There is just too much out there – snow and blogs.

Finally, here is something that actually might be helpful.  Larry Cheng has published his 2011 directory of top VC blogs.  Here is the link.  His directory lists 149 VC, seed etc. blogs.  The top ones are ranked by number of monthly uniques in Q4.  Thank you Larry. 

But, who is really going to read all those blogs?  No one.

This kind of crowding happens just before a shakeout.  We are in the bubble before the burst.  Think .com in 1999 or tulips in 1624.  Whatever all these VCs think they are getting from all the blogging, the returns will not be there for almost all of them. 

Here are two predictions:

• Many will soon stop blogging (and by soon I mean 24 months). 

• Some will find nitches in industry or other verticles.

Blogging is on the verge of becoming a mature industry with a relatively small number of established players who express the mainstream opinions for the Venture industry, and they will be enough.  Blogging will soon be old and stodgy – my god even lawyers are doing it.  The wave of accountant bloggers can’t be too far behind. 

A major component of the FTC report, Protecting Consumer Privacy in an Era of Rapid Change, is the idea of consumer choice.  This is the idea that when a consumer provides a company with certain types of information, the consumer should be informed as to what that company intends to do with that information and then should be able to choose whether or not to continue the interaction.  One of the goals outlined in the FTC report is to allow “consumers the ability to make informed and meaningful choices” regarding the use of their information for data collection purposes.  The FTC further states that businesses interacting with consumers should present choices “clearly and concisely,” while offering “easy-to-use choice mechanisms.”  Exactly what is determined to constitute an informed choice in the final regulations is likely to have a significant impact on every company that is subject to these regulations.

            As the FTC notes in its report, there are many considerations to weigh in determining how to best present this choice for the consumer.  First, there is a question of when the necessary disclosure and consumer control mechanism should be presented.  In the case of a website where the company is providing retail or other service directly to the consumer, common sense tells you that the consumer should be presented with the choice mechanism at the point of sale or exchange of data.  This question becomes more complicated, however, when one considers the example of a social media service where the relationship between the consumer and the company might be ongoing, and where the nature and scope of the information being exchanged often changes over time.  In this scenario, should the consumer be continually prompted to provide consent to the use of their information?  Alternatively, should all potential exchanges of information between the consumer and the company be included in the initial disclosure and consent?      

            A second consideration for establishing the proper consumer choice mechanism is the content of the disclosure itself.  As the FTC report makes clear, the Commission staff believes that disclosures and the choices presented buried within lengthy privacy policies will not result in meaningful, informed consent by consumers.  While the Commission staff clearly prefers a simple and widely-accessible approach to providing this choice, their report provides little evidence of how they intend to apply these ideas to the varying types of consumer interaction with different websites, services and products.  For instance, how would the developer of an application used on a mobile device both clearly and accurately provide the consumer with the required disclosure when those disclosures might involve describing complicated relationships between third-parties?  Further, is it feasible to believe that a consumer who might download such an application while commuting on the subway will read the disclosures on their mobile phone and then be able to provide an informed consent?     

            Despite fact that this question of consumer choice will likely be a central element of any new regulations related to the protection of consumer privacy and the use of consumer data, the FTC’s proposals provide many more questions than answers on this issue.   One of the proposed approaches is some version of an “opt-in” or “opt-out” consent provided to consumers when they seek to engage with a particular company.  Similar to the concerns over the “Do Not Track” proposal, there is a significant possibility that this simplistic, all-or-nothing approach might encourage consumers to simply choose to “opt-out,” without much consideration to the trade offs involved with the exchange of data for the services of the company.  As consumers opt-out, companies who up to that point have relied on the use of consumer data as a way to keep the cost of their services low (or free), will likely need to raise prices on the consumer.  On the other hand, should consumers choose some sort of general “opt-in” when they purchase or begin to use a product or service, the regulations likely will not have the intended effect of increasing consumer knowledge and control over the use of their personal data.  

            As with most elements of the FTC’s report, these issues do not lend themselves to simple, blanket solutions.  As stated in its title, the purpose of this report is to protect consumer privacy; however, the framework in its current form is weighted too heavily on the side of privacy, without enough consideration for the practical implications for the businesses that provide many different products and services to consumers.  All parties would benefit from a regulatory approach that takes into account the nuanced and complex relationship between consumers and businesses in this increasingly data-driven sector of the economy. 

First-party marketing: Online retailers recommend products and services based upon consumers’ prior purchases on the website.  Offline retailers do the same and may, for example, offer frequent purchasers of diapers a coupon for baby formula at the cash register.  Some of these practices, such as where a retailer collects a consumer’s address solely to deliver a product the consumer ordered, are obvious from the context of the transaction, and therefore, the consumer’s consent to them can be inferred.

Staff proposes that first-party marketing include only the collection of data from a consumer with whom the company interacts directly for purposes of marketing to that consumer.

Basically, online behavior that is analogous to offline behavior (Macy's giving you a discount on your next purchase or taking down your address to deliver goods, etc.) is likely to be OK under the new rules, whatever they may eventually be, and, by the way, it should be.

The real rub occurs when companies start doing things that are not analogous to mainstream offline behavior, particularly when a company shares data with a third party or allows a third party to collect data about consumers visiting that company’s site.

As the FTC puts it:

If a company shares data with a third party other than a service provider acting on the company’s behalf … the company’s practices would not be considered first-party marketing and thus they would fall outside of “commonly accepted practices,” …. Similarly, if a website publisher allows a third party, other than a service provider, to collect data about consumers visiting the site, the practice would not be “commonly accepted.

The underlying rationale appears to be that the FTC believes that consumers expect, or can be inferred to expect, online business models to mimic offline business models.  If you are doing, or planning to do, something different and creative, you are likely going to have to meet a much higher regulatory burden than if you stick with the status quo. 

This regulatory framework is, of course, great for the status quo.  If you are doing regular stuff that the FTC imagines most consumers understand and expect, then you probably can keep doing it without much additional new regulatory intervention.  Hence, Amazon can keep on tracking your purchases and recommending books.  Google probably gets a bye as well.

But, what if you come up with something new.  Google was new once, although that was a long time ago in technology years.  I even remember being pleasantly surprised to receive book buying suggestions from Amazon. 

I don’t know what will come next.  The pace of technological innovation in this area is staggering.  Consider the rate at which Google, Facebook and Twitter evolved.  If you come up with something new, how expensive and time consuming will it be to get the FTC to say it is OK? 

Right now the US is, without question, the world leader in the communications/social media world because it is by far the best innovator.  This brings jobs and, by the way, money (as Google, Facebook et al expand overseas) into our economy.  Without some lower bar for innovative companies, the FTC may be putting lead weights on the wings of the goose that laid the golden egg.

The FTC and Commerce may well be hanging a giant sign on the door reading “Whatever you do, don’t innovate.”

            By now, readers have seen by now the preliminary FTC Staff Report, Protecting Consumer Privacy in an Era of Rapid Change (the “FTC Report”) recommending implementation of a “Do Not Track” mechanism available to all Internet users.  The Staff envisions “a uniform and comprehensive way for consumers to choose to block online tracking and targeted advertising” accomplished by legislation or potentially through robust, enforceable self-regulation.  Media outlets have heralded the ill-defined mechanism as a simple and powerful tool to aid Internet users in their losing battle to elude an ever more complex and technologically sophisticated tracking bogeyman.  Sounds great!  “Where do I sign up?” ask the masses.  Slow down masses.  As with most sweeping government regulations, the devil is in the details.  More bedeviling is that there are no, or very few, details.  The Staff merely suggests that a “persistent browser cookie” might be the most practical means of implementing “Do Not Track.”  Serious technical and other challenges to implementation, and uncertainty as to whether legislation or “robust, enforceable self-regulation” would be sufficient are then acknowledged.

            In a nod to the FTC report, the recent Department of Commerce green paper: Commercial Data Privacy and Innovation in the Internet Economy (the “Commerce Green Paper”) asks how the Commerce Department can best “encourage the discussion and development” of technologies such as “Do Not Track.”  In general, the Commerce Green Paper reflects greater support for cooperative industry self-regulation regimes than does the FTC Report.  Commerce acknowledges that the rate at which new technologies and services develop, and the pace at which consumers form expectations about acceptable and unacceptable uses of personal information, is measured in weeks or months, while a rulemaking can take years and result in rules addressing long-since abandoned services.  As such, Commerce suggests engaging multi- stakeholder groups, and employing a “Dynamic Privacy Framework” as the best means of enabling Internet users to take advantage of “Do Not Track” in whatever form it emerges.  The Commerce Green Paper mentions in a footnote testimony that goes to the heart of what every stakeholder should have in mind:  “[A]greement on what is meant by the ‘do-not-track’ sign on, say, the user’s browser, is a . . . complex task, requiring agreement on policy and best practices among a number of players including users, advertisers, marketers, technology companies, and other intermediaries.”

         FTC states that the most practical method of providing uniform choice for online behavioral advertising would involve placing a setting similar to a persistent cookie on an Internet-user’s browser and conveying that setting to sites that the browser visits, to signal whether or not the consumer wants to be tracked or receive targeted advertisements.  “Do Not Track” boosters, media and the FTC trumpet the success of FTC’s popular and successful Do Not Call registry as a bellwether of what life in a “Do Not Track” world will look like.  Some have stated that the complexity of implementing “Do Not Track” would be similar to that involved with implementing Do Not Call. Unlike Do Not Call, however, it would be unnecessary, impossible, futile and kind of ironic for the government to set up a centrally administered database of people who have elected to take shelter under any FTC-enforced “Do Not Track” umbrella.  FTC’s envisioned “uniform and persistent choice” browser setting would instead send a universally recognized message to deactivate tracking technologies.

Although a “Do Not Track” mechanism could be simple to implement from a technical standpoint, to the extent that it takes the form of a simple on/off switch such a mechanism could amount to an innovation-stifling, business-model killing command and control regime enforced by bureaucrats.  The Commerce Department Green Paper recognizes that this is the worst-case scenario.  The Green Paper states that any “Do Not Track” mechanism needs to be colored by stakeholder input and ultimately more nuanced than simply allowing consumers to flip a switch to turn off all tracking technologies.  Commentators point out that this is because most Internet users like using the free stuff available on the Internet and are willing to pay for it by way of receiving certain targeted advertisements.  The question for stakeholders, then, becomes what constitutes “tracking” and what filter will users will be able to apply to tracking activities so as to personalize their experience? For example, a user may be happy to receive targeted marketing from businesses relevant to his profession, but opposed to the collection and sharing of any information concerning that rash he picked up in the hotel spa.  Stakes are high concerning the answer to the question of what tracking is, as countless innovative business models rely on monetizing information about Internet users in one way or another.

Do Not Track makes a lot of sense as a normative principle.  If an Internet user feels uncomfortable with a certain behavior, that user should be able to opt out of being subject to that behavior, whether the behavior is accomplished by way of a cookie, a flash cookie, or some other method either he or his browser has not learned how to fend off.  The problem is in figuring out how to attack the behavior (collecting and sharing information and Internet browsing behavior concerning that rash) without creating a bright-line rule against innovative, useful and responsible ways of collecting and using information in the context of informed consent.   Content providers use the information they collect to do lots of stuff that Snidely Whiplash would find downright mundane and in many cases benevolent (e.g., debugging and personalizing user experiences). 

“Do Not Track” is not like Do Not Call.  When the FTC bars a vinyl siding salesman from calling me at dinner, I am happy.  If FTC inadvertently prevents me from enjoying a personalized experience on Pandora, my utility will likely take a hit.  As such, FTC has proposed a system where users exercise “granular control” over their “Do Not Track” preferences, rather than a crudely fashioned on/off switch.  As technologies and uses of information advance, though, how can such granular control be exercised and enforced without ending up with a tome of regulations the size of the Internal Revenue Code?  This is where it is essential for stakeholders to provide input to FTC and the Commerce Department.  “Do Not Track” was conceived with the best intentions in mind, but I’m afraid with little thought beyond how great everyone thinks Do Not Call is and whether the technology exists to persistently block scary-sounding trackers.  Stakeholders need to give the FTC and Commerce Department some real-world perspective as to what a command and control “Do Not Track” regime would look like in practice and as to what alternatives there are for protecting Internet users’ interest in the responsible, transparent use of their data in the context of informed consent.  To these ends, FTC has asked several very important questions concerning any implementation of an enforceable “Do Not Track” regime.  Among them:

• How should a universal choice mechanism be designed for consumers to control online behavioral advertising?
• How can such a mechanism be designed so that it is clear to consumers what they are choosing and what the limitations of the choice are?
• What are the potential costs and benefits of offering a standardized uniform choice mechanism to control online behavioral advertising?
• How many consumers would likely choose to avoid receiving targeted advertising?
• How many consumers, on an absolute and percentage basis, have utilized the opt-out tools currently provided?
• What is the likely impact if large numbers of consumers elect to opt out? How would it affect online publishers and advertisers, and how would it affect consumers?
• In addition to providing the option to opt out of receiving ads completely, should a universal choice mechanism for online behavioral advertising include an option that allows consumers more granular control over the types of advertising they want to receive and the type of data they are willing to have collected about them?
• Should the concept of a universal choice mechanism be extended beyond online behavioral advertising and include, for example, behavioral advertising for mobile applications?
• If the private sector does not implement an effective uniform choice mechanism voluntarily, should the FTC recommend legislation requiring such a mechanism?

Here is the regulatory proposal: The Commerce Department, in its policy framework, is affirmatively recommending that “the United States Government recognize a full set of Fair Information Practice Principles as a foundation for commercial data privacy.”

As the Commerce Department points out, the Department of Homeland Security (DHS) has adopted a set of FIPPs to govern its use of personally identifiable information (PII).  Just so you get a flavor of what FIPPs look like, here are three FIPPs taken from DHS (and cited in the Commerce Department’s framework):

• Transparency:  Organizations should be transparent and notify individuals regarding collection, use, dissemination, and maintenance of personally identifiable information (PII).
• Individual Participation:  Organizations should involve the individual in the process of using PII and, to the extent practicable, seek individual consent for the collection, use, dissemination, and maintenance of PII.  Organizations should also provide mechanisms for appropriate access, correction, and redress regarding the use of PII.
• Data Minimization:  Organizations should only collect PII that is directly relevant and necessary to accomplish the specified purpose(s) and only retain PII as long as necessary to fulfill the specified purpose(s).

These FIPPs are broad, unobjectionable principles in the “mom and apple pie” category.  They also lack the specificity to provide much guidance for compliance and enforcement.  For example, how much transparency is enough to meet the standard?  How much individual participation is practicable? 

As a result of these kinds of ambiguities, Commerce is proposing that the FIPPs sit on top of “voluntary, enforceable codes of conduct” developed through a multi-stakeholder input process.  In Commerce’s proposal, compliance with an approved voluntary code of conduct would operate as a safe harbor from enforcement action.  To be eligible for the safe harbor, a voluntary code of conduct would have to be developed through an open, multi-stakeholder process and approved by the FTC for sufficiency.  As Commerce sees it, FTC approval might be obtained as a result of a request from a party or as a result of the resolution of a specific dispute. 

In the absence of a voluntary code of conduct, Commerce is, apparently, prepared to recommend FTC rulemaking or actual legislation.  Commerce clearly prefers the use of FIPPs with codes of conduct because they appear to be more flexible than either rulemaking or legislation.  Commerce may be right about the flexibility, but, flexible or not, Commerce does not seem to consider the potentially differing effect of any of these processes on differently situated groups.

Here is the rub:  Google’s ability to develop a voluntary code of conduct through “an open, multi-stakeholder process” is completely different from that of an early stage company that just got five million dollars of venture money, let alone a start-up with few hundred thousand dollars of angel money.  The internet is still evolving at an astonishing rate.  Companies that were once tiny have become titans (look at Google or Facebook).  There remain many of these stories to come.  The Commerce Department itself points out that “Between 1998 and 2008, the number of domestic IT jobs grew by 26%, four times faster than US employment as a whole…By 2018, IT employment is expected to grow by another 22 percent.”  This growth is driven by innovation.  Innovation, in turn, is driven by small tech companies.  Burdening these companies with rules and regulations that might make sense for Microsoft, Google and Facebook is tantamount to slamming the breaks on progress in one of the US economy’s few potential bright spots.

 The FTC has this to say in its proposal:

For every business, privacy should be a basic consideration – similar to keeping track of costs and revenues, or strategic planning. To further this goal, this report proposes a normative framework for how companies should protect consumers’ privacy. This proposal is intended to inform policymakers, including Congress, as they develop solutions, policies, and potential laws governing privacy, and guide and motivate industry as it develops more robust and effective best practices and self-regulatory guidelines.

Commerce Secretary Gary Locke has this to say about the Commerce proposal:

America needs a robust privacy framework that preserves consumer trust in the evolving Internet economy while ensuring the Web remains a platform for innovation, jobs, and economic growth. Self-regulation without stronger enforcement is not enough. Consumers must trust the Internet in order for businesses to succeed online.

I believe that the “big boys” (Microsoft, Google, Facebook et. al.) are on top of the issues and have, doubtless, retained armies of lobbyists to influence whatever regulation comes out of the FTC and Commerce.  Having said that, I don’t think that smaller tech companies that could be affected by the upcoming regulations or their investors have given this topic much thought.  Perhaps, that is not really fair.  It is more probable that they have not focused on the substantive provisions that are up for consideration or how those provisions (if adopted in the forms proposed) could affect them.  Finally, I don’t think small tech companies and their investors think they can do much about any of this, so why spend time on it.

As a result, I (together with a couple of my colleagues here at Foley Hoag, Pat Connolly and Hillary Fitzpatrick) have decided to write a series of posts addressing some of the more material proposals at a pretty granular level.  These posts will appear regularly over the next few weeks.  Actually, I want to put them up before the last week of January because that is when the comment period for the FTC and Commerce proposals runs out. 

The purpose of these posts is to educate about what is actually in the proposals and to build support for outreach to the FTC and Commerce in an effort to limit the potential negative impact of these proposals on early stage and venture financed tech companies.

One theme that will emerge is that there will be some level of regulation protecting consumer privacy.  So, these posts are not really about resisting the inevitable.  To the extent that these posts are about affecting the FTC and Commerce outcomes, they will be about the art of the possible.  It is too late to go back to the relatively unregulated world that we have become used to in the internet.  The status quo is going to change.  But there is some room for influencing the actual outcome.

Another theme that will emerge is that the interests of the internet big boys are not necessarily the same as that of early stage companies.  For example, the ability of companies that are profitable or have relatively easy access to capital to comply with regulatory requirements is very different from that of a start up or a company with angel or venture financing.  For this reason, smaller companies and their investors should not just assume that the big boys will make sure things come out OK.

A final theme that will come out is that you have to speak to be heard.  As of last Monday, there were 177 comments to the FTC proposal and almost all of them supported do-not-track.  None of the ones I looked at recognized any special adverse impact that the proposals are likely to have on small companies.  If the comment period closes and there is nothing from the early stage tech community in the docket, the FTC and Commerce will be in a position to address the concerns of all the other constituents and ignore the entrepreneurial world.

The recent FTC report envisions a do-not-track mechanism that lets consumers opt out of third party tracking for behavioral advertising, which is one of the most common forms of online tracking. If companies wish to share personal information with third parties for purposes other than online behavioral advertising, we think some greater form of user consent should be obtained. The system as currently envisioned would not apply to ordinary first party tracking or to a first party's use of a service provider for website analytics, assuming the service provider makes no additional use of the collected data.

It is important to keep in mind that the FTC is not proposing a blanket ban on all tracking.  Having said that, it is still not clear to me that the proposal is not based upon the perceived creepiness of tracking and the emotional response of many people to the idea that they are being tracked. 

The reason that third party tracking is “one of the most common forms of online tracking” is that there are substantial economic benefits to it.  No one has really answered the question:  What happens if do-not-track actually results in many people opting out?

One thing is likely, the people who make money as a result of this kind of tracking wont any more.  So, whatever “free” content is being supported this way will either disappear or will be paid for some other way.

Another thing that might happen was suggested to me by a well known entrepreneur and investor here in Boston.  A great deal of effort and ingenuity will be expended getting people to opt in.  If this happens, it could have a lot of ramifications.  One consequence that he suggested is that once people opt in, they will have expressly agreed to the use of their information and there is likely to be much more far reaching and free ranging use of their information compared to the current system in which abusers are likely to be outed unpleasantly one way or another.  A second consequence that he suggested is that businesses will try to position themselves as first party providers in various ways and thereby evade the ban.  Finally, he suggested that the cost getting people to opt in will simply be added to the cost of innovation.

One thing is for sure, there is significant money to be made through behavioral advertising.  Until the cost of getting to good quality behavioral advertising becomes so high that it become uneconomical to go there, the money will be seeking ways to get there. 

This is the time of year when pundits look forward and make predictions.  So, I decided to do the same.  Here are ten predictions for next year:

 1)     The Pats will beat the Eagles in the Superbowl

 2)     Angels will continue to invest at a torrid rate.

 3)     There will be continued modest improvement in numbers of VC financings (but not enough to get back to 2007 levels).

 4)     Cleantech and renewable energy start-ups will continue to have difficulty raising venture money.

 5)     There will be continued modest improvement in M&A exits (but not enough to get back to 2007 levels).

 6)     There will be approximately 50 IPOs of venture financed companies (more than half of t he 86 that happened in 2007).

 7)     VC fund formation will also be slower than 2007 (both in amount raised and new funds raised).

 8)     The west coast will continue to provide better terms and valuations to entrepreneurs than the east coast.

 9)     Consumer web privacy rules will be promulgated and they will not have a material impact on tracking.

 10)   Net neutrality rules will be promulgated, and they will allow differential pricing of some sort.

So we will not be seeing 2007 levels of activity, but the entrepreneurial ecosystem will be livelier than last year.  So, I am predicting cold, but with a chance of fun.

As WiredPrNews.com puts it, “If the Do Not Track plan is approved and implemented, the repercussions for the online ad industry could be catastrophic.”

You can think it is creepy, you can think it is an invasion of your privacy, whatever.  But, make no mistake about it.  If the Feds actually do away with tracking (by having a super easy opt out or in some other way), the basic business models that bring you (an everyone else) all that cool free stuff, will have to change.

It will have to be paid for some other way.  Subscription fees and pay per use are my bets.  Maybe that is OK because it protects privacy.  But, have no illusions about it, such a change would favor those who have the means to pay and make the internet a difficult place for those who do not.  It will change the fundamental egalitarian nature of the web and will make it a less robust less valuable place.

I have not addressed the free rider problem.  That is can you (as an individual) opt out and still get all the goodies from Google that require that all the rest of us agree to be tracked?  The problem with this is, of course, that each person is likely to be incentivized to opt out because they will not pay the cost in “lost” privacy but will get the benefit of “free” stuff.  If enough people opt out, the goodies wont be there for anyone.  And, by the way, the rate of development of new “goodies” will slow to a crawl.

So, what should the Feds do?  Perhaps, the Feds should consider a regulatory structure along these lines: (1) promulgate rules that protect populations that need protections (such as children) with specific substantive rules around what information can be gathered, stored and monetized about these populations, (2) promulgate rules that protect specific types of information that are rife with the possibility for abuse (such as social security numbers or personal medical information), and (3) for everyone and everything else promulgate rules that require full and fair disclosure around what is and is not being tracked.  Other than these three things, the FEDs should consider doing nothing at all.

If you really want to opt out, you will be able to do so by simply not using Google, Facebook, MapQuest or any of the others.  You won’t be free riding, and, frankly, the value each of us gets from all these “free” online services is so great that few, if any, will opt out when the direct choice is not to have these “free” services.

The other day at Mass TLC’s Mobility Summit I had a brief conversation with Mark Herrmann (an entrepreneur here in Boston) that touched on the FTC’s recent proposal for protecting consumer privacy online.  We were talking about the “do not track” proposal and the consensus in the tech industry that it just won’t fly. 

Mark’s comment:

“It is creepy that ‘they’ can and do track you out in the net, but ‘creepy is the new cool.’”

There is just no question that some people accept the fact that they are being tracked and fed targeted online advertising.  It is not just OK by them; it’s a value add.  I don’t disagree. 

But, for anyone who has read “1984” (and even a lot of people who haven’t) the notion of being tracked is creepy.  There are a lot of these folks – perhaps a significant majority of the U.S. population – that feel this way.

In 2011 the FTC and Congress are going to pay attention to these concerns. It is good politics. 

Prediction #1:  Legislation in this area will be one of the few places where we will see bipartisan consensus in the next Congress. 

Why: No Congressperson wants to be opposed to consumer privacy, and they all want to have supported some legislation that passed, when running in the next election.

Mark (and others) made the point that if you really end tracking, you will end Facebook.  So, whatever happens it won’t be that.  However, the political snowball is rolling down the mountain - there will be regulatory activity around consumer privacy. 

The only question is: What will be the nature and scope of the activity?

The big boys (those with well established businesses that either make money or have ready access to capital) are going to be lobbying hard for a regulatory framework that does not dent their current business model. 

Prediction #2:  The big boys will fight anything that disrupts tracking and they are going to win this battle – no one in Congress wants to run on the platform that they put Facebook (or others) out of business.

But the big boys are going to have to trade something.  The easy things for them to trade are procedural protections for the consumer. 

• The FTC wants the industry to adopt “privacy by design” principles.  This means that companies should adopt internal processes to promote consumer privacy and security protections into their daily practices and to consider privacy issues at every stage of design and development of products and services.
• The FTC wants the industry to make consumer data more available to consumers.  This means allowing for increased consumer access to data collected. 

Prediction #3:  The big boys will trade lots of procedural protections for the consumer to prevent substantive regulation that will directly affect their business models. 

Why:  The big boys can afford the administrative burden implicit in procedural protections.  It is just a matter of more money, more people and more oversight.  A company that is well established and profitable or that has easy access to capital can afford to write the code, hire an army of new engineers, consultants, lawyers etc. and create an entire Department of Privacy Compliance and Protection. 

In fact, to the extent that having to do all that makes it harder for start-ups, it may even be helpful to the established companies.

Some folks I talk to have expressed real concern about this looming regulatory push and how it might affect the entire ecosystem for digital media start-ups.

There is still a chance to influence the inevitable regulation that is upcoming and I am working on assembling a group of industry leaders to do just that.  I recently sent out a letter (here’s a link) to people I thought might be concerned enough to actually do something.

Read it and let me know what you think.

The tech community seems to think this is no big deal because industry will prevail.  By "prevail" tech folks seem to mean that the regs, whatever they are, will be so watered down that the regs will be meaningless.  Their position is that anything else is unthinkable because the really big boys, Facebook and Google –as well as many others, depend upon tracking and targeted advertising.  To put a damper on them would create massive disruption.  Also, traditional carriers have huge value in the data they have, so Verizon, ATT and etc. will not let it happen.

At some level you have to agree with these observations. 

But, the counterpoint to them is that the FTC has now come out with a proposal.  There is great political pressure on Congress to do something. There is wide bipartisan support in Congress for regulatory activity to protect personal privacy.  Finally, among the non-tech world (which is most of the population) is creeped out by the notion that they are tracked onthe web.

I am concerned that the tech world just does not recognize that the non-tech population really does not like tracking 9and other data gathering).  I think the tech world also underestimates the appeal of giving people a choice not to be tracked.  Strangely, Fred Wilson’s blog makes this clear.  He refers to the “silent majority” who are not troubled by the data collection practices of most web companies and the “vocal minority” that are.  My concern is that he may just be wrong. 

So, it is predictable that some compromise will be reached between the FTC and the large companies who are already alerted to the issues and are working on changes that will be OK for them.

One problem: large companies have different interest from early stage and smaller companies.  For example, large companies will have far greater resources to deal with and comply with all sorts of regulation.  If they are required to incorporate specific privacy based procedures into their product development and other activities, they have the financial and other resources to do this.  If they are required to make the gathered information available to consumers or place restrictions on “new” uses of such data they can carry the cost of doing these things.  In fact, big companies may support this type of regulation, in part, as a trade for leniency on tracking and, in part, because it will form a barrier to entry for little companies.

If this happens, regulation could go a long way to undermining the economics of some start-ups.  So, you can’t rely on Facebook, Google, Microsoft et. al. to carry the ball for early stage companies.

The FTC has a process by which interested parties can comment on and influence the outcome of proposed regulation.  The resulting regulation will reflect this input.  The problem that arises for small companies is that it (the process) is expensive and time consuming.  it takes time and money to write comments, track proceedings, contact congressmen etc.  Google, Facebook, Verizon, and ATT will be hiring armies of lobbyists to do this (they may already ahve the armies deployed) – but they will not be lobbying for changes that work for start-ups.  Smaller companies just will not be able to compete in the fight to influence regulation and may end up with a regulatory scheme that is not hostile to them.

Small companies and the people who invest in them need to find a way to participate in the process.  If they do not, they could be looking at a pretty bleak future.

The Federal Trade Commission (FTC) just published its preliminary Staff report setting out its proposed framework for protecting privacy in the digital economy. View the FTC’s press release here. The FTC is seeking comments on its proposed framework by January 31, 2011 and expects to issue a final report in 2011.

Every digital media business that attracts advertising revenue online and/or through mobile devices, as well as the venture capital and private equity funds that invest in them, has a stake in the outcome of this proposed framework. It can affect current business models, future financial performance and potential exit opportunities for current and potential companies that rely on collecting data from consumers.

The final report, and possible new regulations and/or federal legislation to follow, will help shape substantive law, enforcement policies and commercial best practices regarding consumer privacy practices that will need to be followed.

Notably, the FTC staff cites flaws in commercially available, privacy-related plug-ins and browser features, and supports a more uniform and comprehensive consumer choice mechanism for online behavioral advertising than currently exists. This is often called “Do Not Track,” in a nod to the currently mandated “Do Not Call” registry that restricts the activities of telemarketers. FTC staff identified and requested comment on a number of issues concerning the formulation and adoption of any such “Do Not Track” mechanism.

Other important components of the proposed framework include:

• Scope: The proposed framework would apply to all commercial entities that collect or use consumer data that can reasonably be linked to a specific consumer, computer or other device. Here, the FTC staff recognizes the erosion of the distinction between personally- identifiable information (e.g., name, address and social security number) and supposedly anonymous information that may be collected without the knowledge of the web- or mobile device-user.
• Promotion of consumer privacy: The proposed framework would require companies to promote consumer privacy and security protections into their daily practices and to consider privacy issues at every stage of design and development of products and services. Suggested steps include:1) providing security for consumer data; 2) limiting data collection to the relevancy of a specific business practice; 3) enforcing sound retention policies; 4) providing assurances of data accuracy; and 5) implementing comprehensive data management procedures throughout the lifecycle of products and services.
• Consumer choice: In addition to the “Do Not Track” mechanism described above, the proposed framework would require companies to provide consumers with a notice-and-choice mechanism at the point when the consumer is providing data to the company. This would not be required in the context of commonly- accepted practices, such as order fulfillment or first-party marketing, however.
• Transparency and Access to Data: The proposed framework would require vastly- increased transparency with respect to data collection practices and allow for increased consumer access to data collected. As part of implementing this component, the Commission suggests a level of simplification and standardization for currently loosely governed website privacy policies.

Before this framework is submitted in final form to the FTC for a vote by its commissioners, which will accelerate the process further, the FTC is requesting comment by interested parties on a variety of key related issues, including:

• Scope: Are there practical considerations that support excluding certain types of companies or businesses from the framework?
• Substantive Privacy Protections: What substantive protections should companies provide, and how should the costs and benefits of such protections be balanced?
• Comprehensive Data Management Procedures: How can the full range of stakeholders be given an incentive to develop and deploy privacy-enhancing technologies? 
• Consumer Choice; “Do Not Track”:
  • How should a universal choice mechanism be designed for consumers to control online behavioral advertising?
  • What are the costs and benefits of offering a standardized uniform choice mechanism to control online behavioral advertising?
  • What is the likely impact if large numbers of consumers elect to opt out?
  • Should a universal choice mechanism include an option that allows consumers more granular control over the types of advertising they want to receive and the type of data they are willing to have collected about them?
• Transparency of Data Practices: With respect to website privacy notices, is it feasible to standardize the format and terminology for describing data practices across industries? Should companies inform consumers of the identity of those with whom the company has shared data about the consumer, as well as the source of that data?
• Notifying Consumers of Changes in Data-Use Practices: What is the appropriate level of transparency and consent for prospective changes to data-handling practices?

Public sensibilities on privacy will evolve. Over time, Web users will recognize that the Internet is a public space, not unlike public malls or streets. You may surf the Web from your bedroom, but your surfing takes you out of that private, protected place. Just as people can be recognized when they walk through public malls or streets, they will be recognized online if they haven't taken steps to prevent that recognition, which will probably mean that there will be many parts of the Web where they won't be able to go if they want to remain cloaked.

This does seem like where we are going and good common sense to me.

Now consider the following investment scenario:  you get a $5mm on $5mm valuation, but what does that mean?  If there is a preference, then the investor's $5mm is worth more than yours (this is even more true if there is also a participation).  (Just consider what happens in a low value exit.)

But -- how much more is the investor’s position worth?  I am not a finance maven, but think about the exercise price of your company’s options.  This price is supposed to be the fair market value of a share of common stock.  Now no one (except maybe the IRS) really believes that the strike price of an option is actually the fair market value of share common stock on the date of issue since setting the exercise price of options is mostly an effort to pick the lowest price you think you can get away with.  Nevertheless, everyone agrees that a share of preferred stock is worth a lot more than a share of common stock.  For argument's sake, let's assume a share of common stock is worth half of a share of preferred stock.  In this case your $5mm on $5mm is really $5mm on $2.5mm.

Thinking of your common stock position this way will also give you a sense of how much bigger a score has to be for you to make a return than it has to be for the investor.  I am really thinking of smaller exits, which a lot of people think is likely to be one of the hallmarks of capital efficient businesses.

If you raise $5mm (at $5 mm pre (i.e. $5 on $5) with a preference and a participation) and you sell for $20mm in two years, your investor gets $12.5mm (a return of 150%) and you get $7.5 (a return of 50%).  If the exit is at $200mm, there is still a disparity, but it fades into insignificance.  A capped participation preserves the disparity in the low value exit scenario while making it go away in the high value scenario. 

It sometimes seems to me that the quid pro quo for downside protection should be a diminution of upside return, but that is not the way VC investments are structured.

When you realize that returns to VCs in the last decade have been at or near zero (industry wide, and despite the downside protection), you have to realize that returns to entrepreneurs have been far far worse.

Not many mechanisms have been devised to mitigate this situation from an entrepreneur’s point of view.  One that has been used on occasion is to structure the initial capitalization of the Company (i.e. before venture investment) with common stock and a preferred stock.  Usually this is a preferred "lite."  It does not have all of the bells and whistles of the usual VC preferred, but it carries some important rights such as a preference and anti-dilution provisions.  These preferred shares are issued for “real” consideration (cash for example) and then the argument is made (at the time of venture investment) that they are really an early seed round.

 Whether you can succeed with this strategy is, of course, a matter of negotiating strength.

Like everything else i write and look at several weeks later, there are a few nuances that I wish I could rework and a few additional points I wish I could make, but all in all I'm pretty happy with the article and about those additional points you ask? .......Stay tuned!

Picture this: you’re an entrepreneur about to make your first foray into e-commerce.  This is exciting, but you can’t help but feel a little concerned.  Every day, you read a new story about advocacy groups and even Congress scolding businesses for being careless in their treatment of the personal data they collect, or criticizing the shadowy ways in which they collect it.  Publishers of major websites are rethinking procedures as they discover tracking technologies residing on their sites that they weren’t even aware of.  The dollar amount of settlements in the wake of high profile data breaches would be enough to cripple your budding enterprise.  I’d be worried if you weren’t concerned about the increasingly high profile area of consumer privacy protection.  Thinking carefully now and coming up with a website privacy policy in accordance with some simple guidelines can give you peace of mind and will allow you to focus on running and growing your business and making the most of your new website.

As you’re starting out, you probably have only a handful of site visitors.  You may even know many of them personally and you know they are rooting for you to succeed.  Because you would never want to do anything to breach the trust of your precious new customers, your task may seem simple: promise them absolute protection of their privacy.  Promise to keep everything they share with you in a Seinfeldian vault, and promise that the combination to the vault is theirs alone.  To achieve this, you may immediately set about cutting and pasting the most stringent provisions you can find from privacy policies of your favorite well-known websites.  Danger! Resist the urge to do this.  This approach is problematic (first off, consider the copyright implications).  Instead, engage in some thoughtful planning and keep a few concepts in mind as you conceive your privacy policy....

            Now that OPPA has given you a rough idea of what you must tell visitors in your privacy policy, you need to consider what level of detail to include.  Although there is no negotiation taking place, by asking your customers to accept the terms of your privacy policy you are attempting to enter into an agreement with them.  For your side of the agreement, the more you promise, and the more you give your customers in terms of privacy protection, the more good will and reputational advantage you may earn.  These are important values to keep in mind with consumer consciousness concerning privacy on the rise.  On the other hand, your business will be bound to act in accordance with your privacy policy, the obligations it imposes, and the promises it contains.  Over-promising now could hamper your business’s future ability to collect and use information in benevolent and rewarding, but currently unforeseen, ways.  That said, I will reiterate the importance of disclosing enough so as not to mislead your customers.  With a nod to OPPA, website privacy policies are often constructed by asking, and presented by providing the answers to, the following questions:

• When do we collect information?  In addition to information you collect from users when they register as a member or order a product, do you collect information concerning site usage behavior, IP addresses and other anonymous information using tracking technologies?  If so, one component of the answer to the “when?” question may be “any time a user visits the website.”
• What information do we collect?  The answer to this question is often broken down into the personally identifiable information (e.g. first and last name, address, telephone number, etc.) that is collected and into another category, often called aggregate information.  Any data you collect from users on an anonymous basis to administer the site and analyze its usage probably falls into the aggregate information bucket.
• How do we use personal information?  In your answer to this question you may include things like order fulfillment or storage in a contact database.  Describe how you actually use information but beware of promises to never engage in certain other uses.  As I will describe, amending away such an absolute promise in a privacy policy can be tricky.
• What information do we disclose to third parties?  In answering this question, remember that you likely cannot make an absolute promise not to disclose personal information to thirds parties.  Leaving aside the acts of various scalawags that are out of your control, you need to think about any necessary disclosures to contractors (e.g. those who ship goods ordered from your site), to courts or law enforcement agencies, or to third parties in the context of a business combination.
• How do our customers access and update their information?  This process usually includes a user logging into their account on the site and updating the information they’ve shared.  If such online functionality is not available, it’s a good idea to post an e-mail address where users can request changes to or deletion of their personal information.

Answering these questions will likely require you to perform some internal due diligence.  You should engage all relevant departments (e.g. marketing, IT, billing) of your business in assessing and understanding your privacy practices.  Once you have a thorough understanding of what you’re actually doing with respect to website visitors’ privacy, you can craft a policy that is consistent with reality and with other statements made on the website, and that you will be able to adhere to.

Although not required, some policies contain a description of the physical and technical safeguards used to safeguard privacy.  You will likely build up trust capital by showing your customers that you have robust privacy protection practices in place.  Watch out here, though.  Don’t say you use, for example, secure socket link encryption for transactions if that’s not actually the case.  This is an example of a provision that sounds great when you read it in the privacy policy posted on megaretailer.biz, but which you may not be able to adhere to.  Better to remain silent on the security measures you employ than to give a list of impressive-sounding practices you don’t actually adhere to.

Another important consideration is your explanation of how the policy will be amended.  Be aware that there are certain best practices to be followed in trying to ensure that your privacy policy as amended will apply to continuing users of your site.  Once again, you’re trying to form an agreement with visitors to your website, and principles of contract formation are likely to apply.  This means that each time you change your privacy policy, the best practices include notifying visitors of the changes and requiring them to accept the changes after clicking through the amended policy. 

Keep the cumbersome amendment process in mind while crafting your privacy policy and deciding what promises you want to make at the outset.  Visitors who use your site in reliance on the promises you make will likely have a right to have those promises enforced, and amending promises away as your business evolves is a tricky proposition.  Avoid the temptation to make broad and absolute promises in your privacy policy, and cut out flowery, aspirational language.  Although “legalese” should be scrapped in favor of language that is easily read and understood, resist the urge to go too far in the other direction.  In your introductory paragraph, a clear description of the purpose and content of the privacy policy that doesn’t contain any promises you can’t fulfill or hidden liability traps beats a statement that effectively promises visitors the moon when it comes to protection of their privacy.

Of course, your company may have special concerns about its website.  For example, if you plan to collect data from children under the age of 13, you’ll need to comply with the Children’s Online Privacy Protection Act (“COPPA”).  Enforcement of COPPA is the responsibility of the FTC and has lately been the focus of review by the agency and the scrutiny of all sorts of advocacy groups.  This is an area that may be in flux and deserves careful monitoring. 

I have confidence that if you were able to find your way to this article, it won’t take long for you, perhaps with the able assistance of your attorney, to be well on your way to crafting a thoughtful, well-balanced website privacy policy using about the same number of words I’ve used in this primer.  For more on the topic of consumer privacy protection, visit Foley Hoag’s blog, Security, Privacy and the Law and please keep an eye out for a follow up primer on drafting website terms of use agreements.

Here is a simple thought.  The value of advertising has to bear some relation to the value of the things it is selling.  If the gross value of all goods you are trying to sell is $X billion, then all the advertising has to be something less than $X billion.  There is some upper limit on the value of advertising based businesses.

The value of all these businesses in the aggregate can’t increase all that dramatically from year to year, unless the underlying market for the goods they are selling is also increasing.  That has not been the case in the past few years, yet there has been a boom in advertising driven businesses.  It may be that there has been a shift in value from old style ad based businesses (like print ads) to new interactive ad based businesses like Four Square.  But, I will venture a guess that it is not dramatic enough to account for the vast increase in valuations for these types of businesses. 

If the two trend lines, growth in valuation of ad based businesses and growth in the underlying businesses that use ads, diverge greatly there is evidence that there is a bubble and there will be a correction.  Here is a link to a short video on Richard Dale’s blog Venture Cyclist that kind of makes this point.

Then every now and again, you catch something.  The other day I went steelhead fishing on the Salmon River and caught a couple of monsters.  Here is one:

Anyway it is time for the quarterly catching report – that is the report on venture deals for Q3. 

Foley Hoag (my firm), Fenwick & West (a Silicon Valley based firm), and Cooley (with offices sprinkled about the country) have each published their activity reports for Q3 of 2010.  The consensus view is one of cautious optimism that recognizes continued signs of trouble.

My partner, Dave Pierson, put it this way, “The reported information suggests that the environment for venture investing continues to be sluggish.  Nevertheless, there are positive signs…..Unfortunately, there are negative indicators as well….”

Fenwick has this to say, “Third party analysis of the venture industry in the third quarter of 2010 reported a decrease in venture investment compared to the second quarter of 2010, but a continued improvement in venture funded company liquidity.”

Cooley described it this way, “Consistent with a theme we reported on during the prior quarter, Q3 2010 financing results remained mixed.”

By way of background, Foley Hoag’s Venture Perspectives reports on New England transactions, Fenwick reports on Silicon Valley transactions and Cooley reports on transactions in which it is involved.

Activity Levels

According to our research, overall New England Series A deals increased in Q3 over Q2 but the number of New England Series B and later stage deals declined.  Perhaps the most striking thing is that, in terms of numbers of Series A deals, the technology sector looks to be on track to top 2007!  (Cleantech too, but that is a very small number of New England deals.)

According to Fenwick, in the Valley, “up rounds exceeded down rounds in 3Q10 52% to 30%, with 18% flat.  That was generally consistent with 2Q10…”

Cooley has much the same point of view, “The percentage of up versus flat/down rounds remained relatively consistent with the prior two quarters of the year, with the majority of deals being up rounds for the third consecutive quarter.”

Looked at from 30,000 feet, we are circling.  It looks like there is a slight trend towards improvement that has been sustained through the year.  But it looks fragile and who knows if it will continue.

Terms – Usually boring but this time there are some striking east coast/west coast differences.

As I have done in the past, I have prepared a table comparing some of the deal terms reported on by the three firms. 

Comparison of Terms for Q3 2010 Venture Deals from Foley Hoag, Fenwick & West, and Cooley

(some percentages are approximate)

(1) In 58% of these cases the participation was not capped

(2) Represents all transactions collectively

Cumulative Dividends

Just look at the difference between what Foley Hoag is reporting and what Fenwick is reporting – an order of magnitude!  Since I have been writing this quarterly post, I have noted a divergence in practice between the two coasts with respect to cumulative dividends, but the divergence is increasing not decreasing.  It is hard for me to explain this divergence.  One explanation could be that while New England VC firms that operate on both coasts are not extracting cumulative dividends from their portfolio companies, the smaller regional firms in New England retain a very conservative investment style and continue to get these dividends.

Preference with Participation

There is good news and bad news.  The good news is that only about half the deals reported on have this deadly combo.  The bad news is that about half the deals reported on have this deadly combo.  Looked at in this very high level broad brush way, east and west seem to have a consistent practice with respect to preference and participation.

Redemption

Another shock to the system.   Again compare the numbers between New England and the Valley.  The prevalence of redemption provisions in New England is hard to explain.  In past quarters I have attributed this to a slower rate of change in New England than on the west coast, but the numbers are not converging. 

Venture Capital or Banking?

When you look at the numbers over several quarters and you add up the dividends, preferences and redemption, you could come to the conclusion that New England VCs have a banking mentality.  They will lend you money at interest (dividends), you need to pay back the principal (preference) in a five year term (redemption), and they get an equity kicker (participation).

So How is the Fishing?

Well there are some good indications that the fish are biting (or soon will be).  Here is one:  There have been some 40 IPOs of venture financed companies to date this year.  A number which is more than 3x the total 2009 number but is still half of 2007’s full year total.  I don’t know exactly where the Dow is right now, but it is getting ever closer to the 12,000 number and has risen significantly this year.  The improved atmosphere for exits should generate confidence in investors and therefore investment.  Hopefully, the fish will be out there feeding.

A contra indicator is that VC fund raising appears to be behind 2009.  Just for scale, 2009 was the lowest fund raising year since 2003 (I think).  This trend (low rates of fund raising) suggests that there will be fewer fish in the river.

Anyway, if you are lucky, you will catch one of these:

Here is the basic rationale Fred offers in support of always getting a preference:

i invest $1mm in your company for 20%

  the company is six months old and this is the first investment of outside capital

  a week later you sell the company for $2.5mm

  you get $2mm for six months work i get a $500k loss does that sound fair?

no it does not that is why there is a liquidation preference to protect investors from that happening to them

In light of that comment, consider this scenario:

A VC invests $5mm with a $5mm pre (that is $5 on $5).  What the investor seems to be saying is that your efforts to date are worth $5 and their money is clearly worth $5, so the total post value is $10.  You have each contributed equal value to the company.  Then time passes and you sell the company for $9 (Fred’s nightmare).  In the distribution, you get $4mm and your VC gets $5mm.  You made equal contributions, but you took way more downside risk on performance than the VC. 

Now consider what happens if you sell the company for $20mm.  In the case where there is preference without participation, you and the investor will share equally in the proceeds ($10mm each).  You will each have gotten the same return on investments of equal value in the same enterprise.  But the VC took way less risk than you to get the same return.  In the case where there is a 1x preference and a participation, the return is $12.5mm to the VC and $7.5MM to you.  You made investments of equal value in the same enterprise, but the VC took less downside risk and got a bigger upside return.

Based on this scenario and Fred’s concern as expressed in the quotation, I would argue that Fred’s concern about a precipitous early sale that provides a return to the founders at the expense of the investor (which I hope is ill founded) can, and should, be addressed through contractual provisions such as blocking rights and board representation and not through a reallocation of investment risk that affects returns in cases where there is not an unfair early sale.

I will go further and argue that if the investor wants the downside protection of a preference, the founder should get a compensating upside boost.