Consumer Law & Policy Blog

Is Your Mobile Phone Information for Sale?

by Jeff Sovern

When mobile phones have GPS devices, as many smart phones do, mobile phone providers can track their customers wherever they take their phones (providers can also track phones lacking a GPS, but less precisely).  For an example, go here to see how Deutsche Telefon recorded the location of one of its customers for a six-month period.  Now Verizon has begun selling that data, as reported in the Wall Street Journal (behind a paywall).  According to the article, Verizon won't sell data about individuals, but only aggregated data.  I wonder how much security that really offers, especially since deidentified data can sometimes be re-identified.  The article also notes that one customer for the data, the Phoenix Suns, is using the data to learn where the people attending its games live.  Of course, the Suns could just ask their fans, but then the fans would know that the Suns have that information or might refuse to provide it.  Other carriers are going even further.  According to the article, a European company plans to let stores know what web sites consumers are browsing while in the stores, as well as demographic information. 

Hoofnagle & Whittington Paper on Free Offers

The prolific Chris Jay Hoofnagle of Berkeley and Jan Whittington of the Department of Urban Design and Planning, University of Washington have written The Price of 'Free': Accounting for the Cost of the Internet's Most Popular Price, forthcoming in 61 UCLA Law Review (2014). Here's the abstract:

Offers of “free” services abound on the internet. These offers cause a conundrum for consumer protection. Courts are apt to discount users’ claims against such services; one recently held that users are not “consumers” for purposes of California consumer protection law. Industry leaders push to monitor users ubiquitously, an imperative driven by the desire to fund “free” content. Policymakers struggle with this imperative and weigh it against vague consumer preferences for privacy, which users seem to happily abrogate to get the next new free service. These problems, we argue, flow from attention to the price of free offers instead of their costs.

To elucidate these costs, we apply a transaction cost economic (TCE) approach to “free” transactions with personal information. TCE provides a framework for analyzing these exchanges even where the price of the product seems to be zero. “Freemium” offers employ a form of cross-subsidy, a technique widely accepted in infrastructure industries, and a basic tool used to support the equitable delivery of products and services with the understanding that some have more willingness and ability to pay than others. However, we argue that information intensive companies misuse “free” to promote products and services that are packed with non-pecuniary costs.

Current governance structures allow firms to collect valuable information ex ante and monetize it ex post, despite consumer preferences for privacy and the impression, given to the consumer, that the transaction would be “free.” Some firms obligate consumers to divulge personal information in order to try a “free” sample of their online product. Other firms, such as social networking services, would not have a product if not for the personal information consumers create and upload. In both business models, what may begin as ex ante misalignment between the interests of the firm and consumer can become ex post maladaptation when the firm realizes the financial gains possible from monetizing the consumer’s personal information. Targeted advertising, switching costs, the cost to consumers to try to monitor the actions of the firm, viral patterns of distribution of consumers personal information amongst firms, and disincentives that lead firms to underinvest in information security, are among the contractual hazards that raise transaction costs for consumers.

We then turn to potential governance structures to curb the incentives of firms to raise transaction costs for consumers. One source for legal intervention is the Federal Trade Commission’s “Free Guidelines.” These guidelines will be reviewed in 2017, offering an opportunity to reconsider the fairness of free offers conditioned on provision of personal information. As currently written, they do not directly address exchanges for personal information. Still, two remedies flow from the FTC Guide: clearer disclosures that personal information forms the basis of the transaction, and the requirement to establish a regular price before marketing a service as free.

While behavioral economics may support an outright ban of free offers because of their biasing effects, TCE suggests other strategies for reform, focused upon placing business risk more firmly in the hands of businesses. These interventions go beyond the traditional transparency and accuracy requirements suggested by privacy law. They involve eliminating the avoidable costs that arise for consumers when compelled to provide personal information in order to try a “free” product, recognizing the role consumers play in the production and business of social networking services, and requiring each third party interested in access to a consumer’s personal information to obtain opt-in per consumer through full disclosure with terms of service and privacy policies.

 

 

An Infographic (and ad) About Google and Privacy.

Here. (HT: Michael Romero)

A Video That Seems Not to Have Anything to Do with Consumer Law--But Does

Here.  And it's less than three minutes.

Interesting Column by The Nation's Rick Perlstein on Fine Print Contracts

Here.  And here's the beginning:

Imagine you’ve clicked on your computer screen to accept a contract to purchase a good or service—a contract, you only realize later, that’s straight out of Kafka. The widget you’ve bought turns out to be a nightmare. You take to Yelp.com to complain about your experience—but lo, according to the contract you have given up your free speech rights to criticize the product. Let’s also say, in a fit of responsibility, (a bit fantastic, I know) you happened to have printed out this contract before you “signed” it, though you certainly hadn’t read through the thing, which is written, literally, on a “twenty-seventh grade” reading level. Well, you read it now (perhaps with the help of a friend who’s completed the twenty-seventh grade). And you see that there was nothing in the contract limiting your right to free speech at the moment you signed it. That part was added later. Your friend with the twenty-seventh-grade education points to the clause in the contract in which you’ve granted this vendor-from-hell the right to modify the terms of the contract, unilaterally, at any time into the vast limitless future.

Others, you realize, must have had the same problem with this lemon of a product. You begin canvassing the possibility of a class action suit. But you guessed it: the contract you agreed to waived your right to class action as well.

You study this gorgon of a text to figure out what other monstrosities lie within—and discover this: you’ve waived away your right to the privacy of certain information, too. Shocked, you resolve: never again. You realize that when you buy a product or service, you’re also buying the contract that goes with it. So you’ll comparison shop. You think about how, when you rent a car, you have to sign and initial all that contract language you have no time to read with eight people behind you in line at the airport. So you call all the big rental car companies to get copies of their standard boilerplate contracts to read at your leisure—but not one would e-mail you the contract. You’re told it just isn’t done.

FTC Issues Staff Report on the Use of Mobile Payments

Here.  The report addresses issues of dispute resolution (e.g., for unauthorized charges or fraud), security, and privacy, among others.

FTC Pursues Phone Text Spammers

The Times report is here.  An excerpt:

The messages, which typically promise gift cards to national chain stores or other prizes, are sent to random phone numbers and usually direct recipients to a Web site where they are asked for personal information like Social Security numbers or credit card numbers, agency officials said.       

Rarely, if ever, do consumers receive any actual reward, said C. Steven Baker, the commission’s Midwest region director. Instead, the Web sites often take users through multiple screens that ask them for more detailed information or entice them to sign up for free trials of products, then charge them for shipping and handling.

* * *

Roughly 60 percent of mobile phone users have received one or more spam text messages in the last year, [Baker] said, and about 15 percent clicked on the link included in the message.

Federal law  bars the use of automated dialing machines to send text spam, which as a practical matter means that such spam is illegal, because it takes so much time to send texts manually that text spam becomes uneconomic. 

Porat & Strahilevitz Paper: Personalizing Default Rules and Disclosure with Big Data

Ariel Porat of Tel Aviv University and Chicago and Lior Strahilevitz of Chicago have written Personalizing Default Rules and Disclosure with Big Data.  Here's the abstract:

This paper provides the first comprehensive account of personalized default rules and personalized disclosure in the law. Under a personalized approach to default rules, individuals are assigned default terms in contracts or wills that are tailored to their own personalities, characteristics, and past behaviors. Similarly, disclosures by firms or the state can be tailored so that only information likely to be relevant to an individual is disclosed, and information likely to be irrelevant to her is omitted. The paper explains how the rise of Big Data makes the effective personalization of default rules and disclosure far easier than it would have been during earlier eras. The paper then shows how personalization might improve existing approaches to the law of consumer contracts, medical malpratice, inheritance, landlord-tenant relations, and labor law.

The paper makes several contributions to the literature. First, it shows how data mining can be used to identify particular personality traits in individuals, and these traits may in turn predict preferences for particular packages of legal rights. Second, it proposes a regime whereby a subset of the population (“guinea pigs”) is given a lot of information about various contractual terms and plenty of time to evaluate their desirability, with the choices of particular guinea pigs becoming the default choices for those members of the general public who have similar personalities, demographic characterics, and patterns of observed behavior. Third, we assess a lengthy list of drawbacks to the personalization of default rules and disclosure, including cross-susidization, strategic behavior, uncertainty, stereotyping, privacy, and institutional competence concerns. Finally, we explain that the most trenchant critiques of the disclosure strategy for addressing social ills are really criticisms of impersonal disclosure. Personalized disclosure not only offers the potential to cure the ills associated with impersonal disclosure strategies, but it can also ameliorate many of the problems associated with the use of personalized default rules.

 

 

 

Sad News: Privacy Pioneer Alan Westin Dies

More here.  His work informed my writing and the work of countless others, and as it happens, as an undergraduate, I was fortunate enough to take a class with him .

US vs. the EU on Privacy

by Jeff Sovern

Last Sunday, the Times published an article, Data Protection Laws, an Ocean Apart, which quoted the Commerce Department's general counsel, Cameron F. Kerry, as saying “The sum of the parts of U.S. privacy protection is equal to or greater than the single whole of Europe.”  This is a remarkable assertion, given how protective Europe is of privacy.  To take only one example, the EU provides that a consumer’s personal data may be used only if the consumer has unambiguously consented.  Ironically, the previous Thursday, the Times had reported that EyeEm, a Facebook app, shares the photos people view with others without clearly disclosing that it will do so (“An App That May Overshare on Facebook,”Jan. 31).  I wonder if Mr. Kerry is eager to have the pictures he has looked at on the web displayed to his Facebook friends without his knowledge or consent.  The EU obviously prohibits EyeEm's conduct; whether American law prohibits it depends on whether the FTC views it as unfair in violation of the FTC Act, or whether it violates state UDAP statutes, which is not at all clear. 

American privacy rules may appeal to those who want to profit from selling consumers’ personal information, but the EU approach offers consumers far more protection.