Those who favor expanding the FTC’s role with respect to privacy should take a close look at what the agency does with the authority it already has. The most recent exhibit is the FTC’s imposition of a $22.5 million penalty on Google for bypassing the privacy settings on Apple’s Safari browser and thereby violating the terms of Google’s 2011 consent decree with the FTC. Since this is the largest fine the FTC has ever imposed, one would think Google must have committed a pretty serious violation that resulted in substantial harm to consumers. But there is no evidence that consumers have been harmed at all. (Dan Castro has written a nice blog post on this). Instead, the FTC has uncovered just enough of a technical violation to be able to say to Google “gotcha again.”

The issue is difficult to explain briefly, but essentially what happened is this: Google’s social network, Google +, has a “+1” button that, like Facebook’s “Like” button, gives users a way to indicate content they like. This feature doesn’t work with Apple’s Safari browser, which has a do-not-track feature that is turned on by default, so Google developed a tool that made the Safari browser work like other browsers.

Following research of a Stanford graduate student which was reported in the Wall Street Journal, the FTC began investigating and discovered two sentences in a 2009 Google help center page that the FTC claims misrepresent what Google is doing. That language dated from a year before Apple adopted its current cookie policy, two years before the 2011 consent decree, and two years before the +1 button was introduced.

Whether or not Google technically violated its consent decree, it is difficult to see how the Commission’s action will benefit consumers. Paradoxically, the action is likely to undermine one of the Commission’s principle recommendations: “greater transparency” concerning information collection and use practices. The $22 million fine sends exactly the opposite message to Google as well as other firms subject to FTC jurisdiction. The more transparent a company is about how it collects and uses data, the greater the risk of making a mistake and getting in trouble with the FTC. So, companies will find it in their interest to give users less information about web site privacy practices.

In addition, there is a cost to the +1 users the FTC is supposedly protecting. Now that Google has “corrected” the problem, Safari users who want to use +1 need to manually log in to their Google account, which equates to submitting a form, which then allows additional Google cookies to be installed anyway. This is quite a cumbersome process. Moreover, the pre-correction Google workaround meant that only additional cookies from Google’s Doubleclick network could be installed, while blocking cookies from any other third party. The current fix forces users who want to use the +1 function to change the cookie settings for the entire browser, opening their phones to cookies from any website, unless they take the trouble to switch settings back to ‘never accept’ cookies after they have successfully ‘+1′ the content they set out to share.

That FTC privacy-related enforcement is not based on demonstrable consumer benefits should not come as a surprise to those who have been following the agency’s work in this area. In the past two years, the Commission has released two privacy reports (here and here) that contain no evidence of consumer harm from current privacy practices. In fact, the Commission explicitly rejects the harm-based approach to privacy. This, of course, makes analysis of the benefits of proposed measures difficult, since if there are benefits they will consist of reduced harms.

So, what are the broader lessons from this episode? First, we should be wary of privacy legislation that gives the FTC additional authority to write new rules and enforce them (which virtually all privacy legislative proposals would do). If new legislation is enacted, it should only be with a strict mandate that any new regulations address significant harms and pass a cost-benefit test.

Another lesson may be for companies like Google, who understandably are anxious to avoid protracted litigation and get on with their businesses. These companies probably need to reassess the cost-benefit calculation that induced them to settle in the first place.

The Senate Commerce Committee held a privacy hearing yesterday with three government witnesses from the agencies responsible for this issue:  Federal Trade Commission Chairman Jon Liebowitz and Commissioner Maureen Ohlhausen, and Commerce Department General Counsel Cameron Kerry.  The Senators and witnesses went over a lot of familiar ground.  A few takeaways from the hearing:

- Perhaps because of sparse attendance on the part of Committee members, the privacy issue appeared to be more partisan than it used to be.  The two skeptics about the need for legislation were Senator Pat Toomey (the only Republican to show up) and newly-confirmed Commissioner Ohlhausen.  Senator Toomey stressed the need for evidence of market failure, harms to consumers and cost-benefit analysis (a position with which I agree and have made before this committee).   Senator Kerry, on the other hand, stated that the record is clear on the need for a privacy law, even suggesting that Senator Toomey’s concerns have been addressed at previous hearings (they have not).  Commissioner Ohlhausen expressed “concerns about the ability of legislative or regulatory efforts to keep up with the innovations and advances of the Internet without imposing unintended chilling effects on many of the enormous benefits consumers have gained from these advances.”  Senator Rockefeller acknowledged that a consensus doesn’t yet exist on legislation, but indicated after the hearing, “I really don’t see it as that complicated a subject.”  In fact, it is a complicated subject.

- The issue is viewed as a consumer protection issue (which it is), but it is perhaps more importantly an innovation issue, as suggested by Commissioner Ohlhausen.  This is because virtually all innovation on the Internet depends in one way or another on the use of information – to develop the product itself and/or the financial resources for it.  Thus, privacy regulation, which necessarily limits the collection and use of information, can have a profound effect on both the magnitude and direction of innovation on the Internet.  The legislation proponents do not acknowledge these tradeoffs.  They simply assume that regulations can be adopted without any adverse effect on innovation.

- There remains substantial confusion about the anonymity of data.  Much of the discussion conflated data from social networks – clearly not anonymous – with data used anonymously for a variety of commercial purposes on the Internet.  Individuals understandably get upset when personal information posted on social networking sites which was previously available to one group of people becomes unexpectedly available to a wider group.  This is the type of information at issue in the recent FTC consent decrees with Facebook and Google.  In these instances, both companies were forced by their users to stop the questionable practices as soon as they became known, long before the consent decrees were entered into.  In any event, some combination of consumer unhappiness and the FTC’s existing statutory authority was sufficient to stop the questionable practices.  But information on social networking sites is different from the vast amount of data collected and used for behavioral advertising or to refine search engines, to take two examples.  These data are “known” to computers, not to individuals.  No one is sitting around saying, “What can I sell Tom Lenard today.”  Rather, computers are using algorithms to serve advertisements to consumers who have certain interests.

- There is a lot of confusion about the market for privacy and whether firms compete on the basis of privacy.  The two government reports did not do a good job of illuminating this central issue.  Senator Toomey suggested  companies are competing on privacy, while the pro-legislation group at the hearing argued that companies always lose profits by providing more privacy (i.e., sacrificing some data), so they will never want to do it.  But companies do things like this all the time – i.e., provide better service, which costs money, in order to attract more customers, which makes them more money.  What the pro-legislation camp seems to be arguing is that companies won’t be able to attract consumers by offering more privacy, even though consumers are unhappy with the privacy protections they’re currently receiving.  This is not a compelling argument.  In fact, we really don’t know that consumers are, on the whole, unhappy with current privacy protections, which gets us back to Senator Toomey’s opening remark:  “Seems to me neither this committee nor the FTC nor the Commerce Department fully understands what consumers’ expectations are when it comes to their online privacy.”  We should know more with all these reports.

Last week, the Administration released its long-awaited privacy report.  The new privacy framework includes a Consumer Privacy Bill of Rights and a Multistakeholder (MSH) process to develop “enforceable codes of conduct” that put those rights into practice.

The inclusion of this “Bill of Rights” raises some serious concerns. In adopting the language of “rights” the Administration is moving toward the European approach, which also discusses privacy in terms of rights.  This sends the wrong signal.  The U.S. has created an environment that is much more conducive to IT innovation, partly as a result of our less regulatory privacy regime.  It is not an accident that the U.S. has spawned literally all the great IT companies of the last couple of decades.  Google, Facebook, Amazon, Microsoft and others all depend on personal information in one way or another.  So, why we would want to move in the direction of Europe is a bit of a mystery.

Adopting the language of rights also provides a rationale for not subjecting privacy proposals to any kind of regulatory analysis.  Rights are absolute.  Once we label something a right, we’re saying we’re beyond the point of considering its costs and benefits.  But privacy regulation involves major tradeoffs that we would be better off to consider explicitly.  The White House report does not do that and suggests there is no intention to do so in the future.

In the report, the Administration also voices its support for legislation.  However, this seems somewhat inconsistent with the MSH approach described in the report.  A key advantage of the MSH approach, if structured properly, should be greater flexibility relative to regulation that would typically result from legislation.  This flexibility is vital for the tech sector, which is constantly changing.  We should give the MSH process a chance to work before trying to adopt something more formal.   Therefore, Congress should put efforts to enact privacy legislation on hold.

Google stirred up a hornet’s nest when it announced its new privacy policy, including questions from Congress, a request from the EU for Google to delay implementing the new policy pending an investigation and, yesterday, a Complaint for Injunctive Relief filed by EPIC alleging that the new policy violates the FTC’s Consent Order.

Google’s new privacy policy appears to represent a relatively small change that is also pro-consumer.  The company is proposing to consolidate privacy policies across its various products, such as Gmail, Maps and YouTube.  Google says it is not collecting any new or additional data, is not changing the visibility of any information it stores (i.e., private information remains private), and is leaving users’ existing privacy settings as they are now.

Google has indicated it will merge user data from its various products, and this is what has riled up critics, who apparently believe that combining information on users, even within a company, is harmful. Yet, combining the data Google already has will increase the value of those data, both for the company and its users.  As its understanding of users increases, Google will be able to provide more personalized services, such as more relevant search results. And, of course, if it can serve users more useful ads then it can charge advertisers more for those ads.

It is important to note that the new policy has not actually been implemented.  No actual users of Google products have experienced how the policy will affect their user experience or had a chance to react to it. If users feel the change negatively impacts their experience, they will presumably let Google know.

Not being a lawyer, I’m not going to opine on whether this policy is or is not consistent with the FTC Consent Order.  But the episode is troubling if one thinks about its potential effect on innovation on the Internet, which largely depends on the use of information—either to develop and improve products or to fund them.  It seems now that the cost of making even a modest innovation has ratcheted up.