FCC Refuses To Force Websites To Adhere To 'Do Not Track,' And That's A Good Thing

from the plate's-already-full dept

If you've followed the saga of "Do Not Track," you know it began with good intentions, labored under squabbling and marketing industry sabotage, and is now seen by some as too little too late in the face of far more sophisticated new snoopvertising technologies. Knowing that many companies will never honor Do Not Track requests voluntarily, Consumer Watchdog had filed a petition (pdf) with the FCC to "initiate a rulemaking proceeding requiring 'edge providers' (like Google, Facebook, YouTube, Pandora, Netflix, and LinkedIn) to honor 'Do Not Track' Requests from consumers."

In short, the faux consumer advocacy group (which is famous for taking extreme positions that would likely do more harm to consumers than help them) wanted the FCC to lean on Title I and Section 706 authority to regulate "information services," forcing content companies to honor DNT requests. While the FCC is planning to begin proceedings examining new privacy policies for broadband companies in the next few months, the group argued this wouldn't be enough to protect consumers from invasive snoopvertising:

"Many consumers are as concerned -- or perhaps even more worried -- about the online tracking and data collection practices of edge providers... edge providers collect the same sensitive personal information that broadband Internet access service providers collect, and that the Commission is committed to protecting. If the Commission does not act to regulate the collection of personal information by edge providers, the Commission will in effect be granting a regulatory advantage to the edge providers, implicating concerns of market distortions."

But the FCC is having none of it. The agency dismissed (pdf) Consumer Watchdog's request, stating that it "has been unequivocal in declaring that it has no intent to regulate edge providers." And indeed, the FCC already has its hands full; it's fighting off ISP lawyers trying to dismantle net neutrality and Title II reclassification, battling ISP-beholden states unhappy with the agency's attack on protectionist broadband state law, and is about to go to war with ISPs on privacy. That's a pretty full plate, with the FCC likely lacking the bandwidth for making any more "friends" at the moment.

And while some telecom industry sockpuppets will surely insist this is a double standard, the FCC's decision may not be a bad thing. The EFF argues the FCC made the "right call, for now," pointing out that consumers can choose not to use Google or Facebook, a luxury they don't enjoy when being held captive by the uncompetitive broadband last mile:

"Why the distinction between websites and ISPs? Because ISPs occupy a much more privileged position on the network. They carry all of a user’s traffic. That gives them the power to act as gatekeepers, deciding what sorts of traffic users can send and receive. It also gives them the opportunity to modify user traffic, adding privacy-destroying tags like Verizon’s UIDH super-cookie.

Edge providers, on the other hand, don’t have quite as much power. It’s a lot easier for users to “vote with their feet” and use a different edge provider for search, social networking, blogging, etc., than it is to change ISPs. Users also have more control over what information they send to edge providers -- that’s why tracker blockers like Privacy Badger work. And of course, there’s the matter of jurisdiction; while ISPs operate in specific geographical areas, websites are accessible (and hosted) all over the world, which would raise all sorts of terrible jurisdictional issues."

In other words, enforcement would be impossible even if the FCC had decided to regulate websites and stumble into the Do Not Track mess. It's a fairly restrained decision for an agency consistently accused of being power mad, and the right call for a regulator that will need every spare calorie for its mammoth battle against the broadband industry duopoly.

Filed Under: do not track, edge providers, fcc, information services, privacy, section 706, title i
Companies: consumer watchdog, google facebook

Complaint To FTC Says It’s 'Deceptive' For Google To Not Recognize 'Right To Be Forgotten' In US

from the what-the...? dept

If you want an understanding of my general philosophy on business and economics, it's that companies should focus on serving their customers better. That's it. It's a very customer-centric view of capitalism. I think companies that screw over their customers and users will have it come back to bite them, and thus it's a better strategy for everyone if companies focus on providing good products and services to consumers, without screwing them over. And, I'm super supportive of organizations that focus on holding companies' feet to the fire when they fail to live up to that promise. Consumerist (owned by Consumer Reports) is really fantastic at this kind of thing, for example. Consumer Watchdog, on the other hand, despite its name, appears to have very little to do with actually protecting consumers' interests. Instead, it seems like some crazy people who absolutely hate Google, and pretend that they're "protecting" consumers from Google by attacking the company at every opportunity. If Consumer Watchdog actually had relevant points, that might be useful, but nearly every attack on Google is so ridiculous that all it does is make Consumer Watchdog look like a complete joke and undermine whatever credibility the organization might have.

In the past, we've covered an anti-Google video that company put out that contained so many factual errors that it was a complete joke (and was later revealed as nothing more than a stunt to sell some books). Then there was the attempt to argue that Gmail was an illegal wiretap. It's hard to take the organization seriously when it does that kind of thing.

Its latest, however, takes the crazy to new levels. John Simpson, Consumer Watchdog's resident "old man yells at cloud" impersonator, recently filed a complaint with the FTC against Google. In it, he not only argues that Google should offer the "Right to be Forgotten" in the US, but says that the failure to do that is an "unfair and deceptive practice." Really.

As you know by now, since an EU court ruling last year, Google has been forced to enable a right to be forgotten in the EU, in which it will "delink" certain results from the searches on certain names, if the people argue that the links are no longer "relevant." Some in the EU have been pressing Google to make that "right to be forgotten" global -- which Google refuses to do, noting that it would violate the First Amendment in the US and would allow the most restrictive, anti-free speech regime in the world to censor the global internet.

But, apparently John Simpson likes censorship and supporting free speech-destroying regimes. Because he argues Google must allow such censorship in the US. How could Google's refusal to implement "right to be forgotten" possibly be "deceptive"? Well, in Simpson's world, it's because Google presents itself as "being deeply committed to privacy" but then doesn't abide by a global right to be forgotten. Really.

“The Internet giant aggressively and repeatedly holds itself out to users as being deeply committed to privacy. Without a doubt requesting the removal of a search engine link from one’s name to irrelevant data under the Right To Be Forgotten (or Right to Relevancy) is an important privacy option,” Consumer Watchdog’s complaint said. “Though Google claims it is concerned about users’ privacy, it does not offer U.S. users the ability to make such a basic request. Describing yourself as championing users’ privacy and not offering a key privacy tool – indeed one offered all across Europe – is deceptive behavior.”

That's, uh, not how this all works. In his complaint to the FTC, Simpson's theory is laid out in all its kooky nuttiness. Basically, because in the past we didn't have technology, and things would get forgotten thanks to obscurity -- and because Google claims to support privacy, it must magically pretend that we still live in such an age, and agree to forget stuff people want it to forget. He'd also, apparently, like Google to get off his lawn.

Here is why the Right To Be Forgotten – or Right of Relevancy – is so important to protecting consumers’ privacy in the digital age: Before the Internet if someone did something foolish when they were young – and most of us probably did – there might well be a public record of what happened. Over time, as they aged, people tended to forget whatever embarrassing things someone did in their youth. They would be judged mostly based on their current circumstances, not on information no longer relevant. If someone else were highly motivated, they could go back into paper files and folders and dig up a person’s past. Usually this required effort and motivation. For a reporter, for instance, this sort of deep digging was routine with, say, candidates for public office, not for Joe Blow citizen. This reality that our youthful indiscretions and embarrassments and other matters no longer relevant slipped from the general public’s consciousness is Privacy By Obscurity. The Digital Age has ended that. Everything – all our digital footprints – are instantly available with a few clicks on a computer or taps on a mobile device.

[....]

Google’s anti-consumer behavior around privacy issues is deceptive. The Internet giant holds itself out to be committed to users’ privacy, but does not honor requests that provide a key privacy protection. Google explains: “We know security and privacy are important to you – and they are important to us, too. We make it a priority to provide strong security and give you confidence that your information is safe and accessible when you need it. We’re constantly working to ensure strong security, protect your privacy, and make Google even more effective and efficient for you.” Recently Google said, “Protecting the privacy and security of our customers’ information is a top priority, and we take compliance very seriously.” In its Privacy & Terms Technologies and Principles Google claims, “We comply with privacy laws, and additionally work internally and with regulators and industry partners to develop and implement strong privacy standards… People have different privacy concerns and needs. To best serve the full range of our users, Google strives to offer them meaningful and fine-gained choices over the use of their personal information.”

In other words the Internet giant aggressively and repeatedly holds itself out to users as being deeply committed to privacy. Without a doubt requesting the removal of a search engine link from one’s name to irrelevant data under the Right To Be Forgotten (or Right to Relevancy) is an important privacy option. Though Google claims it is concerned about users’ privacy, it does not offer U.S. users the ability to make this basic request. Describing yourself as championing users’ privacy while not offering a key privacy tool – indeed one offered all across Europe – is deceptive behavior.

This is an absolutely insane interpretation of "deceptive." A company that supports user privacy is not being deceptive just because its definition of privacy doesn't match your crazy definition. It's just a different policy. If Google had flat out said that it would support a "right to be forgotten" in the US and then refused to process any requests, that would be deceptive. But accurately stating what the company does is not deceptive, no matter what Simpson seems to think.

What about the "unfair" part of "unfair and deceptive"? I honestly can't summarize the logic because there is none. Apparently, some people might not like what searches on their name turn up, and that's bad and thus... unfair?

Not offering Americans a basic privacy tool, while providing it to millions of users across Europe, is also an unfair practice. Acts or practices by a business are unfair under Section 5 of the Federal Trade Commission Act if they cause or are likely to cause substantial injury to consumers that consumers cannot reasonably avoid themselves and that is not outweighed by countervailing benefits to consumers or competition.6 Here are some examples of people who have been harmed by Google’s refusal to honor Right of Relevancy or Right To Be Forgotten removal requests in the United States. Clearly there is no countervailing benefit in continuing to link to the items from search results. Consider these examples:

• A young California woman was decapitated in a tragic auto accident. Photos from the grisly accident scene were wrongfully leaked by California Highway Patrol officers and posted to the Internet. A search on her name still returns the horrible photographs.
• A guidance counselor was fired in 2012 after modeling photos from 20 years prior surfaced. She was a lingerie model between the ages of 18-20, and she had disclosed her prior career when she first was hired. Despite this, when a photo was found online and shown to the principal of her school, she was fired.

I don't see how any of this is "protecting consumers." It's seems quite the opposite, actually. It seems to be assuming that the public is made up of pure idiots who can't ever figure out context or understand that sometimes bad things happen. But that's not true. People learn and adapt and adjust to new technologies, even as people like John Simpson fear them. When cameras first started becoming popular they were banned from beaches because people might take photographs of other people there. But people grew up and realized that wasn't destroying anyone's privacy. Simpson has this weird infatuation not with protecting consumers, but with censoring the internet to keep the public from knowing factual information, because apparently he thinks the public can't handle it.

Last week, on On The Media, host Bob Garfield pointed out to Simpson how ridiculous all of this was, and Simpson doesn't have a single reasonable response. Garfield points out that public information, even embarrassing public information, is, by definition, not private information, and thus there's no privacy violation here. And all Simpson can do is pull his nostalgia gig about how things used to be different when people would forget your embarrassing things in the past. But that doesn't answer the question at all. It just makes Simpson seem totally out of touch with the modern world.

Filed Under: consumers, deceptive, ftc, john simpson, privacy, right to be forgotten, unfair
Companies: consumer watchdog, google

Privacy Groups Want The Government To Investigate Google Over The NSA's Hacking

from the really-now? dept

The Electronic Privacy Information Center (EPIC) has this unfortunate habit of making absolutely insane arguments that really destroy its credibility elsewhere. At times it does good work in responding to egregious violations of privacy, but at times it just makes itself look like a total kook organization -- such as when it sued the FTC for not investigating Google over EPIC's ridiculously bizarre claims of privacy violations just because Google changed its privacy policy. EPIC is never one to let go, and its latest self-defeating strategy is to demand the FTC investigate Google and Yahoo... for letting the NSA hack their data centers.

As was widely discussed last month, the NSA had found a backdoor way to effectively hack into the networks that connect Google and Yahoo's data centers, allowing the NSA to pull down all sorts of data, without either company knowing about it. It seems quite reasonable to go after the NSA and the US government about this, but in the twisted mind of EPIC, this is a violation of Google's privacy policy. I'm not joking. EPIC, along with a number of other privacy groups (some of whom focus nearly their entire efforts on trying to make Google less useful) have sent a ridiculous letter to the FTC. It points out that the FTC has previously ordered these companies to "adopt comprehensive privacy programs," and then argues that those privacy programs have been violated because of the NSA hacks.

These companies have represented that user data is only disclosed to law enforcement subject to a lawful process. But there is every reason now to believe that millions of consumer records were unlawfully obtained by the National Security Agency. Of course, once the records are in possession of these firms there is nothing that users can do to limit the subsequent improper release or avoid the misuse. And there is clearly no benefit to users in the improper and unlawful disclosure of their personal information.

[....] Finally, the Commission should pursue this investigation because it routinely holds itself out as the defender of consumer privacy in the United States. It is inconceivable that when faced with the most significant breach of consumer data in U.S. history, the Commission could ignore the consequences for consumer privacy.

Talk about taking a blame the victim approach. EPIC, CDD, Consumer Watchdog, Privacy Rights Clearinghouse, Consumer Federation of America, Public Citizen (?!?) and the Privacy Times, who all signed onto this letter look ridiculous. They're saying that the FTC needs to investigate Google and Yahoo for violations of their privacy policies, because the NSA hacked into their data centers. Go after the NSA and the rest of the US government for doing that. But blaming the companies who didn't even know about this isn't just ridiculous, it's counterproductive.

These groups are so focused on trying to do anything to attack Google that they're making the situation worse. Based on this kind of ridiculous attack, pretty much any company is now better off making their privacy policies worse. The crux of EPIC's stupid argument is that this violates their privacy policies. You know the best way to avoid that? Change your privacy policy so that revealing as much information as possible isn't a violation. Furthermore, blaming the hacking victims for the hack takes the attention away from where it belongs: on the NSA and the administration for doing this in the first place.

Given that the FTC and the NSA are both a part of the administration, it's not impossible to imagine a scenario where the only ones actually punished for hacking into these data centers are Google and Yahoo, while the NSA gets away with the whole thing. Is that really what these organizations want? EPIC, CDD and Consumer Watchdog in particular like to set themselves up as "defending consumers." But they're doing the opposite here. They're inevitably making life worse for consumers. Hopefully, as it has in the past, the FTC sees through these ridiculous arguments.

Filed Under: datacenters, ftc, infiltration, nsa hacking, nsa surveillance, privacy, privacy policies
Companies: consumer federation of america, consumer watchdog, epic, google, privacy rights clearinghouse, privacy times, public citizen, yahoo

How Is Consumer Watchdog 'Helping' When It's Trying To Destroy Services Consumers Find Useful

from the get-away-from-my-email dept

A few weeks ago, we wrote about a troubling ruling by Judge Lucy Koh, in which she accepted the argument pushed by a group called Consumer Watchdog (which is basically an anti-Google organization focused on misrepresenting Google at every opportunity) that Google's Gmail conducted some sort of illegal wiretap when its computers scanned incoming emails to put relevant ads next to it. As we noted, if having a computer scan your email is illegal wiretapping, then pretty much any anti-spam software is also an illegal wiretap. The whole concept is really ridiculous. If you send me a mail, you are granting permission for me to view that mail however I wish to view it -- and if that includes reading it via Gmail and having its automated computers put ads next to it, then that's the price you pay.

Unfortunately, with Judge Koh unwilling to recognize this basic concept, it's now open season on email providers. A very similar lawsuit has now been filed against Yahoo, and I'm sure it won't be the last one.

The whole situation is screwed up beyond belief. Eric Goldman's comments on the original lawsuit against Google are completely on point here. Not only does this ruling show how totally screwed up ECPA (the Electronic Communications Privacy Act) is, but the whole thing may lead to making just about everyone a hell of a lot worse off. Goldman notes why Judge Koh's ruling is almost certainly incorrect under the law: algorithmic processing of content isn't considered interception under the law; the ruling could certainly apply to anti-spam/anti-virus/spell-checking services and more; email providers have been doing this for ages, so where's the statute of limitations; and what actual harm was caused to people who had their email scanned?

But he concludes it with this plea for sanity to the likes of Consumer Watchdog:

PLEASE PLEASE PLEASE don't take away my Gmail account. It has materially improved my life, and I hope and pray that I'm not downgraded into some second-rate email account due to this litigation.

Indeed. It leaves me wondering what "consumers" Consumer Watchdog is looking out for, because it's not me, and it doesn't appear to be the many many millions of people who use a variety of different webmail services quite happily -- because it improves their lives. I don't want a group (especially one prone to blatantly misrepresenting reality) to break email for me. That's not being a watchdog, it's being an authoritarian dipshit, arguing that millions of people around the world should be worse off because this one group thinks it knows best.

Filed Under: email, gmail, privacy, wiretapping
Companies: consumer watchdog, google, yahoo

Press Suckered By Anti-Google Group's Bogus Claim That Gmail Users Can't Expect Privacy

from the no-expectation-of-accuracy dept

Okay, so as a bunch of folks have been sending over today, there's been a bit of a furor over a press release pushed out by Consumer Watchdog, a hilariously ridiculous group that has decided that Google is 100% pure evil. The "story" claims that Google has admitted in court that there is no expectation of privacy over Gmail. This is not actually true -- but we'll get to that. This story is a bit complex because the claims in most of the news coverage about this are simply wrong -- but I still think Google made a big mistake in making this particular filing. So, first, let's explain why the coverage is completely bogus trumped up bullshit from Consumer Watchdog, and then we'll explain why Google still shouldn't have made this filing.

First off, you may recall Consumer Watchdog from previous stunts such as a putting together a hilariously misleading and almost 100% factually inaccurate video portrayal of Eric Schmidt, which was all really part of an effort to sell more copies of its founder's book (something the group flat out admitted to us in an email). They're not a consumer watchdog site -- they're a group that makes completely hogwash claims to try to generate attention on a campaign to attack Google.

The press release from Consumer Watchdog fits along its typical approach to these things: take something totally out of context, put some hysterical and inaccurate phrasing around it, dump an attention-grabbing headline on it and send it off to the press. In this case, it claimed that Google had said in a court filing that you have no expectation of privacy with Gmail. That got a bunch of folks in the press to bite with wildly inaccurate headlines:

• CNET: Google filing says Gmail users have no expectation of privacy
• Time: Google Says Gmail Users Have ‘No Legitimate Expectation of Privacy’
• The Guardian: Google: Gmail users shouldn't expect email privacy
• Gizmodo: Google: Non-Gmail Users Have No Legitimate Expectation of Privacy
• Huffington Post: Google: Email Users Can't Legitimately Expect Privacy When Emailing Someone On Gmail
• Business Insider: GOOGLE: If You Send To Gmail, You Have 'No Legitimate Expectation Of Privacy'

The first three of those headlines are simply flat-out factually incorrect. I mean, not even close, and it's fairly incredible that those come from the three more "established" or "mainstream" news publications. The last three are slightly more correct, but still completely miss the point. The best debunking of these claims so far comes from Nilay Patel at the Verge who breaks down the details. The filing, which is from over a month ago, is a response to an absolutely, monumentally bogus class action lawsuit filed against Google, arguing, hilariously, that it's a violation of wiretap laws to put ads next to emails based on the text of those emails. No, seriously.

As Patel points out, first, if you put the argument back into context, it's not even about Gmail users -- as the top three headlines above falsely state. Google is arguing that non-Gmail users are consenting to the fact that when they send an email, the ISPs who receive the email will automatically process them. This should not be controversial. At all. Without that concept email doesn't work. As the filing states (which the folks hyping this ignore):

Non-Gmail users who send emails to Gmail recipients must expect that their emails will be subjected to Google's normal processes as the [email] provider for their intended recipients.

In other words, there's no "there" there. All Google was arguing was that courts have held that if you are using a communication service, there's a perfectly reasonable (in fact, expected) recognition that the service provider will have the right to process some information about that communication. In the context of the case that Google cites, the infamous Smith v. Maryland, the argument is that the business provider is reasonably expected to be able to track the user's activity. That's not controversial. The controversial step that Smith v. Maryland then makes is to argue that because the service provider has a right to that basic information it means that the end user has no expectation of privacy with regards to the government getting access to the same info. That's the problem with Smith v. Maryland -- the failure to recognize that massive difference between me (1) consenting to let my phone company record who I make phone calls to in exchange for the ability to make calls and (2) the expectation that it's okay for the government to collect that very same info without a warrant.

Google's citation of Smith v. Maryland is to make the first half of that argument -- showing that courts recognize the obvious: that when you use a communication service, there are certain aspects of information that you know the service provider is going to have access to. Without that you don't have email, or (realistically speaking) the internet.

So, this is all much ado about nothing.

Except... I still think it was a mistake for Google to use this legal argument, and I'm somewhat surprised Google's legal team let this go through in place. First, Google does not need this citation to make this point. There are other cases that can make this point effectively without touching on the government spying aspect. But, the real reason why this is a mistake is that Google has given fairly strong indications in recent statements that it's willing to fight back against certain government requests for user info (and that it's done so in the past). In those cases, the government is absolutely going to cite Smith v. Maryland as its evidence that users have no expectation of privacy in their communications and now they'll also point out that Google cited the case approvingly. Google will want to argue that Smith v. Maryland is outdated law and was decided wrongly and/or in a different time under a different technology ecosystem. And this is a very, very strong argument that has a good chance of winning. But the ability of the government to point out that Google has, in other cases, cited the Smith precedent approvingly -- even if it was really only part of the Smith precedent -- could undermine their arguments against Smith in future cases down the road.

Either way: the freakout here is totally manufactured by a bogus, laughable group that is spreading ideas that would do massive harm to the internet based on a near total ignorance of how things work. Yes, people are on edge given the NSA revelations, but this "gotcha" is no "gotcha" at all. It's just more evidence of the sheer duplicity of Consumer Watchdog. That said, it was still short-sighted for Google to make this claim in a filing. They didn't need the citation, and while it may help them win this ridiculous class action lawsuit, it may come back to bite them down the road in more important cases.

Filed Under: 3rd party doctrine, consumer watchdog, email, fearmongering, government, hype, journalism, privacy, smith v. maryland, surveillance
Companies: consumer watchdog, google

Consumer 'Watchdog' Anti-Google Video Just Part Of A Stunt To Sell Books?

from the who's-watching-those-consumers dept

There was all sorts of news coverage recently about the group Consumer Watchdog creating a video that mocked Google's Eric Schmidt for not caring about your privacy -- though, which did so by getting all sorts of basic facts wrong and while relying on the "evil" Google Analytics for its own site (though, the group claims it's been trying to get rid of it, and has tried to spin the story into a claim that shows "how hard it is to escape Google on the Internet." Actually, it's not that hard at all. The whole thing seemed pretty silly, and clearly a stupid promotional stunt.

It seems that folks associated with Consumer Watchdog's Jamie Court are perfectly willing to admit that the whole thing is a crass stunt to help Jamie sell more of his new book. They've sent over a letter to us, hyping up Court's book, offering to send us a copy, and linking the recently released book to the "stunt" in Times Square, which they blatantly admit was a stunt. So, now, who's going to watch over Consumer Watchdog to make sure it's not engaged in questionable motives in its own activities? I'm all for people actually looking out for consumer rights, but sometimes I wonder who appointed these folks as our "watchdogs?"

Filed Under: eric schmidt, jamie court, privacy, stunts
Companies: consumer watchdog, google