive privacy legislation would be beneficial for businesses.  In congressional testimony in 2010, one consumer advocate said that the  lack of comprehensive privacy protections put U.S. companies at a  disadvantage overseas because many foreign companies and  governments were uncomfortable with, or in some cases legally restricted  from, engaging in business with them. has suggested that comprehensive privacy legislation could help reduce  compliance costs because the current sectoral approach, with multiple  laws, makes compliance a complex and costly task for many  organizations. FTC noted in its 2012 privacy report that some business  representatives noted in public comments that baseline privacy legislation  would help provide legal certainty and serve as a key mechanism for  building trust among customers.
Testimony of Leslie Harris, July 22, 2010.
subsections: section_title: Potential Disadvantages of Comprehensive Privacy Legislation
paragraphs: Industry stakeholders have argued a comprehensive privacy law would  amount to a one-size-fits-all approach to regulation, which could be overly  burdensome because no single law can be tailored to fit the practices of  each individual company and industry. For example, one information  reseller told us comprehensive baseline privacy legislation might not  make distinctions between types of and uses for personal data and said  that data used for marketing purposes generally were more benign and  thus the threshold for privacy protections should be lower for these  purposes.
Stakeholders also said that the current sector-specific system was well- suited to addressing those gaps—for example through targeted  rulemaking or legislation that sought to address a specific new technology  or sector not adequately covered under current law. Moreover, they said  that a sector-specific approach provided greater flexibility to tailor  appropriate restrictions based on the types and uses of data. Some  industry representatives note that FCRA has been successful in providing  appropriate privacy protections tailored to specific types of data (those  used for certain eligibility determinations) that can be particularly sensitive  because they can affect a consumer’s ability to get credit, insurance, or  employment.
Other stakeholders also suggested refinements to existing sector-specific  laws. An information reseller with whom we spoke suggested that a  preferred alternative to implementing a comprehensive or baseline federal  privacy law would be to create more consistency in definitions and  approaches among the current sector-specific privacy laws. One privacy  advocate with whom we spoke said that because comprehensive privacy  legislation may be politically unfeasible, it may be beneficial instead to  focus on strengthening, extending, and updating existing sector-specific  legislation such as FCRA and HIPAA.
section_title: Views on How to Address Consumers’ Interests in the Use of and Control of Their Data
paragraphs: Other debate on privacy protections has focused on the third-party market  for and usage of consumer data, whether or how consumers can access  and control such usage or correct the data, and how or if limits should  apply to web tracking.
Changes in the marketplace for consumer data include a vast increase in  recent years in the number and types of companies that collect and share  such data with third parties. FTC has noted a distinction between first- party data—data held by the party that originally requested or collected  it—and third-party data—data purchased or otherwise obtained by a third  party, often to be used for a purpose different than originally intended.For example, as noted earlier, information from a retail store purchase or  a warranty registration card can be sold to a third party to be used for  marketing purposes. In the online environment, consumers who provide  their e-mail addresses and other personal information for a nonmarketing  purpose to a website may find that information sold to an advertising  network or data aggregator for purposes unrelated to that website. Some  information resellers may use the information that was provided to  determine the consumer’s identity and associated demographic  information, which can be used to customize future advertising, all without  the consumer’s awareness. In some cases, the information could be  sensitive—for example, activity on a health-related website that results in  the collection and use of information about a consumer’s interest in a  particular medical topic.
In a July 2010 testimony, a representative of one consumer advocacy  organization proposed certain limitations on the use of personal data for  purposes beyond which the data were provided. He noted that consumers  face obstacles in understanding how and why their information is being  collected, analyzed, and used, and that they cannot rely on privacy  policies and disclosures to provide clear disclosure or consent to  repurposing of a consumer’s information. privacy advocacy organizations with whom we spoke similarly noted that  consumers often were not aware of, and had not always consented to,  personal information being repurposed for marketing and other uses.
House Subcommittee on Commerce, Trade, and Consumer Protection, HR 5777, The  Best Practices Act, 111th Cong., 2nd sess., July 22, 2010; see testimony of Edmund  Mierzwinski, U.S. PIRG Consumer Program Director. disclosed the information for other purposes, they should provide  transparency and choice by disclosing those other purposes in a manner  that is prominent and easily understandable to consumers. In its 2012  privacy report, FTC articulated a “context of the interaction” standard for  determining when a practice required consumer choice. Under this  standard, a requirement for consumer choice would depend on the extent  to which the practice was consistent with the context of the transaction or  the consumer’s existing relationship with the business, or was required or  specifically authorized by law.
Representatives of information resellers, marketers, and other industries  that use consumer data have argued that repurposing of consumer  information generally is not inappropriate or harmful. According to one  reseller with whom we spoke, personal information that consumers  provide to unrestricted websites—such as certain social media sites,  blogs, or discussion boards—becomes publicly available information, and  therefore can be used by a third party for various purposes, without any  legal or ethical limitations on its use. Other industry representatives have  noted that companies often clearly disclose to consumers that information  consumers provide may be used for marketing purposes. For example,  some resellers with whom we spoke said that disclosure on how personal  information may be used generally was given when consumers provided  personal information through such venues as loyalty card programs,  contests and surveys, and website and warranty registrations. However,  they acknowledged that some consumers might not read these  disclosures. In addition, some industry representatives have noted that  information resellers avoid web extraction in most cases and that some  forms of web scraping violate the Direct Marketing Association’s  mandatory ethical standards, which prohibit a company from selling or  sharing personally identifiable information obtained from social media  channels or online referral marketing without prior permission from the  referred individuals.
Stakeholders’ views have differed on the extent to which consumers  should be able to access data held about them. In its 2012 report, FTC  said that companies should provide reasonable access to the consumer  data they maintain, a position that many privacy groups have echoed.
The agency noted that consumer access rights should be proportional to  the sensitivity and the intended use of the data at issue—for example,  consumers typically would have less access to data held about them for  marketing purposes than they would for data covered under FCRA and  used for eligibility determinations. FTC called on information resellers that  compile data for marketing purposes to explore creating a centralized  website where resellers would identify themselves and describe how they  collect and use consumer data, and the access rights and other choices  that consumers have. Some industry representatives with whom we  spoke said that such a centralized website would serve to confuse most  consumers and be costly to businesses. Representatives of two privacy  advocacy groups noted that while a centralized website would encourage  transparency, it likely would not provide consumers with comprehensive  or meaningful information. FTC staff told us that the agency has been  discussing the feasibility of such a centralized website with stakeholders.
Debate also has developed on consumers’ right to correct information  held about them for marketing purposes. As noted earlier, no federal law  that we examined gives consumers the right to correct or delete  inaccurate, incomplete, or unverifiable information used for marketing or  look-up purposes not covered by FCRA. Some privacy advocates and  members of Congress have argued that consumers should have the  inherent right to correct inaccurate information about them that is being  held and sold. In addition, one privacy advocate noted that uses of data  not covered by FCRA can include fraud prevention and identity  verification, and that inaccuracies in these databases can cause  inconvenience or harm to a consumer. For data used for marketing,  another privacy advocate has noted that companies may base some  individual product pricing on a consumer’s profile, so inaccurate data  could affect the price offered. However, both FTC and the Direct  Marketing Association have expressed the belief that special measures  are not needed to ensure the accuracy of data maintained and used for  marketing purposes because the only resulting harm to consumers might  be to receive irrelevant advertising. The Administration expressed a  similar view in its 2012 privacy framework, which noted that in providing  consumers the opportunity to correct inaccurate data, companies may  consider the scale, scope, and sensitivity of the data and whether  consumers would be exposed to any financial, physical, or other material  harm if the data were inaccurate. In addition, some resellers have stated  that because they acquire information continuously from a variety of  sources, providing consumers with an opportunity to correct erroneous  information would not be effective unless consumers also corrected the  information at the sources from which it had been drawn.
Some of the most publicized debate related to privacy and new  technologies has been on the issue of consumers’ ability to control the  tracking of their web activity. Areas of disagreement include the  effectiveness of voluntary initiatives that currently allow consumers to  exert some control over web tracking and the use of information collected  during such tracking. The Digital Advertising Alliance maintains a website  (http://aboutads.info/choices) that allows consumers to opt out of  behavioral advertising by its participating companies. The alliance also  developed an icon to let web page users know that their visit to that page  was being tracked and their actions used to infer their interests and target  future advertising. Users can click the icon to learn more about behavioral  advertising and control whether they receive such advertising and from   The Digital Advertising Alliance said it believes that  which companies.these initiatives provide consumers with meaningful and effective choice  tools. However, some privacy advocates have pointed to limitations to this  mechanism, noting that the opt-out option focuses on what behavioral  advertising consumers see rather than the extent to which their web  habits are tracked. In addition, the option applies only to companies that  are participants of the Digital Advertising Alliance, although the alliance  notes that this includes most online advertising networks.
Debate also has developed in recent years about the implementation of  “do not track,” another method for facilitating consumer choice. Under this  approach, consumers would be able to choose whether to allow the  collection and use of data about their online searching and browsing  activities (through cookies or other mechanisms). Typically, this would  involve the placement of a “flag” on the consumer’s browser signaling the  consumer’s choices for tracking and receiving targeted advertisements.  FTC supported the concept of a universal “do not track” mechanism in its  2010 and 2012 privacy reports, noting that it could be accomplished  either through legislation or through robust, enforceable self-regulation.  On the self-regulatory side, some Internet browsers, including Mozilla  Firefox, have introduced do-not-track features. The World Wide Web  Consortium has been developing a universal web protocol for “do not  track.” Disagreements among stakeholders on a number of different  issues (such as scope, technological specifications, and which parties  should respond to a request) have delayed widespread adoption or  standardization of “do not track.”
Additionally, various proposals have been made in Congress and  elsewhere that would require FTC to promulgate regulations to implement  a “do not track” mechanism. Although the specific methods and  parameters of the proposals vary widely, proponents have made several  general assertions in their favor. They note that the use of third-party  cookies and behavioral advertising greatly increased in recent years—for  example, the Wall Street Journal identified more than 3,000 tracking files  placed on a test computer by the top 50 websites.organizations such as the Center for Democracy and Technology have  argued that Internet users may not be fully aware of the extent of such  tracking by third parties and that users should have to affirmatively  consent to the tracking of their online behavior. Some members of   Advocacy  Congress also have raised concerns about supercookies (that is, flash  cookies) and whether these would be covered by the prohibition of unfair  or deceptive acts or practices in Section 5 of the FTC Act.
Representatives of the advertising and some other industries have  cautioned against many of the proposals for a do-not-track mandate. The  Digital Advertising Alliance has argued that the current opt-out  mechanism it provides is an effective means for consumers to control the  collection and use of their web viewing data, and that such self-regulation  is a more flexible and efficient approach than legislative mandate.  Industry representatives also have asserted that limiting consumer web  tracking could adversely affect consumers’ online experiences—for  example, by not facilitating advertising relevant to their interests or  reducing advertising revenues used to provide free content.
section_title: Views on the Potential Impact of New Regulation on Consumers and Commerce
subsections: section_title: Benefits of Information Sharing for Consumers
paragraphs: Representatives of the marketing and reseller industries have argued that  regulatory restrictions on the use of consumer data unintentionally could  reduce the benefits consumers reap from the use and sharing of personal  information. First, advertising representatives have noted that marketing  and advertising that can be targeted to individual consumers helps  underwrite the cost of web applications and online services that are  available free to consumers.personal information has resulted in many products and services that are  useful or enjoyable to consumers. For example, representatives of  individual reference (look-up) sites have noted that their products allow  users to reconnect with friends and family members or learn more about  prospective romantic partners. Similarly, representatives of leading  Internet service providers have noted that location-based services such   Second, the ability to collect and share  as those available on mobile devices can offer a vastly improved user  experience when the user reveals his or her current position. Third, some  resellers have said that consumers benefit from targeted behavioral  advertising because it provides them with information about products and  services relevant to their specific interests, needs, or preferences—all at  a time when the consumer is likely interested in such products or  services. A 2013 poll commissioned by the Digital Advertising Alliance  found that about 68 percent of respondents indicated they would prefer  that at least some of the Internet advertisements they saw were directed  toward their interests, compared with about 16 percent who preferred to  see random advertisements. The U.S. Chamber of Commerce has  noted that public policymakers must consider benefits to consumers in  weighing the trade-offs between protection of privacy rights and other  factors.
However, some privacy advocates expressed the belief that the benefits  to consumers have been overstated and were skeptical that most  consumers highly desired targeted advertising. Some advocates also  raised concerns that the profiling and scoring techniques used to deliver  specific advertisements to specific consumers might have discriminatory  effects because they presented information, sales, or opportunities only to  consumers with certain characteristics.
Stakeholder views again diverged in relation to the potential economic  effects of strengthened privacy regulations. The Direct Marketing  Association and other industry representatives have said that companies’  ability to readily collect, use, and share consumer information has had  economic benefits and fostered innovation that could be inhibited by  legislative proposals or regulation that restricted the collection and use of  this information. In 2010, commercial and nonprofit marketers spent about  $154 billion on direct marketing advertising expenditures, according to the  Direct Marketing Association, accounting for about 51 percent of all  advertising expenditures in the United States. Additionally, industry  representatives have noted that the Internet has become an increasingly  important part of the U.S. economy—for example, retail e-commerce  sales totaled about $225 billion in 2012, according to Commerce—and  data-driven marketing helped facilitate this activity. According to a study  by the Network Advertising Initiative, behaviorally targeted advertising  generated almost three times more revenue and was twice as effective at  converting browsers into buyers than nontargeted online advertising.  According to a study commissioned by the Interactive Advertising  Bureau—an organization of media and technology companies engaging  in online advertising—advertising-supported Internet activity that uses  consumer data has significant economic benefits, including job  creation.
In addition, representatives of the information reseller industry have said  that the use of consumer information for data-driven marketing helps to  foster competition online and ensures that large and small businesses  can reach consumers across the Internet. According to a 2011 study by a  global consulting firm, the availability of consumer data has enabled much  of recent economic innovation and growth. For example, the study cited the emergence of real-time location data as creating an entirely new  set of location-based services, from navigation applications to people  tracking. In a 2013 congressional hearing, representatives of two industry  associations stated that stricter privacy controls would increase  compliance costs for businesses, particularly smaller businesses.
However, privacy and consumer groups generally have argued that even  with restrictions on the use of consumer data, industries that use such  data would find a way to expand their businesses and remain profitable.  They noted that the industry’s claims that increased privacy protections  would be too burdensome and stifle innovation have not been  accompanied by convincing evidence. Moreover, some privacy and  consumer groups have stated that effective privacy regulations actually  can have positive effects on the economy and innovation. They noted that  privacy-enhancing technology, such as data encryption, that safeguards  personal information online has led to greater consumer participation  online, including more e-commerce. privacy protections may encourage companies to develop innovative  services that rely less on personal information. The White House privacy  framework noted that consumers who feel protected from misuse of their  personal information likely would be more open to engaging in commerce  and various online technologies. Privacy advocates have cited the  example of encryption technology to enable secure online payments as  increasing consumers’ willingness to engage in online financial  transactions. In addition, one privacy organization noted that  competition among companies to address consumers’ privacy concerns  could encourage innovations.
See letter of consumer and privacy organizations. Industry representatives also have  talked about the importance of consumer trust. For example, in A Status Update on the  Development of Voluntary Do-Not-Track Standards, April 24, 2013; see testimony of  Harvey Anderson, Senior Vice President Business and Legal Affairs, Mozilla.
Similarly, the Federal Communications Commission stated in a 2012  report that companies that could demonstrate clear and consistent  transparency in collection and use of personal information could be  competitive and more attractive to consumers. In public comments  solicited by Commerce in 2010 on information privacy and innovation in  the Internet economy, online businesses and advertisers noted the  importance of respecting customers’ privacy if they wanted to retain their  business, and information and communications technology companies  stated that privacy protections were necessary to encourage individuals  to adopt new devices and services. According to a representative of  one privacy organization, even in those cases in which privacy  regulations served to inhibit one line of marketing—as with the effect on  telemarketers of regulation creating the National Do Not Call Registry— advertisers and marketers have been able to rapidly shift to other  profitable marketing avenues.
Department of Commerce, Internet Policy Task Force, Commercial Data Privacy and  Innovation in the Internet Economy: A Dynamic Policy Framework (Washington, D.C.:  2010). to track and comply with data protection laws in each country.  Specifically, some who commented noted gaps in protection for  consumers whose data were transferred across borders, because it was  not always clear who had jurisdiction over data and what protections  existed for foreign consumers. To overcome these obstacles, they  recommended a number of options, with the majority advocating for  greater harmonization and the ability to work together across systems  (interoperability). The Administration’s 2012 privacy framework echoed  these concerns and noted that creating interoperability between different  nations’ privacy regimes was critical to the continued growth of the digital  economy. Underlying the approach to achieving international  interoperability, it said, were mutual recognition of commercial data  privacy frameworks, cooperation in enforcing these frameworks, and  mechanisms that allow companies to demonstrate accountability.
As noted previously, the European Union’s 1995 Data Protection  Directive provides a comprehensive privacy framework and states that  the personal information of European Union citizens may not be  transmitted to nations not deemed to have “adequate” data protection  laws. The United States does not have an adequacy finding from the  European Commission (the executive body of the European Union).  However, companies that participate in the U.S.-EU Safe Harbor  Framework are deemed to provide adequate data protections and may  transfer personal data from the European Union. observers have warned against enacting a strict privacy regime like the  one in the European Union. For example, according to a representative of  an information reseller, moving to a strict privacy regime similar to that of  the European Union would hinder commerce and innovation and have a  strongly detrimental effect on certain industries and the overall U.S.  economy. A representative of another information reseller said that the  U.S. privacy regime has worked well and agreed that making it more like  that of the European Union would have detrimental, unintended  consequences, such as harming economic growth and innovation.
FTC has the authority to enforce the substantive privacy requirements of the U.S.-EU  Safe Harbor Framework.
section_title: Conclusions
paragraphs: The advent of new and more advanced technologies and changes in the  marketplace for consumer information have vastly increased the amount  and nature of personal information collected and the number of parties  that use or share this information. While the views of stakeholders differ,  based on our review, we found that gaps exist in the current statutory  privacy framework. In particular, the current framework does not fully  address changes in technology and marketplace practices that  fundamentally have altered the nature and extent to which personal  information is being shared with third parties. Moreover, while current  laws protect privacy interests in specific sectors and for specific uses,  consumers have little control over how their information is collected, used,  and shared with third parties for marketing purposes. As a result, current  privacy law is not always aligned with the Fair Information Practice  Principles, which Commerce and others have said should serve as the  foundation for commercial data privacy.
Thus, the current privacy framework warrants reconsideration in relation  to a number of issues, including consumers’ ability to access, correct, and  control their personal information used for marketing; the types of  personal information collected and the sources and methods for collecting  it; and privacy controls related to relatively new technologies, such as  web tracking and mobile devices. At the same time, different legislative  approaches to improving privacy—including comprehensive or sector- specific—involve trade-offs and have advantages and disadvantages.  The challenge will be providing appropriate privacy protections without  unduly inhibiting the benefits to consumers, commerce, and innovation  that data sharing can accord.
section_title: Matter for Congressional Consideration
paragraphs: Congress should consider strengthening the current consumer privacy  framework to reflect the effects of changes in technology and the  marketplace—particularly in relation to consumer data used for marketing  purposes—while also ensuring that any limitations on data collection and  sharing do not unduly inhibit the economic and other benefits to industry  and consumers that data sharing can accord. Among the issues that  should be considered are  the adequacy of consumers’ ability to access, correct, and control  their personal information in circumstances beyond those currently  accorded under FCRA; whether there should be additional controls on the types of personal  or sensitive information that may or may not be collected and shared;  changes needed, if any, in the permitted sources and methods for  data collection; and privacy controls related to new technologies, such as web tracking  and mobile devices.
section_title: Agency Comments
paragraphs: We provided a draft of this report for review and comment to the  Department of Commerce and the Federal Trade Commission. In written  comments, which are reprinted in appendix III, Commerce agreed that  evolving technology and business practices are changing the ways that  consumers’ personal information is collected and used, and that  strengthened privacy protections could better protect consumers and  support innovation. It also noted that the Administration’s privacy  framework supports privacy legislation that would create baseline  protections for consumers while preserving existing sector-specific federal  laws. In addition, the Federal Trade Commission provided technical  comments, which we incorporated as appropriate.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  report date. At that time, we will provide copies to other interested  congressional committees, as well as the Secretary of Commerce and the  Chairman of the Federal Trade Commission. We will also make copies  available to others upon request. In addition, this report will be available  at no charge on our website at http://www.gao.gov.
Should you or your staff have questions concerning this report, please  contact me at (202) 512-8678 or cackleya@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. Key contributors to this report are listed in  appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report examines (1) existing federal laws relating to the privacy of  consumer information held by information resellers, (2) any gaps that may  exist in this legal framework, and (3) views on approaches for improving  consumer data privacy. For the purposes of this report, we defined  information resellers as companies with a primary line of business of  collecting, aggregating, and selling publicly available and private personal  information to third parties. This report focuses primarily on privacy issues  related to consumer information used for marketing and for individual  reference services—sometimes called look-up or people-search services.  We generally excluded from our review privacy issues related to  consumer data collected and used by information resellers for purposes  such as fraud prevention, eligibility determination for credit or  employment, and legal compliance.
To determine laws that relate to the privacy and safeguarding of  consumer information held by information resellers, we reviewed relevant  federal and selected state laws and determined their applicability to  information resellers’ collection and use of consumer information used for  marketing and individual reference services. Specifically, we reviewed  various law review and legal journal articles, conducted searches of the  Westlaw database, and reviewed and analyzed a legal treatise compiling  laws relating to data privacy, including any laws applicable to government  records, electronic surveillance, medical data, financial information,  commercial transactions, and online activity. We reviewed laws in terms  of their general purpose, applicability to resellers or the collection and use  of consumer information, as well as applicable agency regulations.
In conducting our analyses, we determined that privacy laws are  applicable for specific purposes, in certain situations, to certain sectors, to  certain types of entities, or to certain types of records; and categorized  our findings into two major groups that included (1) primary federal  privacy laws, and (2) other federal privacy laws that also may apply to  information resellers’ practices and products, consumer services, or types  of records. We also reviewed and analyzed relevant state laws governing  consumer privacy and data security, and identified those states that also  enacted privacy legislation beyond data breach notification. We reviewed  selected Federal Trade Commission (FTC) enforcement actions related to  its deception and unfairness authority. To determine whether gaps may  exist in the current privacy framework, we analyzed these federal laws  and related regulations to assess the extent of privacy protections under  federal law and any limitations in their scope, including the adequacy of  consumers’ ability to access, correct, opt out, or request deletion of  information.
To obtain views on approaches to improving consumer data privacy—as  well as gather additional information on potential gaps in the privacy  framework for consumer privacy—we identified and analyzed relevant  studies and reports, Congressional testimony, legislative and regulatory  proposals, position papers, and other documents from governmental and  nongovernmental stakeholders. We solicited views on these issues from  representatives of various organizations that represent the interests of  information resellers, advertisers, and consumers, as well as federal  agencies. We reviewed the Fair Information Practice Principles (FIPPs), a  set of internationally recognized principles for protecting the privacy and  security of personal information, and the framework for consumer data  privacy issued by the White House in February 2012. We also reviewed  relevant public comments that the Department of Commerce (Commerce)  and FTC received from notices soliciting such comments. In addition, we  reviewed correspondence from information resellers in response to the  Bipartisan Congressional Privacy Caucus’s inquiry into nine resellers’ use  of consumer information.
To address all three objectives, we also used Internet search techniques  and keyword search terms to identify sources and types of available  information about the reseller industry, including the definition of  information resellers; number and nature of companies that serve as  information resellers; industry revenues; product offerings; internal  controls and practices; extent of consumer information collected and  maintained; and who is buying information resellers’ products and for  what purposes. In doing so, we generally obtained information from  various online research sources such as LexisNexis, Proquest, and  Gartner, which consisted of company dossiers, journals, trade  publications, periodicals, studies, white papers, and aggregated  databases relevant to the reseller industry. We also analyzed U.S.
Census Bureau data to obtain information on business classification  codes (including Standard Industrial Classification and North American  Classification System codes) assigned to reseller companies to classify  their main industry and line of business. On the basis of our analyses, we  determined that the data do not provide a reliable count or other statistical  information on the information reseller industry, and there is limited  publicly known information about the industry as a whole.
We obtained documentation from, and interviewed representatives of,  federal agencies, including the Consumer Financial Protection Bureau,  Commerce, and FTC; trade associations, including the Consumer Data  Industry Association and Direct Marketing Association; consumer and  privacy advocacy organizations, including the Center for Digital  Democracy, Electronic Privacy Information Center, Privacy Rights  Clearinghouse, U.S. Public Interest Research Group, and World Privacy  Forum; Privacy Times, a newsletter that covers privacy law and policy;  and Safe Shepherd, a company that provides products and services to  protect privacy. In addition, we interviewed (in some cases, receiving  written responses to questions we provided) six information resellers— Acxiom, Epsilon, Experian Marketing, Intelius, LexisNexis (Reed  Elsevier), and Spokeo. These companies were selected because, based  on our analyses, they constituted a mix of the largest and most widely  recognized resellers that maintain a range of products and services that  collect and sell consumer information for purposes including marketing,  individual reference services, or both. The information resellers we  included and the products they offer do not necessarily represent the full  scope of the industry. We reviewed marketing materials and other  documentation from these companies. Additionally, we reviewed our 2006  and 2008 reports on information resellers as well as recent work on  issues related to consumer and data privacy, and other related subjects.
We conducted this performance audit from August 2012 through  September 2013, in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
section_title: Appendix II: Examples of Data Collected and Used by Information Resellers
paragraphs: Tables 2 and 3 illustrate some of the consumer information included in  the marketing products offered by two large information resellers, Acxiom  and Experian Marketing.
section_title: Appendix III: Comments from the Department of Commerce
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Jason Bromberg (Assistant  Director), Michelle Bowsky, William R. Chatlos, Rachel DeMarcus, Beth  Faraguna, Kun-Fang Lee, Patricia Moye, Barbara Roesmann, Rachel  Siegel, and Jena Sinkfield made key contributions to this report.