CDD

News

  • News

    Privacy and Consumer Advocates Leave Administration’s “Multistakeholder” Negotiations on Facial Recognition

    Cite Industry Refusal to Support a Consumer’s Right to Control their own Facial Data

    Today, the groups participating in the Obama Administration’s so-called multi-stakeholder negotiations to develop a self-regulatory “code of conduct” on facial recognition and privacy sent a letter (attached) to the Commerce Department explaining why they would no longer participate in the process. As CDD has said from the start, the approach the Administration embraced to protect consumers’ rights to their personal information was flawed. It relied on the data collection and digital marketing industry to support significant new policies that would empower individuals to make decisions about how their information can be collected and used. Right now, of course, it’s individual companies and industry-wide data gathering practices that have left Americans with barely any privacy. For the industry—including Google, Facebook, and Microsoft—what’s foremost in their political agenda is preserving their right to use all our personal information without constraint. It never made sense to expect industry to turn away from business practices that reap billions of dollars. What was needed at the outset was an independent agency such as the Federal Trade Commission proposing tough new rules—and an administration willing to fight for the interests of the public. The multi-stakeholder approach to Internet governance cannot work when it involves challenging the economic (or political) interests of the digital industry and its partners. Our facial data is sensitive, personal information. Before companies can gather it—let alone use it—a person must have at a minimum full knowledge on how it will be used and give meaningful prior consent. None of the companies or industry trade associations participating in the Commerce Department-led initiative is willing to support opt-in for facial recognition. That’s because they are increasingly using facial recognition technologies to track and target people in commercial settings, adding our face and other biometric data to the vast amounts of information they now routinely gather. The withdrawal by the consumer and privacy groups should wake up the Obama Administration—it must embrace a new ethics-based approach to how it develops consumer privacy safeguards. Relying on the digital foxes (the data industry) to develop rules on data gathering and use will actually lead to the further erosion of our privacy and consumer protections. This failure by the White House on privacy underscores why the EU must oppose U.S. attempts to weaken its own civil rights-based approach to data protection, especially through the TTIP trade deal. .
  • The Center for Digital Democracy (CDD), in its ongoing efforts to monitor the Federal Trade Commission’s enforcement of the Children’s Online Privacy Protection Act (COPPA), has filed a motion in the U.S. District Court of the District of Columbia challenging the FTC’s refusal to release important COPPA documentation. The case involves seven “safe harbor” programs, such as KidSAFE and TRUSTe, approved by the FTC to handle website compliance with COPPA regulations. CDD originally made its request in July 2014, under the Freedom of Information Act, seeking access to annual reports filed with the FTC by safe harbor organizations, as required by COPPA. In light of the commission’s failure to respond to that request within FOIA’s statutory time limit, CDD initiated the current legal proceeding in December 2014. Two months later, the FTC finally responded to CDD’s FOIA request, releasing heavily redacted annual reports amounting to less than half of CDD’s original request.As CDD’s court filing makes clear, the FTC has been overzealous in protecting the self-interest of the private Safe Harbor programs. CDD’s predecessor, the Center for Media Education, spearheaded the movement that led to the passage of COPPA in 1998. The regulation applies primarily to commercial websites that target children under 13, limiting the collection of personal information, providing a mechanism for parental involvement, and placing obligations on companies for adequate disclosure and protection of data. More recently, CDD led a coalition of child advocates, privacy groups, and health experts that successfully pressed for a revised set of regulations that update and clarify COPPA’s basic safeguards. These new regulations, which became effective in 2013, add new protections specifically designed to address a wide range practices on social media, mobile, and other platforms. Without the diligent oversight of the FTC, however, COPPA regulations will mean little in the rapidly evolving online marketplace. As it awaits a favorable ruling from the District Court, CDD remains committed to ensuring that COPPA is fully and fairly enforced. See the filed memo attached below.
  • Digital Data and Consumer Protection: Ensuring a Fair and Equitable Financial Marketplace. Author and Professor Frank Pasquale discusses his new book "The Black Box Society," on the growing use of secret algorithms to categorize consumers. A Project of US PIRG Education Fund & Center for Digital Democracy Part 1: Keynote by Professor Frank Pasquale, author of "The Black Box Society" (Harvard University Press 2015) https://www.youtube.com/watch?v=hkXdxYG_lFA (link is external) Part 2 (Panel 1): Advocates Sarah Ludwig, (New Economy Project-NYC) and Alexis Goldstein (Other98.org (link is external)) w/ Frank Pasquale and Ed Mierzwinski, USPIRG Education Fund https://www.youtube.com/watch?v=yH5YNPBsEAQ (link is external) Part 3 (Panel 2) : Regulators Jessica Rich (FTC) and Peggy Twohig (CFPB) w/ Frank Pasquale and Jeff Chester, Center for Digital Democracy https://www.youtube.com/watch?v=-tgnf0nsBrM (link is external) About this project: American consumers face new challenges and opportunities to their financial security as our economy is transformed by the convergence of digital media with “Big Data” technologies. Our use of mobile phones, social media, “apps,” and other online tools have created new ways for us to spend, save and borrow money. Powerful forces are at work, however, that can undermine a consumer’s ability to make the best choices and may place those already financially at risk even more vulnerable. The digital data-driven economy continually gathers vast amounts of information on individuals, online and offline, which is used to create a “profile” about our spending habits, behavior and our geo-location. These profiles can be “scored”—an invisible measure known only to the marketer and data brokers—that can determine whether we are offered high interest credit cards, payday and for-profit college loans and even what we may pay at retail and grocery stores. The uses of the information can be positive or, absent any regulation or meaningful protections, lead to discrimination, price manipulation or denied opportunity. Our collected personal information is merged into an ever-expanding database of information that enables firms we may know about and many others we don’t know to engage in personalized high-tech marketing and advertising practices designed to get us—and our families—to continually spend more money. In today’s online world, a consumer can be targeted for offers nearly 24/7, whether we use a mobile phone, computer, or while watching TV. American consumers do not have meaningful safeguards for these data analytics and digital marketing practices, including both protecting their privacy and preventing misuse of their information to deny economic opportunity. USPIRG Education Fund (link is external) and the Center for Digital Democracy are working together to ensure that consumers are treated fairly by this new digital “wild west” financial marketplace. Case Studies and Reports: Online Lead Generation: What You need-to-know to Protect Yourself from Companies in the Business of Secretly Selling You to Predatory Payday and Other Short-term Loan Companies (link is external) (May 2015) Targeting Hispanics for Leads in the Digital Big Data Era (link is external)(May 2015) Private For-Profit Colleges and Online Lead Generation: Private Universities Use Digital Marketing to Target Prospects, Including Veterans, via the Internet (link is external) (May 2015) Big Data Means Big Opportunities and Big Challenges: Promoting Financial Inclusion and Consumer Protection in the “Big Data” Financial Era (link is external) (March 2014) Law Review Articles: Selling Consumers Not Lists: The New World of Digital Decision-Making and the Role of the Fair Credit Reporting Act (link is external), Suffolk University Law Review, (December 2013) Available Video and Webinar Presentations: Video archive (link is external) of the “Data, Lending, and Civil Rights” conference at Georgetown University, 8 April 2015, (agenda and information (link is external)) sponsored by Americans for Financial Reform, The Leadership Conference Education Fund and the Center on Privacy and Technology at Georgetown Law. (Ed Mierzwinski’s panel begins at approximately 2h 45m and Ed’s main remarks at approximately 3h 2m 30sec.) USPIRG Education Fund and Center for Digital Democracy acknowledge the support of the Ford Foundation, the Annie E. Casey Foundation, the Rose Foundation for Communities and the Environment and the Digital Trust Foundation for support of our research and education work on data and financial opportunity. We thank them for their support but acknowledge that the work, events, reports and investigations are those of the authors and organizations alone, and do not necessarily reflect the opinions of the Foundations. This work is licensed under a Creative Commons Attribution 4.0 International License (link is external)
  • CDD's executive director Jeff Chester called on regulators representing dozens of nations to address the role that today's data collection complex plays in consumer transactions and services. Speaking at the 2015 annual meeting of the International Consumer Protection and Enforcement Network (ICPEN), Chester said that in order to protect consumes today's regulatory agencies--such as the FTC--must understand how data issues are integrally a part of consumer services, including in the financial, health, and retail marketplace. A modified version of the presentation is attached, minus the videos shown that illustrated the cross-device tracking and Big Data Management Platforms that are just the latest developments in digital targeting of individuals. There were also video presentations on how programmatic advertising works (targeting junk food to kids); the role that measurement plays (continually analyzing how we respond to a range of applications and interactions); and the growing use of neuromarketing (fMRI's, facial coding, etc.) is shaping digital marketing and other communications so that it operates at the subconscious and emotional level of individuals. The "story" the slides tell is that to protect consumers in the 21st Century, consumer regulatory agencies need to address how digital marketing actually operates, which is, of course, through a system that integrates data collection with a range of online advertising applications (to "immerse" users in the interactive content, through social media surveillance, neuromarketing, geo-location, etc.). Consumer agencies should tackle the "path-to-purchase" paradigm, supported by Google and others, that continually targets an individual to influence their purchasing behaviors both online and offline. Digital marketing is really a powerful system designed to promote the influence of brands and products, including through ways designed to change how an individual thinks, feels and acts. We explained that this was a global system, with the same set of marketing and data gathering practices being used in SE Asia, Middle East, Latin America, EU, U.S., etc. So here's a quick run-down of the slides attached, minus the videos. Slide 1: 21st Century Consumer protection must address the role that data collecting and its use play with the marketing and provision of services, including financial and health. Slide 2: Scholars, such as Prof. Frank Pasquale, are raising concerns about the role that complex data analysis plays in decision-making on individuals. They have called for regulators to address how the "Black Box" of algorithms and related predictive analytic tools is used in the marketplace. Slide 3: This slide from Adobe illustrates one of my points, that the “Black Box” reflects deliberately chosen business practices used to target individuals. The so-called “secret sauce” is often visible by examining how the businesses use their data and marketing to sell or promote to consumers. Slide 4: What safeguards are required today. Slide 5: Our work since the early 1990’s to address the role that data plays in the commercial marketplace, including our leading campaign to enact the Children’s Online Privacy Protection Act (COPPA) in 1998. We explained we fought for privacy rules that would protect everyone back in the 1990’s, but the industry opposition then—as today—was too strong to get anything except for children. Slide 6: Explained that the basic business model for online was articulated back in the early 1990’s in the book “One-to-One Future.” At that time, it was about tracking an individual across a single website; today includes omnipresent tracking across devices and applications. The picture on the right is Facebook’s new data center in Sweden, the largest one it has built in the EU. Slide 7: Illustrates the role that online data collection, through lead generation, played in the global financial crisis. Online lead gen used to sell subprime loans in the U.S. Message was there are vast international consequences—to people, families, and nations—with how the online marketing system operates. Slide 8: Our recent FTC complaint on Google’s YouTube Kids unfair and deceptive ad practices that target the youngest children. Slide 9: It’s a global system and an international problem. Slide 10: What’s been created in a commercial surveillance system of individuals, groups, and communities. Slide 11: The path-to-purchase paradigm and need for regulators to understand and address the continual monitoring and targeting of consumers. Slide 12: The role that contemporary “Big Data” practices play in marketing. Slide 13: The mobile device’s critical role in digital marketing, including how quickly it achieved mass use (compared with other media). Slide 14: The complex of data companies, often working closely together, that assembles profiles of an individual. Slide 15: It’s not anonymous. It’s about an individual. Slide 16: To address today’s consumer practices, you need to analyze how both data and digital marketing applications are used. Slide 17: The intent is to understand and “manage” a person’s identity, for commercial (and also political) purposes. Slide 18: Facebook sells itself to advertisers by saying they know the “identity” of the user. Slides: 19-20: A person is sold in real-time, milliseconds, to marketers via so-called programmatic buying (ad exchanges, etc.). Gave example from McDonald’s in Denmark. Slides: 21-23. Features of contemporary digital marketing. Slides 24-25: Companies are engaged in social media surveillance, including through the monitoring and analysis of blogs, posts, etc. They are now social media “command centers” engaging in such practices 24/7. Slides 26-28: Examples of digital marketing of loans to low-income consumers, health products and alcoholic beverages. Slide 29: Real-time data targeting and sells of a user/household coming to TV. Slide 30: Teens require safeguards. Role of junk food companies using digital marketing, despite global youth obesity epidemic. Slide 31: Problems will grow, with Internet of Things, mobile payments, wearable’s, etc. Final Slide: Need to proactively act. Regulators should be concerned that trade deals, such as TPP and TTIP, will restrict their ability to act on the future. PS: FTC Commissioner Julie Brill gave a terrific presentation on these issues, raising many key concerns (attached).
  • News

    Child and Consumer Advocates Urge Federal Trade Commission to Investigate and Bring Action Against Google for Excessive and Deceptive Advertising Directed at Children

    So-called “Family-Friendly” YouTube Kids App Combines Commercials and Videos, Violating Long-Standing Safeguards for Protecting Children

    Washington, DC – Tuesday, April 7 – A coalition of prominent children’s and consumer advocacy groups filed a complaint with the Federal Trade Commission (FTC) today requesting an investigation of Google, charging the company with unfair and deceptive practices in connection with its new YouTube Kids app. The complaint (link is external) details a number of the app’s features that take advantage of children’s developmental vulnerabilities and violate long-standing media and advertising safeguards that protect children viewing television. Among the specific practices identified in the complaint are:Intermixing advertising and programming in ways that deceive young children, who, unlike adults, lack the cognitive ability to distinguish between the two;Featuring numerous “branded channels” for McDonald’s, Barbie, Fisher-Price, and other companies, which are little more than program-length commercials;Distributing so-called “user-generated” segments that feature toys, candy, and other products without disclosing the business relationships that many of the producers of these videos have with the manufacturers of the products, a likely violation of the FTC’s Endorsement Guidelines.When it launched the YouTube Kids app in February, Google described it as “the first Google product built from the ground up with little ones in mind.” As the complaint points out, however, the company appears to have ignored not only the scientific research on children’s developmental limitations, but also the well-established system of advertising safeguards that has been in place on both broadcast and cable television for decades. Those important policies include (1) a prohibition against the host of a children’s program from delivering commercial messages; (2) strict time limits on the amount of advertising any children’s program can include; (3) the prohibition of program-length commercials; and (4) the banning of “product placements” or “embedded advertisements.” Such “blending of children’s programming content with advertising material on television,” the group’s complaint declares, “has long been prohibited because it is unfair and deceptive to children. The fact that children are viewing the videos on a tablet or smart phone screen instead of on a television screen does not make it any less unfair and deceptive.” The complaint also charges that Google is violating its own advertising policies for YouTube Kids. For example, while the company promises that food and beverage ads will not appear on the app, advertising and promotions for junk food are prominently featured throughout. “YouTube Kids is the most hyper-commercialized media environment for children I have ever seen,” commented Dale Kunkel, Professor of Communication, University of Arizona. “Many of these advertising tactics are considered illegal on television, and it's sad to see Google trying to get away with using them in digital media.” “There is nothing 'child friendly' about an app that obliterates long-standing principles designed to protect kids from commercialism,” added Josh Golin, Associate Director of Campaign for a Commercial-Free Childhood. “YouTube Kids exploits children’s developmental vulnerabilities by delivering a steady stream of advertising that masquerades as programming. Furthermore, YouTube Kids' advertising policy is incredibly deceptive. To cite just one example, Google claims it doesn't accept food and beverage ads but McDonald's actually has its own channel and the 'content' includes actual Happy Meal commercials.” Angela J. Campbell of the Institute for Public Representation at Georgetown Law, who serves as counsel to the coalition, called on the FTC to "investigate whether Disney and other marketers are providing secret financial incentives for the creation of videos showing off their products. The FTC’s Endorsement Guides require disclosure of any such relationships so that consumers will not be misled." “In today’s digital era, children deserve effective safeguards that will protect them regardless of the ‘screen’ they use,” explained Jeff Chester, Executive Director of the Center for Digital Democracy. “In addition to ensuring that Google stops its illegal and irresponsible behavior to children on YouTube Kids, new policies will be required to address the growing arsenal of powerful digital marketing and targeting practices that are shaping contemporary children’s media culture – on mobile phones, social media, gaming devices, and online video platforms.” Organizations signing the complaint include: the Center for Digital Democracy, Campaign for a Commercial-Free Childhood, American Academy of Child and Adolescent Psychiatry, Center for Science in the Public Interest, Children Now, Consumer Federation of America, Consumer Watchdog, Consumers Union, Corporate Accountability International, and Public Citizen
  • Three years ago, (link is external) President Obama promised that his administration would deliver a “Privacy Bill of Rights” to protect American consumers. The bill released today is a serious setback for privacy. Instead of effective rights that Americans can rely on to protect themselves and their families from the onslaught of online and offline data gathering, the administration proposal perversely reduces the power of the Federal Trade Commission to protect the public. It fails to give the FTC, the country’s key privacy regulator, “rule-making” authority to craft reasonable safeguards,and actually empowers the companies that now harvest our mobile, social, location, financial, and health data, leaving them little to fear from regulators.The legislation creates a huge loophole that practically eviscerates any real privacy protection and consumer control of their data. Its provisions are tied to a standard of both “risk” and “context” that enables a company to determine whether a person’s data require greater privacy control. Since the majority of today’s massive online data gathering is disingenuously considered by industry as “marketing” information—versus what it really is, highly detailed and continually updated profiles merging our online and offline data—very little of a consumer’s data will trigger stronger protections.The multi-stakeholder process at the core of this poorly constructed privacy bill has been flawed from the outset, dominated as it is by industry lobbyists whose real goal is to ensure their companies can continue their practices without any real safeguards. The proceedings have failed so far to generate any meaningful and widely adopted safeguards, and the prospects for a new “code of conduct” that offers genuine consumer protection are unlikely. Public interest and privacy groups are vastly outnumbered in the Department of Commerce-run multi-stakeholder process, which is notable for its lack of diverse representation, denying meaningful participation from civil rights, consumer, and other representatives.The bill limits the FTC’s “unfair trade practices” authority once companies that collect our data adopt a “multi-stakeholder code of conduct.” Once that code is developed, the FTC has at most 90 days (if adopted via a Department of Commerce process) to approve or deny it, giving the agency and the public insufficient time to analyze and address the code’s shortcomings. Hundreds of codes are predicted to be proposed, leaving the FTC at a disadvantage in performing its duty to protect American consumers.The bill also greatly reduces the ability of state attorneys general to protect our privacy precisely at a time when there is an explosion of hyperlocal data mining of our neighborhoods.The legislation also enables companies to create so-called “privacy review boards” that will most likely rubber-stamp their data practices, another example of how corporations have been further empowered to decide what the consumer privacy rules should be. While the bill touts that it provides rights to consumers, it gives real control to the companies that collect our information.Although the president’s Privacy Bill of Rights promised transparency and control, it creates a labyrinth-like process that consumers must navigate before they can actually access and correct their own data records held by companies. Data brokers and others can hide behind a convoluted system to determine whether individuals can access their files.Beyond its undermining FTC authority and empowering industry self-regulation, the process by which the bill was written also reflects poorly on the Administration. As a Commerce official said to advocates one week ago, the bill was deliberately drafted so as not to “disrupt [the commercial data] business—we are the Department of Commerce.” The majority of consumer and privacy advocates were given only a review of the near-final text a week ago today, with just less than 30 minutes to read the bill. Advocates told the White House early this week about some of the problems in the legislation, urging it to postpone slightly the release of the bill and to work with us to improve its consumer protections. But this proposal was rejected. Leading Congressional leaders on privacy issues were also denied access to the bill until yesterday, leaving them no time for meaningful engagement with the White House. Parts of the bill appear to have been drafted by the “Big Data” lobby itself, in order to protect industry’s current data practices, which raise serious questions about the influence the commercial sector has within the Department of Commerce.“Instead of supporting the FTC, the Administration has aided the data collection industry in its efforts to undermine that agency’s role,” explained Jeff Chester, CDD’s executive director. This bill fails to fulfill what the president promised. CDD and other consumer and privacy advocates will work to ensure Americans get the privacy rights they deserve.”
  • Washington, DC: The Center for Digital Democracy (CDD), along with U.S. PIRG, Consumer Watchdog, and Public Citizen, called on the Federal Trade Commission to launch an investigation into the impact on the American public of growing consolidation in consumer offline and online data sources and digital marketing applications. The groups also asked for the FTC to hold a public workshop focused on ensuring Americans receive 21st century safeguards protecting their privacy in online transactions, and a truly competitive marketplace.The letter comes after the approval by the Department of Justice of the “Big Data”-driven acquisition by the Oracle Corporation of data broker Datalogix. The merger—announced in late December and approved just three weeks later—would create, in Oracle’s words, “the world’s most valuable data cloud” for digital marketing, connecting and unifying “a consumer’s various identities across all devices, screens and channels.” The deal is the second recent major data broker acquisition by Oracle, which purchased leading online consumer information firm BlueKai last year. The Oracle/Datalogix transaction should have triggered involvement by the FTC, given its expertise on the digital data industry, the groups noted.The letter to FTC Chairwoman Ramirez also underscored that the Oracle/Datalogix merger raised serious privacy and consumer concerns, which required scrutiny by the Bureau of Consumer Protection as well. The combined companies’ datasets include financial, racial, location, and other sensitive data, as well as issues involving the EU/U.S. Safe Harbor agreement and the Google and Facebook Consent Decree settlements. The merger also implicates a number of consumer-protection matters, such as financial marketing and auto sales, where the FTC has a congressional mandate to protect the public.The group’s letter to the FTC (attached below) provides an inside look at the role of consumer data in today’s digital marketplace, in which companies not only amass enormous amounts of information on consumers’ online and offline activities, but exchange that information with partners and affiliates for the purposes of analytical scrutiny and personalized targeting. “This transaction,” the letter explains, “highlights the crosscutting dimensions of the contemporary ‘Big Data’ digital marketplace, where competition and consumer-protection issues are intertwined.”“The American public deserves to know how the consolidation and use of their information affects their daily lives,” the letter concludes, “from the prices they pay and the services they are offered to what this transaction means for their privacy. We urge the FTC to develop a more effective approach to identifying new problems and threats to competition and consumer protection in the Big Data era.”“The Oracle/Datalogix deal reflects the digital data ‘arms race’ underway where companies are amassing powerful and detailed sets of information to track and target a consumer anywhere, anytime,” explained Jeff Chester, CDD’s executive director. “Control over an individual’s information, and the capabilities to use it effectively in today’s Big Data era, are falling into fewer hands. Unfortunately, these critical mergers suffer from ‘premature approval syndrome,’ sanctioned by regulators without adequate analysis and discussion. As the country’s chief regulatory agency protecting privacy and the online consumer marketplace, the FTC needs to show greater leadership by fostering 21st Century safeguards.”“Our letter also urges antitrust authorities to update their market analysis to reflect that digital markets aren’t the same as markets for groceries or steel,” said Ed Mierzwinski, consumer program director for U.S. PIRG. “21st century markets need a 21st century analysis that takes into account the unique ways that fewer, bigger firms leverage even greater market power over consumer data through partnerships and joint ventures.”“The Oracle/Datalogix deal is an example of how powerful companies are amassing unprecedented amounts of data, distorting traditional markets, limiting competition and consumer control,” said John M. Simpson, Consumer Watchdog’s Privacy Project director. “The FTC needs to act quickly and decisively to ensure its regulatory procedures keep pace with the threats of 21st century data-driven markets.”“As evidenced now by Oracle’s acquisition of Datalogix, a handful of Data Titans hope to aggregate personal and private data about everyone, so they know where we go, what we do, whom we see, what we want, what we think and what we say,” said Rob Weissman, president of Public Citizen. “The marketers’ intrusion on our privacy is vastly outpacing public protections, or even public awareness. Consumer protection authorities need to take a very hard look at the Oracle deal and industry concentration more generally. There’s no reason for us to be racing toward a dystopian future of total surveillance.”
  • In December, CDD urged the FTC to reject the verifiable parental consent mechanism for COPPA (Children's Online Privacy Protect Act) proposed by AgeCheq. The comments are attached. Ensuring meaningful parental consent so their child's data can be gathered and used requires a robust and effective system. Parents need to understand precisely what data is collected and by what means; how it is to be used--now and in the future--as well as the business models and online marketing practices that can affect them. CDD and its attorneys at Georgetown Law Center found a range of problems with AgeCheq's submission. The commission should decline approving its parental system for COPPA. Yesterday, the commission announced (link is external)it agreed with CDD and rejected Agecheq's proposal. Eric Null, Staff Attorney at the Institute for Public Representation, Georgetown Law Center, which represented CDD, said that "We are pleased that the FTC followed CDD's recommendation to reject AgeCheq's application for a verifiable parental consent mechanism. This is a true victory for parents and children and sends the message that future applicants must ensure their system meets the COPPA standards."
  • Statement of Jeff Chester, executive director, CDD With personal information on every U.S. individual, their families, community and workplace the "currency" in today's digital economy, the frenzy of dealmaking (link is external)in the databroker business continues as Oracle acquires (link is external)Datalogix (link is external). Through the data (link is external) it gathers on what we buy (link is external), and with its relationship with Facebook (link is external)and other powerful marketers, Datalogix consists of a online treasure trove of data on Americans. The Oracle (link is external) deal announced today follows its recent acquisition (link is external) as well of Bluekai, (link is external) which holds reams (link is external)of information (link is external) on consumers. (link is external) CDD calls on the Federal Trade Commission to closely scrutinize the proposed deal. It must examine the impact on competition and protect the privacy of Americans. Given the FTC's 20-year consent decree with Facebook, and the role that Datalogix plays (link is external) with the social network, it also must review whether the deal requires additional safeguards under that decree. Both Oracle (link is external) and Datalogix (link is external)are members of the EU/US Data Protection Safe Harbor program and the commission must examine how this pending databroker/consumer targeting acquisition impacts that program. The growing consolidation of information on every American and whatever we do--regardless of location, time of day, whether we are online or off--should trigger action, as well as soul searching by both policymakers and the public. Do we want a society where a very powerful few data barons are able to gather and profit from our information without an individual having any ability to protect their privacy? ****** PS: This summary (link is external)via Adexchanger is useful to see the impact and intention of this deal: Datalogix aggregates and provides insights on over $2 trillion in consumer spending from 1,500 data partners across 110 million households to provide purchase-based targeting and drive more sales. Over 650 customers, including 82 of the top 100 US advertisers such as Ford and Kraft, as well as 7 of the top 8 digital media publishers such as Facebook and Twitter use Datalogix to enhance their media. Oracle and Datalogix's Data as a Service cloud solutions will provide marketers and publishers with the richest understanding of consumers across both digital and traditional channels based on what they do, what they say, and what they buy. This will enable leading brands to personalize and measure every customer interaction and maximize the value of their digital marketing. The combination fundamentally transforms marketing automation from executing campaigns to being able to correctly identify consumers, target them accurately with digital campaigns, allow marketers to measure which campaigns and channels are effective, and optimize how they reach consumers and spend their campaign resources. The addition of Datalogix represents a further extension of Oracle's Public Cloud strategy to combine IaaS, PaaS, SaaS and Data as a Service on a common cloud and to transform SaaS business applications and processes by integrating data within these applications. More information can be found at http://www.oracle.com/datalogix (link is external). Supporting Quotes "The addition of Datalogix to the Oracle Data Cloud will provide data-driven marketers the most valuable targeting and measurement solution available," said Omar Tawakol, group vice president and General Manager of Oracle Data Cloud. "Oracle will now deliver comprehensive consumer profiles based on connected identities that will power personalization across digital, mobile, offline and TV." "Datalogix's mission is to help the leading consumer marketers connect digital media to the offline world, where over 93 percent of consumer spending occurs," said Eric Roza, CEO, Datalogix. "We are thrilled to join Oracle and extend the value Oracle Data Cloud brings to marketers and publishers."
  • Consumer, Children’s, and Privacy Groups Challenge Federal Trade Commission’s Proposed Settlement with TRUSTe (True Ultimate Standards Everywhere, Inc.) As Too Lenient Stronger Sanctions Needed for TRUSTe’s Violation of the Public Trust Consumers—Especially Parents—Materially Harmed by Years of Deception Washington, DC: The Center for Digital Democracy (CDD), through its counsel the Institute for Public Representation and on behalf of the American Academy of Child and Adolescent Psychiatry, Campaign for Commercial Free Childhood, Consumer Action, Consumer Federation of America, Consumer Watchdog, and The Rudd Center for Food Policy and Obesity, filed comments today at the Federal Trade Commission (FTC) in response to that agency’s proposed Agreement and Consent Order with True Ultimate Standards Everywhere, Inc. (“TRUSTe”). In November, after conducting an investigation, the FTC filed a complaint against TRUSTe, a company that has been issuing various “privacy seals” since 1997. The display of such seals indicate that a website has been reviewed annually by TRUSTe to ensure it is compliance with TRUSTe’s program requirements designed to protect consumer privacy. In fact, according to the FTC TRUSTe deceived consumers in two important respects. First, TRUSTe failed in over one thousand instances between 2006 and 2013 to conduct the annual re-certifications that it told consumers and the FTC it was conducting. Second, the company failed to require the companies using its privacy seals to change references to TRUSTe’s nonprofit status after it became a for-profit operation in 2008. As CDD’s filing makes clear, these violations are especially significant coming from a company that is entrusted with verifying the self-regulatory privacy-protection efforts of thousands of companies—including some of the biggest in the world—and covering such important areas of concern as the Children’s Online Privacy Protection Act (COPPA) and the EU-US Safe Harbor framework for transatlantic data transfers. Thus while the filing applauds the FTC’s enforcement action against TRUSTe, it finds the proposed sanctions—a $200,000 fine and additional recordkeeping and reporting requirements concerning the COPPA safe harbor program—to be far too lenient. “Safe harbors such as TRUSTe,” the filing points out, “play a pivotal role protecting children’s privacy by prohibiting the collection, use or disclosure of personal information without meaningful notice to parents and advance, verifiable parental consent, limiting the amount of data collected from children and protecting the security of data that is collected.” Unfortunately, because the FTC neither revealed the websites and services that were not properly re-certified, nor estimated the number of consumers who were affected by these violations, consumers—including parents concerned for their children’s privacy—are left wondering just how much meaningful privacy protection they have online. In addition to calling for a significant increase in the size of TRUSTe’s payment (citing individual companies that have paid as much as $1 million for their COPPA violations in the past), CDD’s filing called for all COPPA safe harbor reports (including those filed by TRUSTe) be made available to the public on the FTC’s website in a timely manner. Angela Campbell, co-director of the Institute for Public Representation, emphasized that “Parents rely on seal programs such as TRUSTe when deciding whether a particular website is appropriate for their children. Misrepresentations such as these have the potential to put millions of children at risk across potentially hundreds or thousands of child-directed websites. The FTC must do more to restore public trust in the COPPA safe harbor programs.” “The commission needs to stand up for children and their parents,” explained Jeff Chester, executive director of CDD. “If the FTC had adequately engaged in oversight of these programs, such problems would have been identified earlier,” he noted. “Those companies such as TRUSTe that have pledged to truly protect the privacy of American children should be required to make public how they actually determine whether online companies targeting kids engage in fair and responsible practices.” A copy of CDD’s FTC filing is available at www.democraticmedia.org. --30--
  • News

    Topps Company, Trading Card and Candy Company Charged with Violations of the Children’s Online Privacy Protection Act (COPPA); Coalition of Groups Groups Urge FTC to Investigate and Bring Action

    Topps Company, Trading Card and Candy Company owned by Michael Eisner, Charged with Violations of the Children’s Online Privacy Protection Act

    Consumer, Child Health, and Privacy Groups Urge Federal Trade Commission to Investigate and Bring Action Against Topps for Violating Children’s Privacy Rights through its Child-directed Website Candymania.com and its #RockThatRock Contest Washington, DC: The Center for Digital Democracy (CDD), through its counsel the Institute for Public Representation, along with the American Academy of Child and Adolescent Psychiatry, Campaign for a Commercial Free Childhood, Center for Science in the Public Interest, Consumer Action, Consumer Federation of America, Consumers Union, Consumer Watchdog, Rudd Center for Food Policy and Obesity, and United Church of Christ, today asked the Federal Trade Commission (FTC) to investigate and take enforcement action against The Topps Company, Inc., for violating the Children’s Online Privacy Protection Act (COPPA) Rule in connection with its child-directed website Candymania and its online contest #RockThatRock. Topps, a candy and trading-card company owned by former Disney CEO Michael Eisner, uses its child-directed website Candymania.com and social media to promote Ring Pop, a candy that appeals to children. The #RockThatRock contest, which ran in Spring 2014, encouraged children to post photos of themselves wearing Ring Pops on Facebook, Twitter, and Instagram for a chance to have their photo used in a music video with tween band R5. Of the photographs collected, Topps used several that depicted children clearly under 13 in the video. The video is available on both Candymania and YouTube and has been viewed almost 900,000 times. Long after the contest ended, Topps continued to display children’s photos and contact information submitted using the #RockThatRock hashtag on the Ring Pop Facebook page. Topps made no effort to provide notice to parents about the information collected or to obtain advance, verifiable parental consent as required by the COPPA Rule. Additionally, Topps violated the COPPA Rule by failing to post its children’s privacy policy in a prominent manner, failing to provide a complete and understandable privacy policy, conditioning a child’s participation in the contest on disclosing more information than was reasonably necessary, and retaining children’s personal information for longer than reasonably necessary. “Topps and its partners cynically sought to bypass COPPA’s key safeguard that parents must first be told about a company’s data collection practices before their child’s information is gathered,” explained Jeff Chester, CDD’s executive director. "This is a textbook study of how online marketers are so eager to use Facebook and other social media to promote their products to friends and even strangers, they ignore this key law designed to protect consumer privacy online. Companies such as Topps need to carefully review all their digital marketing practices to make sure they are adhering to COPPA, and also are marketing their products in a responsible manner. The FTC must do more, however, to ensure that COPPA is effectively enforced. It must devote more resources to protect the privacy of children, and begin examining contemporary digital data-driven practices more thoroughly.” Angela J. Campbell, Co-Director of the Institute for Public Representation, which drafted the request, emphasized that “Topps is in violation of provisions of the COPPA Rule that the FTC adopted nearly two years ago to update and strengthen children’s privacy protections,” in two significant ways. First, Topps is collecting photographs of young children, even though the FTC decided to include photographs within the definition of “personal information” requiring parental notice and collection due to the privacy and safety concerns. Second, Topps is using social media to collect and post children’s personal information from which Topps reaps commercial benefits. The Commission amended the COPPA rule to clarify that a child-directed website was responsible for information collected by third parties on its behalf or from which it benefits. Campbell urged the FTC to take action to show that it is serious about enforcing the updated COPPA Rule. In addition to the privacy concerns of Topps’ marketing and data-collection practices, this case comes at a time of heightened concern over the health effects of candy and other unhealthy foods on children. Earlier this month, 41 members of the Food Marketing Workgroup (link is external) (including CDD, Center for Science in the Public Interest, and the American Heart Association) wrote five candy companies—including Topps—to ask them to adopt strong policies on food marketing to children. As the groups’ letter points out, “obesity has tripled in children and adolescents over the past decades. Currently, more than one in three children and teens are overweight or obese.”
  • For months, CDD has been in contact with the Federal Trade Commission over the actual efficacy of the so-called "Safe Harbors" programs established to address children's privacy thru the Children's Online Privacy Protection Act (COPPA). We have major concerns about how these programs are structured, and whether they meaningfully ensure privacy of young people. We have asked, via FOIA, for a detailed documentation on how the COPPA Safe Harbors operate. The FTC has not--to date--provided the information parents and the public require. CDD will ensure, however, that there is meaningful accountability by both the FTC and its COPPA Safe Harbor companies. The commission cannot look the other way on this issue, even if some of the Safe Harbor companies prefer to operate in a non-transparent mannner. Among the companies we have asked for information include: kidsSafe Seal Program; Aristotle International; Children's Advertising Review Unit; Entertainment Software Rating Board; PRIVO; and TRUSTe.
  • Through the terrfic work of Public Citizen, CDD submitted this Amicus brief today in what's called the Wyndham case. Wyndham and its allies are challenging the much needed role of the FTC to protect Americans from data breaches and related online harms. That they are afraid of having a consumer protection agency do its job says a great deal about them. The brief is attached.
  • [excerpt from attached letter] Dear Chairwoman Ramirez: We urge the FTC to review its decision of September 24, 2014, providing “early termination” of the “Big Data” acquisition by Alliance Data Systems of Conversant (formerly ValueClick). We are deeply concerned that the commission failed to examine sufficiently the consequences to competition—and to privacy—of the consolidation of two powerful sets of consumer data. This merger reflects the continuing consolidation of the consumer data marketplace, an issue that the FTC must address. The Alliance/Conversant deal also raises serious privacy concerns, including with its intended goal of further unleashing powerful tracking technologies that follow individuals across all of their devices and applications. Both companies’ play leading roles providing data for financial services targeting, and Conversant is at the forefront of online lead-generation practices. The commission’s approval of this transaction without appropriate safeguards directly undermines its role as the country’s chief privacy regulator. The FTC cannot, on the one hand, express concern about the discriminatory and privacy implications of “Big Data” and the invisible role of databrokers, but at the same time silently consent to expanded commercial surveillance of the American people... The failure of the commission to address key consumer protection issues with this acquisition underscores the need for a greater commitment by the FTC to tackle the competition and privacy issues of today’s data-driven digital marketing era. We specifically urge the commission to launch a formal review of “Big Data” consolidation. The level of commercial data gathering on Americans is unprecedented, growing daily without respite, and is ending up in the hands of fewer companies... In addition, this transaction illustrates the dramatic and unfettered growth of so-called “cookie-less” cross-screen/device-tracking...The commission should not wait until American privacy is further undermined through the dramatic growth of these new “cookie-less” commercial tracking practices. Action is required now
  • U.S. PIRG Education Fund and the Center for Digital Democracy (CDD) respectfully submit these additional comments to the Federal Trade Commission (FTC). A set of regulatory and other safeguards is urgently required to ensure that contemporary “Big Data”-driven financial services are used in an equitable, transparent, and responsible manner. All Americans, especially those who confront daily challenges to their economic security, should be assured that their lives will be enhanced—not undermined—by the new digital-data financial services marketplace. A closer critical examination of the commercial information infrastructure in the U.S. reveals a set of well-developed and interconnected data collection and use practices that few consumers are aware of—let alone have consented to. While the commission’s September 2014 workshop explored some of the key issues, it did not sufficiently examine the implications of current “Big Data” business practices. U.S. PIRG Education Fund and CDD urge the commission to issue a final report that addresses the issues we identify [see attached file].
  • Youth of color are a key focus for digital marketers, especially for fast-foods and beverages linked to the youth obesity epidemic.  The digital targeting of African American and Hispanic youth is growing, and uses a full array of sophisticated mobile, geo-location, social media and other cutting-edge marketing strategies.  Food and beverage marketers should adopt practices that stop unfair and irresponsible digital marketing practices.  The FTC and State AG's should call for safeguards.Here's the latest CDD Infographic that addresses African American youth.
  • Apple iPhone/mobile payments era poses threats and opportunities for consumers, especially those financially at risk Washington: Two leading consumer organizations told the Consumer Financial Protection Bureau (CFPB) today to issue rules so consumers can use mobile financial services without placing their privacy at risk or exposing themselves to new forms of predatory lending and other unfair practices. The groups—U.S. PIRG and the Center for Digital Democracy (CDD)— submitted comments to the agency as part of its inquiry on mobile financial services. They called for a series of safeguards on mobile and other digital financial applications, including on data collection, online financial marketing, mobile payments and other key applications. “The CFPB has a short window to ensure that the public receives the necessary consumer safeguards, especially for financial applications and their privacy, as they increasingly rely on mobile devices for banking, payments, credit applications, shopping, e-commerce, and other services,” explained Ed Mierzwinski, Consumer Program Director for U.S. PIRG. “Otherwise, unfair business practices will become entrenched in the marketplace and hard to stop.” The introduction yesterday of Apple’s mobile payment system is just the latest development transforming how Americans save and spend their money in the digital era. The Internet is quickly becoming the foundation for banking and other financial services, from mobile deposits, online loans, and digital payments. Financial services companies will spend $6.20 billion in 2014 promoting lending, credit cards and related services, a figure that is predicted to grow to $9.57 billion by 2018. $2.2 billion was spent this year for mobile financial marketing targeting consumers. Mobile payments and other digital financial services are integrated into a broad set of online industry marketing practices, which require CFPB action, explained the groups. Industry practices described in the filing as requiring CFPB action include the following: Data collection and profiling, The use of real-time location, How “apps” and other digital financial applications are designed to trigger consumer behavior, The special targeting of multicultural groups, including African Americans and Hispanics, and, How “Big Data” technologies raise privacy and other consumer protection concerns. The growing use of “lead generation” on mobile devices, where a consumer’s data can be stealthily collected and sold to credit card, banking and other financial companies so they can be targeted with offers. the use of data profiles and location to micro-target consumers in real-time with payday loans and other costly financial products. “Contemporary mobile practices that take advantage of the powerful capabilities of online financial marketing raise questions about whether consumers will well-served in the long-run, said Jeff Chester, CDD executive director. For example, economically vulnerable consumers—or any other American on a budget—could be bombarded with highly sophisticated offers urging them to spend that take advantage of their data, buying habits, family composition, ethnicity and more. Without fair rules, such practices could undermine their ability to protect their financial security. That’s why we call on the CFPB to take action now,” he explained. “Without question, the convenience and power of mobile devices and applications provide financially at risk, unbanked, and other vulnerable consumers greater opportunities to save money on banking transactions and payments, have additional ways to build financial resources, make more effective decisions on purchasing,” Mierzwinski concluded. “But few consumers understand or can effectively control how mobile and other digital financial products actually operate; as a result we believe they also pose serious risks unless safeguards are enacted.” **** U.S. PIRG is the non-profit, non-partisan federation of state Public Interest Research Groups. The PIRGs are public interest advocacy organizations that take on powerful interests on behalf of their members. On the web at www.uspirg.org (link is external) The Center for Digital Democracy (CDD) addresses contemporary digital marketing and privacy issues, including their impact on public health, children and youth, and financial services. On the web at www.democraticmedia.org In March, U.S. PIRG and CDD released the report “Big Data Means Big Opportunities and Big Challenges: Promoting Financial Inclusion and Consumer Protection in the “Big Data” Financial Era.” It is available at http://www.uspirg.org/reports/usf/big-data-means-big-opportunities-and-big-challenges (link is external).
  • Washington, DC: The key framework that is supposed to protect EU citizens’ privacy when their data is collected by U.S. companies—known as the U.S.-EU Safe Harbor—is failing to provide them the safeguards that were promised, according to a complaint filed today by a leading U.S. consumer privacy group—the Center for Digital Democracy (CDD). The complaint, filed at the U.S. Federal Trade Commission (FTC), details how these companies are compiling, using, and sharing EU consumers’ personal information without their awareness and meaningful consent, in violation the Safe Harbor framework. Overseen by the U.S. Department of Commerce, the Safe Harbor is based on a voluntary “self-certification” process, in which companies that promise to provide clear “notice” (of their data-collection practices and data uses) and “choice” (giving consumers the opportunity to “opt out” of practices they did not previously agree to) are then allowed to collect information from European consumers without strictly following the EU’s higher data-protection standards. The EU has itself recognized that the current Safe Harbor regime is inadequate, and has called for its revision. CDD’s filing at the FTC, which is the agency that is supposed to ensure that the Safe Harbor system protects EU consumers’ privacy, calls for an investigation of 30 companies involved in data profiling and online targeting, including data brokers that have compiled vast amounts of sensitive information on individual consumers; data management platforms that allow their corporate clients to analyze their own consumer information and combine it with outside data sources to produce detailed marketing insights; and mobile marketers that track devices and tie them to user profiles in order to identify the most profitable consumers for personalized advertising. “The U.S. is failing to keep its privacy promise to Europe,” said Jeff Chester, CDD’s executive director. “Instead of ensuring that the U.S. lives up to its commitment to protect EU consumers, our investigation found that there is little oversight and enforcement by the FTC. The Big Data-driven companies in our complaint use Safe Harbor as a shield to further their information-gathering practices without serious scrutiny. Companies are relying on exceedingly brief, vague, or obtuse descriptions of their data collection practices, even though Safe Harbor requires meaningful transparency and candor. Our investigation found that many of the companies are involved with a web of powerful multiple data broker partners who, unknown to the EU public, pool their data on individuals so they can be profiled and targeted online.” Although the companies cited for FTC investigation differ in their various approaches to data collection for the purposes of profiling and targeting individual consumers, the filing identified five broad concerns that illustrate the inadequacy of the Safe Harbor regime: (1) the failure of Safe Harbor declarations and required privacy policies in particular to provide accurate and meaningful information to EU consumers; (2) an overall lack of candor from the companies about the nature of their data collection apparatus, including their networks of data broker partners and even their corporate affiliations; (3) the general failure to provide meaningful opt-out mechanisms that EU consumers can find and use to remove themselves fully from privacy-harming data collection and processing; (4) the myth of “anonymity” at a time when marketers—armed with vast amounts of details about consumers’ personal needs and interests, employment and social status, location and income—do not need-to-know one’s name in order to track and target that particular individual online; and (5) the false claim made by several companies named in the complaint that they act as “data processors” on behalf of others, when in fact they play a central role in bringing the power of their Big Data-driven services to bear on consumer profiling and targeting. As CDD Legal Director Hudson Kingston explained, “CDDs complaint describes the systemic failure of the Safe Harbor to function as it was intended. Companies are flouting standards that the Department of Commerce agreed to and the Federal Trade Commission pledged to enforce. Safe Harbor has to be overhauled to make sure it actually works; until that time, it should be suspended. We call on the FTC to investigate and sanction the companies named in our complaint. The fundamental privacy right of 500 million Europeans has been ignored and must be acknowledged and protected going forward.” “The U.S. and EU are currently negotiating a trade agreement that will enable U.S. companies to gather even more data on Europeans,” Chester added. “Reform of Safe Harbor is urgently required before it becomes a ‘Get Out of Protecting Privacy’ card used by American companies under the forthcoming Transatlantic Trade and Investment Partnership (T-TIP).” The 30 companies cited in CDD’s filing include Acxiom, Adara Media, Adobe, Adometry, Alterian, AOL, AppNexus, Bizo, BlueKai, Criteo, Datalogix, DataXu, EveryScreen Media, ExactTarget, Gigya, HasOffers, Jumptap, Lithium, Lotame, Marketo, MediaMath, Merkle, Neustar, PubMatic, Salesforce.com, SDL, SpredFast, Sprinklr, Turn, and Xaxis. The Center for Digital Democracy is a nonprofit group working to protect the public in the digital era from unfair practices that threaten their privacy, especially in the financial and health sectors. --30--
  • "Amazon’s policies of making it simple for children to accidentally spend hundreds of dollars in a “kids” app, and its apparent refusal to refund the money to complaining parents, are irresponsible and unfair. Today’s FTC action shows that consumers who have been charged for their kids unauthorized in-app purchases should not have to foot the bill. Amazon’s failure to deal fairly with people who purchased its devices and use its apps suggests it places making money as quickly as possible over serving the interests of their consumers. As Amazon gears up to release a new phone, and expands its impact on the mobile industry and consumers, the FTC’s complaint should serve as a wake-up call for better corporate ethics.” Hudson B. Kingston Legal Director Center for Digital Democracy
  • As part of the Children's Online Privacy Protection Act (COPPA), the federal law protecting the digital privacy of kids 12 and under (and which empowers parents or other key caregivers to control the data collected from children), a so-called "Safe Harbor" system was created. The theory being that companies joining a FTC approved Safe Harbor regime, which is commited to ensuring meaningful compliance with COPPA, is an effective way to have companies follow the law. Yesterday was the deadline for Safe Harbor reports to be submitted to the FTC, and the first once since the new stronger safeguards on COPPA (covering multiple devices and applications, for example), went into effect. CDD has many concerns about how COPPA Safe Harbor is working, which we have explained to the FTC. Our legal and research team is focusing on how these Safe Harbor systems actually operate--so expect to see this issue heat up in next year. We requested all the Safe Harbor reports, including from the: kidSAFE Seal Program, Aristotle International Inc., Children’s Advertising Review Unit (CARU), Entertainment Software Rating Board (ESRB), Privacy Vaults Online, Inc. (PRIVO), and TRUSTe. Here's a statement from Eric Null, staff attorney at the Institute for Public Representation at Georgetown University Law Center. Eric serves as counsel to CDD: "The safe harbor annual reports provide vital information about the conduct of the COPPA safe harbor programs. Without seeing these reports, parents and the public will remain uninformed about how effective the safe harbors are at protecting children against harmful online data practices. Jeff Chester, CDD's executive director, explained that this work is part of our ongoing "Unsafe Harbor" consumer and privacy protection initiative, which is also examining how the U.S. protects the privacy of European citizens through a Safe Harbor program operated by the Department of Commerce.