The Federal Trade Commission and Consumer Privacy in the Coming Decade

The large majority of consumers believe that the term “privacy policy” describes a baseline level of information practices that protect their privacy. In short, a Joseph Turow, Ph.D., is the Robert Lewis Shayon Professor of Communication at the University of Pennsylvania’s Annenberg School for Communication, and the director of the Information & Society Program at the University of Pennsylvania’s Annenberg Public Policy Center. He is the author of, among other books, Niche Envy: Marketing Discrimination in the Digital Age (Cambridge, MA: MIT Press, 2006). b Chris Jay Hoofnagle, J.D., is a senior staff attorney at the Samuelson Law, Technology & Public Policy Clinic, and a senior fellow at the Berkeley Center for Law & Technology of the Boalt Hall School of Law. c Deirdre K. Mulligan, J.D., is the director of the Samuelson Law, Technology & Public Policy Clinic and the Clinical Program at the Boalt Hall School of Law. The work of the Samuelson Clinic is generously supported through an endowment from Professor Pamela Samuelson and Robert Glushko, Ph.D. Additional funding is provided by: The Rose Foundation for Communities and the Environment, the California Consumer Protection Foundation, and the National Science Foundation, Team for Research in Ubiquitous Secure Technologies, NSF CCF-0424422. d Nathaniel Good is a Ph.D. candidate at the School of Information at the University of California, Berkeley. e Jens Grossklags is a Ph.D. candidate at the School of Information at the University of California, Berkeley. His work is supported in part by the National Science Foundation through ITR award ANI-0331659. f This article originally appeared as a paper presented under the same title at the Federal Trade Commission Tech-ade Workshop on November 8, 2006. The version published here contains additional information collected during a 2007 survey. I/S: A JOURNAL OF LAW AND POLICY FOR THE INFORMATION SOCIETY 724 I/S: A JOURNAL OF LAW AND POLICY [Vol. 3:3 “privacy,” like “free” before it, has taken on a normative meaning in the marketplace. When consumers see the term “privacy policy,” they believe that their personal information will be protected in specific ways; in particular, they assume that a website that advertises a privacy policy will not share their personal information. Of course, this is not the case. Privacy policies today come in all different flavors. Some companies make affirmative commitments not to share the personal information of their consumers. In other cases, however, privacy policies simply inform consumers that unless they “opt out” of sharing certain information, the company will communicate their personal information to other commercial entities. Given that consumers today associate the term “privacy policy” with specific practices that afford a normative level of privacy protection, the use of the term by a website that does not adhere to these baseline practices can mislead consumers to expect privacy that, in reality, does not exist. This is not to suggest that companies intend to mislead consumers, but rather that consumers today associate certain practices with “privacy policy” just as they associate certain terms and conditions with the word “free.” Because the term “privacy policy” has taken on a specific meaning in the marketplace and connotes a particular level of protection to consumers, the Federal Trade Commission (“FTC”) should regulate the use of the term “privacy policy” to ensure that companies using the term deliver a set of protections that meet consumers’ expectations and that the term “privacy policy” does not mislead consumers during marketplace transactions. 1 Often consumers are not provided with a means to “opt out” of information sharing. 2007-08] TUROW, HOOFNAGLE, MULLIGAN, GOOD & GROSSKLAGS 725