Consumer Law & Policy Blog

Joshua Fairfield: Is Do-Not-Track Enforceable In Contract?

 

Joshua Fairfield

 of Washington and Lee has written 'Do-Not-Track' as Contract,14 Vanderbilt Journal of Entertainment and Technology Law 101 (2012).  Here's the abstract:

Support for enforcement of a do-not-track option in browsers has been gathering steam. Such an option presents a simple method for consumers to protect their privacy. The problem is how to enforce this choice. The Federal Trade Commission (FTC) could enforce a do-not-track option in a consumer browser under its section 5 powers. The FTC, however, currently appears to lack the political will to do so. Moreover, the FTC cannot follow the model of its successful do-not-call list since the majority of Internet service providers (ISPs) assign Internet addresses dynamically — telephone numbers do not change, whereas Internet protocol (IP) addresses may vary.

This Article explores whether, as a matter of contract law, a browser do-not-track option is enforceable against a corporation, and concludes that it is. The emerging standard of online consent has been whether a party proceeds with a transaction after the counterparty informs the party of the terms of the contract. Adhesion contracts in electronic contexts have bound consumers for over a quarter century in precisely this manner.

This Article argues that what applies to consumers should apply to corporations. When a consumer expresses her preference, in the very first exchange between the consumer and corporate computers, for the corporation not to track her information, the company is free to refuse the transaction if it does not wish to continue on the consumer’s terms. This Article therefore proceeds in three broad parts. Part I introduces the current methods of corporate surveillance of consumers, which have reached dizzying heights. Part II discusses the law of e-commercial and mass-market contracts, which courts have held to bind consumers even on the merest fig leaf of a legal theory of consent. Part III proposes a solution: the answer is not to continue making consumers read more privacy policies on various websites, but instead to enforce the simple preferences that the consumer expresses once.

Whittington & Hoofnagle Paper: Unpacking Privacy's Price

 

Jan Whittington

 of the Department of Urban Design and Planning, University of Washington and

Chris Jay Hoofnagle

 of Berkeley Unpacking Privacy's Price, 90 North Carolina Law Review 1327 (2012).  Here's the abstract:

This article introduces a transaction cost economic framework for interpreting the roles consumers play in social networking services (“SNSs”). It explains why the exchange between consumers and SNSs is not simple and discrete, but rather a continuous transaction with atypical attributes. These exchanges are difficult for consumers to understand and come with costs that are significant and unanticipated. Under current structures of governance, there is no exit for consumers who wish to leave an SNS. In other contexts, similar transactions are bounded by tailored consumer protections. This article explains the need for tailored consumer protection in the SNS context. Specifically, we argue that a consumer right to rescind enrollment in an SNS, triggering a deletion of and ability to export information shared with the service, is appropriate given the skewed aspects of personal information transactions.

Hoofnagle, Urban, and Li on Mobile Payment Benefits and Privacy Concerns

Chris Jay Hoofnagle,

 

Jennifer M. Urban

 and

Su Li

, all of Berkeley have written Mobile Payments: Consumer Benefits & New Privacy Concerns.  Here's the abstract:

 

 

Payment systems that allow people to pay using their mobile phones are promised to reduce transaction fees, increase convenience, and enhance payment security. New mobile payment systems also are likely to make it easier for businesses to identify consumers, to collect more information about consumers, and to share more information about consumers’ purchases among more businesses. While many studies have reported security concerns as a barrier to adoption of mobile payment technologies, the privacy implications of these technologies have been under examined. To better understand Americans’ attitudes towards privacy in new transaction systems, we commissioned a nationwide, telephonic (wireline and wireless) survey of 1,200 households, focusing upon the ways that mobile payment systems are likely to share information about consumers’ purchases.

We found that Americans overwhelmingly oppose the revelation of contact information (phone number, email address, and home address) to merchants when making purchases with mobile payment systems. Furthermore, an even higher level of opposition exists to systems that track consumers’ movements through their mobile phones.

We explain some advantages of mobile payment systems, some challenges to their adoption in the United States, and then turn to our main finding: Americans overwhelming reject mobile payment systems that track their movements or share identification information with retailers. We then suggest a possible remedy for such information sharing: adapting provisions of California’s Song-Beverly Credit Card Act, which prohibits merchants from requesting personal information at the register when a consumer pays with a credit card, to mobile payments systems. Our survey results suggest that consumers would support limitations on information collection and transfer. Song-Beverly could be adopted to accommodate those who wish to share their transaction data.

 

Eric Goldman on Privacy Class Actions

 

Eric Goldman

 of Santa Clara has written The Irony of Privacy Class Action Litigation, 10 Journal of Telecommunications and High Technology Law (2012).  Here is the abstract:

In the past few years, publicized privacy violations have regularly spawned class action lawsuits in the United States, even when the company made a good faith mistake and no victim suffered any quantifiable harm. Privacy advocates often cheer these lawsuits because they generally favor vigorous enforcement of privacy violations, but this essay encourages privacy advocates to reconsider their support for privacy class action litigation. By its nature, class action litigation uses tactics that privacy advocates disavow. Thus, using class action litigation to remediate privacy violations proves to be unintentionally ironic. 

Study of Clickwrap/Privacy Policy Terms

 

Jay P. Kesan

,

Carol M. Hayes

, and

Masooda Bashir

, all of Illinois, have written Consumer Privacy Choices, Informed Consent, and Baseline Protections to Facilitate Market Transactions in the Cloud.  Here's the abstract:

So many of our daily activities now take place 'in the cloud,' where we use our devices to tap into massive networks that span the globe. Virtually every time that we plug in to a new service, the service requires us to click the seemingly ubiquitous box indicating that the user has read and agrees to the provider’s Terms of Service and Privacy Policy. If a user does not click on this box, he is denied access to the service. It is generally accepted that no one reads these agreements. They click accept, because otherwise they could not use the service of their choice, and these terms are typically almost entirely disregarded as a factor when services are chosen. If a user is asked why he does not read these terms, he might offer reasons like the dense legalese, or the length of these agreements.

However, not reading these agreements can have negative effects. Some agreements contain binding arbitration provisions, limiting the agreeing party’s avenues for redress if the provider wrongs him. When a user is not informed about the terms of a privacy policy, she may be unknowingly consenting to the disclosure of her information to third parties with whom she would not want to share her information. These agreements can also affect the agreeing party’s legal rights. The Department of Justice has argued that violating a website’s Terms of Service amounts to a violation of the Computer Fraud and Abuse Act. Additionally, agreeing to overbroad privacy policy terms could reduce a party’s protections under the Stored Communications Act and the Fourth Amendment.

As part of this work, we analyzed and categorized the terms of TOS agreements and privacy policies of several major cloud services to aid in our assessment of the state of user privacy in the cloud. Our empirical analysis showed that providers take similar approaches to user privacy, and were consistently more detailed when describing the user’s obligations to the provider than when describing the provider’s obligations to the user. This asymmetry, combined with these terms’ nonnegotiable nature, led us to conclude that the current approach to user privacy in the cloud is in need of serious revision.

Privacy and autonomy, values necessary for a free society, are threatened by the asymmetric terms and unawareness of parties agreeing to such terms. Based on analysis of the law, theories of privacy developed by scholars, findings of research into human-computer interaction, and an analogy to the ethical guidelines of informed consent followed by social science researchers, we propose the following modest but realistically achievable goals to advance user privacy in the cloud.

First, we suggest adopting a legal regime that requires companies to provide baseline protections for personal information and also take steps to enhance the parties’ control over their own data. We view data control as consisting of two parts: 1) data mobility, where consumers are assured the ability to move course-of-business data from one provider to a competing provider at will, without encountering lock-in problems due to formatting issues; and 2) data withdrawal, where consumers have the right to serve notice and takedown orders on entities that possess and use the consumer’s personal information against the consumer’s wishes.

Second, we argue that collectors and users of personal information in the cloud should be held to ethical guidelines mandating informed consent to facilitate informed contracting. Adopting an approach that is consistent with the informed consent standards required of social science researchers, we view informed consent as consisting of five elements: 1) disclosure, 2) competence, 3) comprehension, 4) voluntariness, and 5) agreement.

Third and finally, we propose that a multi-tiered approach to privacy be mandated by regulations, requiring companies to make heightened privacy protections available to consumers. By mandating choice, we are creating a market where consumers have meaningful choices regarding the level of privacy being afforded, and the existence of these privacy choices will facilitate market transactions. Ultimately, our goal with this piece is to apply established law and privacy theories to services in the cloud, and set forth a model for the protection of information privacy that recognizes the importance of informed users.

Times Article on Spam Texts and Smishing

by Jeff Sovern

Here.  This is a problem where the law did what it could before the issue became common; spam text is outlawed both under regulations adopted under the federal CAN-SPAM Act (as long as the cell phone has a unique electronic address, which I gather they all do) and the federal TCPA (if the texts are sent via autodialer, which they likely are as it would be too time-consuming to send text spam from phones manually by entering in the number and text).  Yet the federal laws have not prevented bad actors from sending spam texts.  This seems like an area, like conventional email spam, where a technical solution is going to be more effective than one crafted by law-makers.  Smishing, by the way, is the text equivalent of phishing emails.

Times Article: How Companies Learn Your Secrets

by Jeff Sovern

I've been meaning to blog about an interesting article in The Sunday Times Magazine of a couple of weeks ago with the above-captioned headline.  The article describes how Target wanted to know when women were in the second trimester of a pregnancy, so it could beat other retailers in selling them baby products.  Target eventually noticed that during the second trimester, women tended to buy certain products.  Accordingly, when Target noticed particular women buying those products, it sent them ads for pregnancy-related products. Some people were unhappy about receiving such ads from a company they had not told they were pregnant, and so Target instead started sending pregnant women circulars with some pregnancy-related products and some unrelated products (e.g., a lawnmower or wine glasses) to create the illusion that Target did not know about the pregnancy and it was just coincidence that the women were receiving such ads for pregnancy-related products.  It appears that these circulars led to a substantial increase in sales.

At least two things are troubling about this practice.  The first is the privacy invasion: Target knows when you're pregnant, even though you haven't told it so.  The second is the deception: Target wants to keep you from realizing that it knows when you're pregnant and so it engages in conduct which is likely to mislead you into thinking it doesn't know that you're pregnant.  Target clearly understood that some consumers found its behavior objectionable and so took steps to keep them from realizing the truth.  It's ironic: Target has learned something about its customers that they would rather it not know--that they are pregnant--and Target doesn't want the customers to know what it knows.  Target is invading its customers' privacy while protecting its own secrecy. To put it in terms of the FTC's standard for deception, Is that likely to mislead the consumer acting reasonably under the circumstances into thinking Target doesn't know they're pregnant?

James Nehf on the FTC's Proposed Framework for Online Privacy Protection

James P. Nehf  of Indiana, who has made significant contributions to the privacy literature in the past, has written The FTC's Proposed Framework for Privacy Protection Online: A Move Toward Substantive Controls or Just More Notice and Choice?, 31 William Mitchell Law Review 1727 (2011).  Here's the abstract:

The FTC released a "proposed framework" for privacy protection late in 2010. While the new framework made headlines by calling for a "do not track" list that consumers could use to avoid being tracked online, most of the framework continues to rely heavily on a notice and choice regime whereby consumers will be expected to make privacy decisions in market transactions (e.g., notice and opt-out opportunities). This paper explains why this approach is not likely to lead to enhance privacy protection in Internet transactions in the years to come.

Paper on data Breaches and Litigation

Sasha Romanosky

 of Carnegie Mellon University - Heinz College of Information Systems and Public Policy,

David A. Hoffman

of Temple and the Cultural Cognition Project at Yale Law School, and

Alessandro Acquisti

 of Carnegie Mellon University - H. John Heinz III School of Public Policy and Management have written Empirical Analysis of Data Breach Litigation.  Here's the abstract:

Legal privacy scholarship typically emphasizes the various ways that plaintiffs fail when bringing legal actions against entities when their personal information is lost or stolen. However this scholarship often considers only a small set of published judicial opinions from large-scale data breaches. And so, little is actually known about the characteristics and disposition of a representative set of data breach lawsuits. Using a unique sample of anually-collected data from Westlaw and PACER, we analyze the court dockets of over 200 federal data breach lawsuits from 1998 to 2011, making this, to our knowledge, the first empirical examination of data breach litigation. We use discrete outcome regression models to estimate the probability that a data breach will result in a lawsuit, and the probability that, once filed, the case will reach settlement. We find that breaches resulting from the unauthorized disclosure or disposal of personal information are 6.9% more likely to result in lawsuit, relative to breaches caused by lost or stolen hardware, whereas breaches caused by cyber-attack are only 2.9% more likely to result in lawsuit. These results suggest that plaintiffs respond more to the careless or negligent handling by a firm of their personal information, than to the firm’s inability to withstand a cyber-attack or misfortune of losing a laptop. However, while these properties may explain the probability of lawsuit, we find that breach characteristics (size, cause and types of information lost) do not significantly predict the outcome of a data breach lawsuit. Instead, the probability of settlement appears to be driven by the presence of actual financial loss, and class certification.

 

More on Finding Out What Others Know About Us

Here's my letter in today's Times, following up on Saturday's post (I'm happy it mentions the blog):

Re “It’s Tracking Your Every Move, and You May Not Even Know” (front page, March 26): You report that cellphone companies seldom disclose what information they collect about consumers. In fact, cellphone companies are not unique in that respect.

Your credit card company, landline phone company, grocery store (where you may have a discount card that enables the store to collect information about your purchases), Internet service provider and many other businesses may all have information about you.

Are you aware, except in general ways, of what they know about you?

Because Congress forced credit bureaus to make such information available to consumers, we can learn what credit reporting agencies have in their records about us. Unless legislators take similar steps concerning other businesses, we are unlikely to discover the contents of their files on us.

JEFF SOVERN
Jamaica, Queens, March 26, 2011

The writer is a professor at St. John’s University School of Law and co-coordinator of the Consumer Law and Policy Blog.