At a Senate Commerce Committee hearing last week, Federal Trade Commission Chairman Jon Liebowitz indicated that the agency is exploring the idea of a Do Not Track List that would allow consumers to block servers from tracking their online activities.  A Do Not Track List sounds like a good idea, because the Do Not Call List for telemarketing calls is popular.  Before moving forward with a Do Not Track List, however, the FTC should thoroughly analyze its benefits and costs and determine whether there are more cost-effective ways of achieving the same objective.  Here is my back-of- the-envelope assessment.

Benefits:

People who sign up for a Do Not Track List will do so because they derive some utility simply from knowing they are not being tracked.  This value is not easily quantifiable, but some people will surely be better off.

However, the more tangible benefits of the Do Not Call List – reducing unwanted marketing solicitations – are not there with a Do Not Track List.  Consumers would not necessarily receive fewer ads.  (Indeed, it would be difficult for them to know if the list were actually working)  They would just receive ads that are less-well-targeted to their interests.  There are ways that consumers can block ads on the Internet, but a Do Not Track List is not one of them.

Costs:

First, there are direct costs of implementation.  This would be a fairly major undertaking for the FTC, so these costs are probably not trivial.

Second, there are indirect costs in terms of the quantity and quality of services and content on the Internet.  These costs would be borne not only by Do Not Track List participants but by other Internet users as well.  A Do Not Track List (depending on how many people signed up) would reduce the value of the Internet as an advertising medium, and therefore would reduce the revenues available to support Internet content.  A Do Not Track List would also affect the quality of major Internet services, such as search engines, which use data on search histories to update and improve their algorithms, and to protect against threats such as search spam, click-fraud, malware and phishing.  If search engines have less data, they can’t do this as well.  In sum, there are positive externalities to the information generated by online tracking that support the services that everyone uses.  Consumers who signed up for a Do Not Track List would be free-riding off those consumers who allowed their data to be used.

Finally, consumers who signed up for a Do Not Track List would receive ads that were less-well-targeted and therefore less useful.  The cost of this would depend on the value these consumers place on advertising.

Cost-Effectiveness:

Even if one were to conclude that the benefits of a Do Not Track List were greater than the costs, there is still a cost-effectiveness question:  is this the least costly way for consumers to avoid being tracked?  The answer is probably not, because users can already adjust their browser settings to avoid being tracked.  Many (perhaps most) users don’t know how to do this, but it’s easy to learn if you want to.  It only takes a few clicks.  In fact, it would likely be just as easy to learn how to adjust your browser to avoid being tracked as to sign up for a Do Not Track List and it would be totally under the user’s control.  Why should the FTC set up a whole new program to do something that consumers can fairly easily do for themselves?  A better, more cost-effective alternative would be for the FTC to post an online tutorial showing consumers how to do it.

Of course, the fact that most consumers probably haven’t taken the trouble to learn how to adjust their browser settings may mean that they don’t place a very high value on not being tracked.  That suggests the benefits of a Do Not Track list would be small, likely far smaller than the costs.

Ever since Facebook introduced its new personalization programs, users, privacy groups, and lawmakers have complained that Facebook’s privacy controls are overly complex and change too frequently.  Thus, users who are not sufficiently alert may unintentionally release personal information to people who shouldn’t have that information.  A lot of people are rapidly becoming more alert.

In response to the flurry of criticism and, perhaps, to forestall government action, Facebook just announced that it will introduce new privacy controls that it hopes will be more transparent and easier to navigate. Google, faced with a similar problem a few months ago with its new feature, Buzz, also changed its privacy controls in response to vocal criticism.

So we see companies and users struggling to find where social networking ends and privacy intrusions begin.  The question for those of us concerned with public policy is whether the government can be helpful in this type of situation – for example, by providing guidelines as suggested by Senator Schumer.

Whatever one thinks of Facebook’s actions, it’s hard to envision how the FTC or any government agency could do anything that wouldn’t seriously interfere with the ability of businesses in young and fast-changing industries like social networking to introduce new services and try new business models.  The exception would be if Facebook misrepresents to its users what it is doing.  In that case, the FTC might have reason to bring an enforcement action under the current law.

So, despite the missteps, Facebook’s privacy practices are best left to be worked out between the site and its users.  Notwithstanding its rapid growth, the company ultimately will not succeed if it isn’t responsive to its users’ privacy concerns.

What is interesting about the recent Facebook and Google Buzz privacy episodes is that the discussions have mostly not been about the use of information for targeted advertising.  This strikes me as a positive development in that perhaps it will make people more aware of the real differences between information on social networking sites and the use of information for targeted advertising.  People are understandably concerned about the unintentional dissemination of personal information about themselves, including potentially to people they know, and they therefore need to pay close attention to the privacy controls.  That particular concern is not present with targeted advertising, because advertisers use information anonymously (see article by Paul Rubin and myself).  Indeed, even the latest news about Facebook and other social networking sites sending information to advertisers about the last webpage a user visited before clicking on an ad, which could be the user’s profile page, is not particularly a cause for concern.  (In any event, the sites have addressed the problem).  The process of targeting advertising based on users’ interests does not involve human beings looking at any individual’s data.  It is entirely automated.

I am not suggesting that targeted advertising has no connection to the new features being introduced by Facebook, Google and others for whom advertising is the major, often the sole, revenue source.  These companies are trying to increase the number of eyeballs, the amount of time the eyeballs spend on their sites, and the quality of information available in order to better target advertising and thus increase revenues.  Presumably, however, the information people make available is valuable for targeted advertising only when it is used anonymously.