In a series of joint privacy petitions to the Federal Trade Commission beginning in 2006 and extended more recently to include behavioral targeting, as well as medical and mobile marketing, U.S. PIRG and the Center for Digital Democracy (sometimes with allies) have argued for greater scrutiny and regulation of the online digital marketing and behavioral targeting ecosystem that involves not only companies you do business with, but social networking sites you visit, third-party advertisers you never heard of and other players. Today, in the New York Times, Professor Lori Andrews says that "Facebook is Using You."
She asks some questions similar to the ones we've been asking. In particular, should companies that collect and use social networking data to make decisions about you on the Internet have the same responsibilities as credit bureaus, which are companies that collect and sell data for credit, insurance and employment purposes, act as powerful gatekeepers to financial success and are (intended to be at least) strictly regulated in their activities because of what they do and its effect on your opportunities?
As Professor Andrews points out in her column: "Even though laws allow people to challenge false information in credit reports, there are no laws that require data aggregators to reveal what they know about you. If I’ve Googled “diabetes” for a friend or “date rape drugs” for a mystery I’m writing, data aggregators assume those searches reflect my own health and proclivities. Because no laws regulate what types of data these aggregators can collect, they make their own rules."
One encouraging event occurred last May. The FTC warned one company, Social Intelligence Corporation, that "The reports sold by Social Intelligence include public information gathered from social networking sites. Our investigation aimed to determine the company's compliance with the Fair Credit Reporting Act ("FCRA"). Social Intelligence is a consumer reporting agency [credit bureau] because it assembles or evaluates consumer report information that is furnished to third parties that use such information as a factor in establishing a consumer's eligibility for employment. Consumer reporting agencies must comply with several different FCRA provisions, and these compliance obligations apply equally in the social networking context."
Of course, this firm is neither a Facebook nor Google in importance or political power. Further, its activities placed it squarely within the credit reporting laws because its collection and sale of data were for an enumerated purpose under the law, employment decisions. But it is certainly not far-fetched to argue that information collected and sold or shared by the web giants is increasingly being used to make decisions about the opportunities and choices available to consumers. Professor Andrews points out that some consumers could be redlined or denied opportunities based on their search patterns:
"You might be refused health insurance based on a Google search you did about a medical condition. You might be shown a credit card with a lower credit limit, not because of your credit history, but because of your race, sex or ZIP code or the types of Web sites you visit. Data aggregation has social implications as well. When young people in poor neighborhoods are bombarded with advertisements for trade schools, will they be more likely than others their age to forgo college? "
And over at the University of Pennsylvania, Professor Joseph Turow has argued against the use of secret profiles in web data to charge different consumers different prices for the same product (dynamic or differential pricing) and that the unregulated web ecosystem encourages "social discrimination."
The Social Intelligence ruling is just a staff letter, but it is the FTC's enforcement position. Holding web firms and other data brokers accountable as credit bureaus may be the best solution to growing uses of web information for purposes that seem a lot like the credit bureaus-- powerful gatekeepers -- when you look at them and what they do hard enough.
Of course, none of this means that current regulation of the credit bureaus is good enough. Their sloppy practices and arrogant disregard for consumer disputes also need to be addressed. Under the Dodd-Frank Wall Street Reform and Consumer Protection Act, as soon as the new Consumer Financial Protection Bureau completes a "larger participants" rulemaking, it will gain new tools that the FTC has never had to look "inside the mysterious black box" that defined the credit reporting system for too long. Larger participant rule comments of the National Consumer Law Center, U.S. PIRG and other leading groups discuss this in detail (49 page pdf, discussion of credit bureaus begins around page 14).