Google, Microsoft, Yahoo and AOL back US 'consumer privacy bill of rights'
Tech giants support Obama administration's plan to issue voluntary guidelines and commit to 'Do Not Track' technology
Google, Microsoft, Yahoo and AOL say they will sign up to a "consumer privacy bill of rights", announced on Thursday by the Obama administration in a move that would bring US law closer to European data protection principles.
The idea would bring stronger privacy protections for consumers, as mobile gadgets, internet services and other tools get better at tracking what you do and where you go.
Administration officials outlined their proposal on Thursday and urged technology companies, consumer groups and others to jointly craft new protections. Such guidelines would initially be voluntary for companies, but those that agree to abide by them could be subject to sanctions for any violations.
Separately, the US Federal Trade Commission - which acts as a consumer watchdog - recommended the creation of a "Do Not Track" tool to let consumers curb advertisers from studying their online activity to target ads. Google was among those which said it would incorporate it into its browser, Chrome.
In announcing support for the Obama administration's privacy safeguards, the companies - responsible for delivering nearly 90% of targeted advertisements - also committed to adopting a technology called "Do Not Track" which will start being built into web browsers later this year.
"As the internet evolves, consumer trust is essential for the continued growth of the digital economy," Obama said in a statement. "That's why an online privacy bill of rights is so important. For businesses to succeed online, consumers must feel secure."
The effort comes as companies have found more sophisticated ways to collect and combine data on your interests and habits. Beginning next week, for instance, Google will start merging data it collects from email, video, social-networking and other services when you're signed in with a Google account. In response, the Electronic Frontier Foundation (EFF) put up a page on its website explaining how to remove your search history from Google's database.
The growing use of smartphones and tablet computers has added another dimension to the tracking. Location information can give service providers insights into where you spend your time and, if you have friends who use the same services, whom you tend to hang out with in person. The discovery that Apple's iPhone and iPad, and then devices using Google's Android, kept a database of the phone's location history, caused an outcry last year; Apple updated its software to wipe the database, while Google strengthened protection around it.
Data collection can help companies improve and personalise services. It can also help advertisers fine-tune messages and reach the people most likely to buy their products and services often without consumers even realising - or consenting to - it.
That lack of informed consent is why the administration is seeking more data protections for US consumers, in the report issued on Thursday.
How strong the protections will be ultimately depends on what rules parties can reach consensus on. The US administration's approach implies of self-regulation, because legislation to enable traditional regulation would take time.
The move carries echoes of European data protection laws, which enshrine individuals' rights about privacy and put limits on how personal data can be processed. But those have been developing since the 1980s, whereas the US has always taken a more laissez-faire approach.
The FTC's move follows the revelation that software companies producing games and other mobile applications often aren't telling parents what personal information is being collected from children, nor how companies are using it. Depending on how the guidelines are crafted, companies could be required to more prominently disclose when they collect such things as location, call logs and lists of friends not just from other children, but everyone.
The report is not intended to replace other efforts at offering privacy protections.
Leading companies in mobile computing agreed on Wednesday to require that mobile applications seeking to collect personal information forewarn users before their services are installed. The guidelines came as part of an agreement with California's attorney general.
The US commerce secretary, John Bryson, said in a briefing with reporters that the administration's proposal on privacy not only protects consumers but also gives businesses better guidance on how to meet consumer expectations.
The proposal expands on widely accepted Fair Information Practice Principles crafted in the 1970s, before internet use had expanded beyond early researchers. The existing guidelines say that consumers should be informed about any data collection and given the option to refuse. They should also be allowed to review and correct data about themselves. The principles also have provisions for security and enforcement.
Applying the principles to the internet era, the administration said data collected in one context should not be used for another, while companies should specify any plans for deleting data or sharing information with outside parties. Companies also need to be mindful of the age and sophistication of consumers. Disclosures need to be presented when and where they are most useful for consumers.
Those closely mirror the principles used in Europe, and could ease the transit of data between the two entities; presently the less strict data protection laws in the US mean that data from Europe which will be processed by US companies are subject to a "safe harbour" agreement, in which the US firm promises to act as though it were doing the processing under European law.
The Commerce Department's National Telecommunications and Information Administration plans to convene companies, privacy advocates, regulators and other parties in the common months to craft detailed guidelines that reflect those principles. Enforcement would be left to the FTC under existing laws.
The codes of conduct would be specific to particular types of companies. One might cover social networks, for instance, while another might deal with services on mobile gadgets. A company that offers social-networking features on phones might adopt both. New ones could emerge as technology evolves.
Although officials expect many companies will agree to the new codes, allowing them to use that commitment in marketing materials, the report also called on Congress to pass new laws to require remaining companies to adopt such guidelines. Until then, enforcement would be limited to companies that say they would abide by the codes but fail to do so.
Legislation also would be needed for the FTC to give protections to businesses that follow a checklist of good practices. Known as "safe harbor", such protections would exempt companies from sanctions if they inadvertently break a code.
The report comes 14 months after the Commerce Department first proposed a privacy bill of rights. The issue was later elevated to the White House and won its endorsement with the release of Thursday's report.
The administration dropped a proposal in the original report to create a federal privacy office within the Commerce Department. Instead, the task of convening parties to craft guidelines is left to the existing NTIA.