One of my colleagues, Hillary Fitzpatrick Peterson, has been doing a lot of work on the privacy front and has this to say about informed consent and consumer choice.
A major component of the FTC report, Protecting Consumer Privacy in an Era of Rapid Change, is the idea of consumer choice. This is the idea that when a consumer provides a company with certain types of information, the consumer should be informed as to what that company intends to do with that information and then should be able to choose whether or not to continue the interaction. One of the goals outlined in the FTC report is to allow “consumers the ability to make informed and meaningful choices” regarding the use of their information for data collection purposes. The FTC further states that businesses interacting with consumers should present choices “clearly and concisely,” while offering “easy-to-use choice mechanisms.” Exactly what is determined to constitute an informed choice in the final regulations is likely to have a significant impact on every company that is subject to these regulations.
As the FTC notes in its report, there are many considerations to weigh in determining how to best present this choice for the consumer. First, there is a question of when the necessary disclosure and consumer control mechanism should be presented. In the case of a website where the company is providing retail or other service directly to the consumer, common sense tells you that the consumer should be presented with the choice mechanism at the point of sale or exchange of data. This question becomes more complicated, however, when one considers the example of a social media service where the relationship between the consumer and the company might be ongoing, and where the nature and scope of the information being exchanged often changes over time. In this scenario, should the consumer be continually prompted to provide consent to the use of their information? Alternatively, should all potential exchanges of information between the consumer and the company be included in the initial disclosure and consent?
A second consideration for establishing the proper consumer choice mechanism is the content of the disclosure itself. As the FTC report makes clear, the Commission staff believes that disclosures and the choices presented buried within lengthy privacy policies will not result in meaningful, informed consent by consumers. While the Commission staff clearly prefers a simple and widely-accessible approach to providing this choice, their report provides little evidence of how they intend to apply these ideas to the varying types of consumer interaction with different websites, services and products. For instance, how would the developer of an application used on a mobile device both clearly and accurately provide the consumer with the required disclosure when those disclosures might involve describing complicated relationships between third-parties? Further, is it feasible to believe that a consumer who might download such an application while commuting on the subway will read the disclosures on their mobile phone and then be able to provide an informed consent?
Despite fact that this question of consumer choice will likely be a central element of any new regulations related to the protection of consumer privacy and the use of consumer data, the FTC’s proposals provide many more questions than answers on this issue. One of the proposed approaches is some version of an “opt-in” or “opt-out” consent provided to consumers when they seek to engage with a particular company. Similar to the concerns over the “Do Not Track” proposal, there is a significant possibility that this simplistic, all-or-nothing approach might encourage consumers to simply choose to “opt-out,” without much consideration to the trade offs involved with the exchange of data for the services of the company. As consumers opt-out, companies who up to that point have relied on the use of consumer data as a way to keep the cost of their services low (or free), will likely need to raise prices on the consumer. On the other hand, should consumers choose some sort of general “opt-in” when they purchase or begin to use a product or service, the regulations likely will not have the intended effect of increasing consumer knowledge and control over the use of their personal data.
As with most elements of the FTC’s report, these issues do not lend themselves to simple, blanket solutions. As stated in its title, the purpose of this report is to protect consumer privacy; however, the framework in its current form is weighted too heavily on the side of privacy, without enough consideration for the practical implications for the businesses that provide many different products and services to consumers. All parties would benefit from a regulatory approach that takes into account the nuanced and complex relationship between consumers and businesses in this increasingly data-driven sector of the economy.