Although the report asserts that “industry must do better,” it contains no systematic data on what industry is doing now. So, how can we know that industry needs to do better? Policymakers can’t make informed decisions without understanding what the baseline is – what’s going on now in the marketplace. The last systematic study of privacy practices of commercial web sites appears to be a 2001 survey (one that I was involved with) undertaken by The Progress & Freedom Foundation and Ernst & Young.
The FTC staff proposal is based on “the major themes and concepts” developed through their roundtables. Themes and concepts are interesting, but they are not a substitute for data and analysis. Without an analysis of benefits and costs there is no way to know whether the proposal or any of its elements would improve consumer welfare. The staff acknowledges the need to assess the costs and benefits of its most prominent proposal, a Do-Not-Track mechanism, but then endorses the proposal without having done such an assessment. This violates the spirit, if not the letter of President Obama’s recent executive order on regulation, which stresses the need to evaluate both benefits and costs.
The commercial use of information online is a critical part of the Internet, supporting a wide array of content and producing other benefits. The FTC is the expert agency on privacy issues, yet its staff has proposed a major new regulatory framework for this sector without any data. We need much more to inform the policy discussion.