Workshop on “cross-device tracking” shows FTC is trying to keep up with emerging marketing technology

SetWidth700-Cross-device-tracking-650x300In mid-November 2015, the FTC hosted a workshop on “cross-device tracking.”  Cross-device tracking is the practice of associating a person’s online activities across multiple devices to create a single marketing profile.

FTC Chairwoman Edith Ramirez provided opening remarks at the workshop before turning the program over to Justin Brookman, FTC Policy Director, Office of Technology, Research, and Investigation, for a short presentation regarding what cross-device tracking actually is.

According to Ms. Ramirez:

While tracking itself is not new, the ways in which data is collected, compiled stored and analyzed certainly is.  We know, for example, that behavioral techniques based on passively collected data are used to infer whether an individual might be in a particular target demographic or be interested in particular products.  Now many of these same techniques are also being used to try to infer the actual identity of that individual and what devices she owns.  This more extensive tracking allows companies to connect more and more of consumers’ offline activities with their online activities.  This results in more detailed and more personalized consumer profiles that are assembled, traded, and shared by a growing number of entities in the data ecosystem.  They do this under the veil of “anonymous identifiers” and “hashed PII,” but these identifiers are still persistent and can provide a strong link to the same individual online and offline.

Ms. Ramirez also iterated that, in addition to transparency concerns, cross-device tracking raises concerns about notice and choice as it relates to consumers:

As it currently stands, there are almost no tools that allow individuals to know which of their devices are linked together by tracking companies or specifically linked to them. Furthermore, while certain tools to opt out exist, most controls do not allow opting out of the underlying data collection and “linking” of identifiers; they only allow opt-outs of targeted advertising.

Following Ms. Ramirez’s comments, Mr. Brookman took to the stage and provided background about the practice of cross-device tracking and a description of some of the techniques currently used to correlate consumer devices.  Mr. Brookman’s presentation also looked at the notice and transparency currently provided to consumers about cross-device tracking and the options consumers have to control the tracking.

The workshop was then divided into two separate panel discussions.  The first panel, moderated by FTC Chief Technologist Ashkan Soltani, provided a technological perspective on cross-device tracking.  Panelists addressed the benefits of cross-device tracking to consumers, content providers, and advertisers, as well as the primary technical risks and techniques to avoid them.  The second panel, moderated by FTC attorney Megan Cox, provided a policy perspective on cross-device tracking.  Panelists discussed the need for increased consumer transparency and control over cross-device tracking, in addition to steps the advertising industry is already taking in this regard.

            Maneesha Mithal, the Associate Director of the FTC’s Division of Privacy and Identity Protection, summarized the “five main takeaways” from the workshop as follows: (1) the benefits of cross-device tracking, including maintaining state, frequency capping, and seamless user experiences across devices; (2) the need to provide greater transparency, choices, and education for consumers; (3) the need to consider the consumer experience; (4) that there is room for industry innovation in this space; and (5) that companies should be mindful of their representations in this space and adhere to those representations.

            On the same day the FTC hosted its workshop on cross-device tracking, Digital Advertising Alliance (“DAA”), the industry group behind the Ad Choices icon, published guidelines that state companies who collect data across all of a consumer’s devices must provide notification of the practice.  It’s partly a bid to play catch up as people increasingly use multiple devices when consuming online content, according to Lou Mastria, the DAA’s executive director.  “This guidance helps companies understand how the DAA’s core Principles of notice and choice should be applied cross-device environments, and it will give consumers confidence that cross-device data practices will be fully disclosed and that the choices they make on each browser or device will be honored and independently enforced,” Mastria said in a statement.  DAA General Counsel Stu Ingis added, “This cross-device guidance makes clear that the DAA Principles apply to cross-device data practices and gives consumers information and control over the use of data from each device they own.”

            While there was no specific call by the FTC for additional legislation or regulatory moves to prevent cross-device data collection, the fact that the topic was worthy of a workshop, and the fact that the agency has a new research division to quantify such issues (Office of Technology, Research, and Investigation), means the FTC is paying attention.  Consequently, it may mean more enforcement actions against companies that track consumers across multiple devices without providing notice to the consumer and the concomitant opportunity to opt-out of the tracking practice.  As Ms. Ramirez noted, “The FTC will continue to monitor the marketplace and take action as needed to protect consumers.”