Progress & Freedom Foundation Podcasts

We had a great discussion yesterday about the technical underpinnings of the ongoing privacy policy debate in light of the discussion draft of privacy legislation recently released by Chairman Rick Boucher (see PFF's initial comments here and here). I moderated a free-wheeling discussion among terrific panel consisting of:

• Lorrie Faith Cranor, Associate Professor, Computer Science, Engineering & Public Policy at Carnegie Mellon University; director of the CyLab Usable Privacy and Security Laboratory


• Ari Schwartz, Vice President & Chief Operating Officer, Center for Democracy & Technology


• Shane Wiley, Senior Director, Privacy & Data Governance, Yahoo!

Here's the audio (video to come!)

Ari got us started with an intro to the Boucher bill and Shane offered an overview of the technical mechanics of online advertising and why it requires data about what users do online. Lorrie & Ari then talked about concerns about data collection, leading into a discussion of the challenges and opportunities for empowering privacy-sensitive consumers to manage their online privacy without breaking the advertising business model that sustains most Internet content and services. In particular, we had a lengthy discussion of the need for computer-readable privacy disclosures like P3P (pioneered by Lorrie & Ari) and the CLEAR standard developed by Yahoo! and others as a vital vehicle for self-regulation, but also an essential ingredient in any regulatory system that requires that notice be provided of the data collection practices of all tracking elements on the page.

For more info, check out:

• Ari's recent paper Looking Back at P3P: Lessons for the Future


• Lorrie's work on P3P Deployment on Websites and Standardizing Privacy Notices: An Online Study of the Nutrition Label Approach.


• The IAB/NAI Technical Specifications for CLEAR Ad Notice (Control Links for Education and Advertising Responsibly)

In particular, we touched on the critical question raised by the Boucher bill: Will website publishers be required to disclose the data collection practices of all parties they allowed to collect data from thei webpages? While it is commonly said that websites "share" information with advertisers (a view seemingly implied by the Boucher bill), in fact, it would be more accurate to say that website publishers simply allow third parties to load tracking elements on their pages, and as a technical matter, they have no way of knowing definitively who all the data collectors on their page might be, let alone what their particular data collection and privacy practices are--not just for behavioral advertising, but for the basic reporting, analytics, conversion optimization, sequencing, frequency capping, and other techniques that make online ads profitable for publishers (thus supporting more free content and services) and also more relevant to users. More on this to come!

Adam Thierer & I offered our initial thoughts upon first reading the discussion draft of the privacy bill introduced by Rep. Rick Boucher (D-VA) & Cliff Stearns (R-FL). In PFF's latest TechCast, I sat down to discuss the bill and my concerns about it with PFF's VP for Communications, Mike Wendy:

Stay tuned for more from us on this. PFF plans to file written comments, as solicited by the bill's authors, by June 4. For more on this, check out our comments to the FTC last December on these issues.

Subscribe now to PFF's TechCast podcast (generally 5-8 minutes) by RSS or through iTunes!