The Progress & Freedom Foundation Blog

Wall Street Journal columnist Holman Jenkins has a terrific, wide-ranging interview with Google CEO Eric Schmidt in today's paper that is well worth reading. One thing worth highlighting is Schmidt's comments on the "economic disaster that is the American newspaper." He argues that, "The only way the problem [of insufficient revenue for news gathering] is going to be solved is by increasing monetization, and the only way I know of to increase monetization is through targeted ads."

Absolutely correct. It's a point that Berin Szoka, Ken Ferree and I tried to make in PFF's mega-filing in the FCC's "Future of Media" proceeding in early May, and Berin and I stressed it in even more detail in our piece on"Chairman Leibowitz's Disconnect on Privacy Regulation & the Future of News." The key takeaway: If Washington goes to war against advertising -- and targeted advertising in particular -- then there will be no future for private news. As we stated there:

The reason for the indispensability of advertising is simple: Information (including news and other forms of "content") has "public good" characteristics that make it is very difficult (and occasionally impossible) for information-publishers to recoup their investments. Simply put, they quite literally lack pricing power: Whatever they charge, someone else will charge less for a close substitute, inevitably leading to "free" distribution of the content, even though the content is anything but free to produce. Advertising is the one business model that has traditionally saved the day by rewarding publishers for attracting the attention of an audience.

Thus an attack on advertising is an attack on media / news itself. And yet Washington is currently engaged in an all-out assault on advertising, marketing, and data collection efforts / business models.

Incidentally, Google recently submitted comments with the Federal Trade Commission in reaction to its Staff Discussion Draft about the future of journalism and laid out their views on many of these issues. More importantly, as summarized on pg. 30 (of the pdf) of this Newspaper Association of America filing to the FTC, Google has proposed an interesting monetization model that utilizes Google Search, Google Checkout and DoubleClick ad server, "to build a premium content system for newspapers." Worth checking out. Kudos to Google for taking these steps and to Schmidt for again stressing the importance of targeted advertising for the future of media.

Working in any field of public policy is a bit like living in a haunted house: You spend most of your day dodging bogeymen, ghosts, phantasms, phantoms and specters of imagined harms, frauds, invasions and various conspiracies supposedly perpetrated by evil companies against helpless consumers, justice, God, Gaia, small woodland creatures and every sort of underserved, disadvantaged and/or underprivileged group of man, animal, vegetable and mineral imaginable.

But Internet policy--particularly online privacy--tends to be haunted by such groundless imaginings far more than most other areas of policy, largely because it manifests itself in ways that are far more real and immediate to ordinary users. For example, as outraged as any of us might feel about the Gulf oil spill, how many of us have the slightest clue what's really involved (beyond what we've learned watching TV anchors stumble through a vocabulary they don't understand)?

By contrast, huge numbers of Americans have daily interaction with web services like those provided by Google, Microsoft, Yahoo, Twitter and Facebook. That doesn't mean we necessarily understand how these technologies work. Indeed, quite the contrary! As Arthur C. Clark said, "Any sufficiently advanced technology is indistinguishable from magic." But we often think we know how these technological marvels work, and certainly sound much more informed when we spout off (pun intended) about these things than, say, "top kills" on the bottom of the ocean floor. In short, we know just enough web services to be dangerous when we ground strong policy positions in our unsophisticated understanding of how things really work online.

There are few better examples of this than the constantly repeated bugaboo that "Facebook sells your data to advertisers!" Or "Facebook only wants you to share more information with more people for advertising purposes!" These myths bear no relation to how advertising on social networking sites actually works, as Facebook CEO Sheryl Sandberg explains beautifully in a short tutorial video. Here's the key portion:

Joint CDT-PFF-EFF Comments on FTC's COPPA Review & the Dangers of COPPA Expansion

"Don't turn COPPA into a sweeping age verification mandate for the Internet!" That was essentially the core message of joint comments (below) Adam Thierer and I today filed with the Center for Democracy & Technology and the Electronic Frontier Foundation on the FTC's Implementation Review of the rules that implement the Children's Online Privacy Protection Act of 1998 (which requires verifiable parental consent for kids under 13 to use most interactive sites and services if those sites are "directed to" them or if the site has "actual knowledge" it might be collecting personal information from such kids or allowing them to share such information through the site).

Specifically, we counsel the Commission against expanding COPPA beyond its original, limited purposes and scope, or calling on Congress to enact an expansion. In a techno-functional sense, COPPA is already "expansive," since it is essentially device- and technology- neutral--essentially applying to any site or service that uses the Internet. That flexibility should allow the FTC to apply the statute in a changing landscape without further legislative changes. But we explain why COPPA is necessarily narrow in its age scope and the "directed to" and "actual knowledge" concepts that actually trigger COPPA's requirements--and why changing any one of these three critical parts would inevitably lead to unconstitutional restrictions on the speech rights of adults, minors, and site operators, while actually reducing online privacy but without enhancing the online safety of children.

We call instead for the agency (i) to use the breadth and flexibility already given to it by Congress in the COPPA statute to enforce the statute in a manner consistent with the rapidly changing technical landscape and (ii) to supplement enforcement of that existing law with increased educational efforts and promotion of parental empowerment solutions.

Adam and I certainly have our differences with CDT and EFF on some issues, but this is not one of them! I'm deeply proud to join with these organizations in pointing out the unintended consequences of expanding regulation in an area where all too many people stop thinking carefully about the effects of regulation because, they seem to think, "We can never do enough for the children!" As we point out in our comments, the trade-offs here aren't just between "The Children" and anyone's narrow economic interests, but run far, far deeper. Adam & I did our best to succinctly capture the true, complex cluster of issues at stake with the title of the paper we released last summer about COPPA expansion: "COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech."

The stakes here for our digital future could hardly be higher, yet more subtle.

So, I'm sitting here at today's Federal Trade Commission (FTC) workshop, "Will Journalism Survive the Internet Age?" and several panelists have argued that private "professional" media is toast, not just because of the rise of the Net and digital media, but also because the inherent cross-subsidy that advertising has traditionally provided is drying up. It very well could be the case that both statements are true and that private media operators are in some trouble because of it. But what nobody seems to be acknowledging is that our government is currently on the regulatory warpath against advertising and that this could have profound impact on the outcome of this debate. As Berin Szoka and I noted in a recent paper, "The Hidden Benefactor: How Advertising Informs, Educates & Benefits Consumers," the FTC, the FCC, the FDA, and Congress are all considering, or already imposing, a host of new rules that will seriously affect advertising markets. This article in AdAge today confirms this:

The advertising industry is heading for a "tsunami" of regulation and is at a "tipping point" of greatly increased scrutiny, warned a panel on social media and privacy at the American Advertising Federation conference here [in Orlando].

The reason this is so important for the ongoing debate about the future of media and journalism is because, as Berin and I argued in our paper:

Yesterday, the Federal Trade Commission (FTC) hosted an all-day workshop on "Protecting Kids' Privacy Online," which looked into the Children's Online Privacy Protection Act of 1998 (COPPA) and challenges posed to its enforcement by new technological developments. The FTC staff did a nice job bringing together and moderating 5 panels worth of participants, all of whom had plenty of interesting things to say about the future of COPPA. But I was more struck by what was not said yesterday. Namely, there was:

ZERO explanation of the supposed harms of advertising, marketing, and data collection. Advertising-bashing is an old sport here in Washington, so I guess I should not have been surprised to hear several panelists yesterday engaging in teeth-gnashing and hand-wringing about advertising, marketing, and the data collection methods that make it possible. But this grousing just went on and on without any explanation by the critics of the supposed harms that would result from it.

ZERO appreciation of the benefits of advertising, marketing, and data collection. Not once yesterday -- NOT ONCE -- did anyone pause to ask what it is that makes all these wonderful online sites, services and content free (or dirt cheap) to consumers. Everyone at this show was guilty of the "manna fallacy" (that all this stuff just falls magically to Earth from the Net Gods above). Well, back here in the real world, something has to pay for all those goodies, and that something is advertising and marketing, which are facilitated by data collection! Or would you like to pay $19.95 a month for each of those currently free sites and services? Yeah, I didn't think so.

Last week, Facebook announced significant improvements to its privacy management tools. As explained in the new Privacy Guide, this upgrade allows users to exercise greater and easier choice over sharing of their information on the site and through the site to third party applications and external websites.

By giving users powerful new tools to further protect their privacy, Facebook has employed a potent weapon to deal with marketplace apprehensions: self-regulation. Government intervention stands little chance in acting as swiftly or as effectively to tackle such matters. Rather than short-circuiting the self-regulatory process, we should trust that users are capable of choosing for themselves if given the right tools, and that companies like Facebook will respond to reputational pressure to develop, and constantly improve, those tools. That approach is far more likely to move us towards the ideal of user empowerment than is heavy-handed government regulation, which would override marketplace experimentation and have many unintended consequences for free online sites and services like Facebook.

Today's announcement represents a major leap forward for privacy controls, but of course the company will have to keep innovating in this area as it does in others. In particular, I hope Facebook and other social networking services like MySpace, Buzz, LinkedIn and Flickr will all work on the next logical step forward: building Applications Programming Interfaces (API) that will allow third party tools to tap into each site's unique privacy settings so that users can have a single "dashboard" for controlling how they share data across platforms. Such a "Privacy API" would take one step further what Facebook has started today: the challenging problem of giving users both granularity/complexity and ease/simplicity, depending on what they want in any particular context. Ideally, such tools would also allow users to harmonize their lists of friends across multiple platforms so they can manage their sharing more easily. For example, Facebook offers powerful privacy functionality by letting users restrict access to particular information or shared items to, say, their family, or specific groups of friends configured by the user. Portability of those lists would make privacy empowerment far easier for users.

But Rome wasn't built in a day, and it's important to remember that opening up this kind of access comes with its own risks. Again, innovation is an iterative process and, as such, takes time. Today's announcement should instill great confidence that there is strong reputational pressure on companies like Facebook to meet this challenge, and vie with each other for leadership in privacy empowerment.

One thing Facebook CEO Mark Zuckerberg mentioned in the press conference bears special emphasis: It's a myth that Facebook is hell-bent on getting users to share more information more widely for the sake of of advertisers. In fact, advertising on Facebook doesn't involve sharing information about users with advertisers. In fact, advertisers buy ads that Facebook shows to users Facebook (or rather, its algorithms) thinks might be interested. If anything, sharing more information can actually help Facebook's competitors if users take advantage of Facebook Connect's data portability to port their data over to competing platforms. So the widely perceived conflict of interest between Facebook's economic interests and users' privacy just doesn't exist. The site gains from having more users spend more time on the site, not from tricking users into "giving up their privacy."

We had a great discussion yesterday about the technical underpinnings of the ongoing privacy policy debate in light of the discussion draft of privacy legislation recently released by Chairman Rick Boucher (see PFF's initial comments here and here). I moderated a free-wheeling discussion among terrific panel consisting of:

Lorrie Faith Cranor, Associate Professor, Computer Science, Engineering & Public Policy at Carnegie Mellon University; director of the CyLab Usable Privacy and Security Laboratory

Ari Schwartz, Vice President & Chief Operating Officer, Center for Democracy & Technology

Shane Wiley, Senior Director, Privacy & Data Governance, Yahoo!

Here's the audio (video to come!)

Ari got us started with an intro to the Boucher bill and Shane offered an overview of the technical mechanics of online advertising and why it requires data about what users do online. Lorrie & Ari then talked about concerns about data collection, leading into a discussion of the challenges and opportunities for empowering privacy-sensitive consumers to manage their online privacy without breaking the advertising business model that sustains most Internet content and services. In particular, we had a lengthy discussion of the need for computer-readable privacy disclosures like P3P (pioneered by Lorrie & Ari) and the CLEAR standard developed by Yahoo! and others as a vital vehicle for self-regulation, but also an essential ingredient in any regulatory system that requires that notice be provided of the data collection practices of all tracking elements on the page.

"The Rise and Fall of Information Empires" & Constant Growth of Regulation"The Rise and Fall of Information Empires" & Constant Growth of Regulation

Today's NYT piece by Brad Stone about Google (Sure, It's Big. But Is That Bad?) offers a superb example of how to use the rhetorical question in an article headlined to suggest that you might actually be about to write a thoughtful, balanced piece--while actually writing a piece that, while thoughtful and interesting, offers little more than token resistance to your own preconceived judgments. But perhaps I'm being unfair: Perhaps Stone's editors removed "YES! YES! A THOUSAND TIMES, YES!" from the headline for brevity's sake?

Anyway, despite its one-sidedness, the piece is fascinating, offering a well-researched summary of the growing cacophony of cries for regulatory intervention against Google, and also a suggestion of where they might lead in crafting a broader regulatory regime for online services beyond just Google. In short, the crusade against Google and the crusade for net neutrality (in which Google has, IMHO unwisely been a major player) are together leading us down in intellectual slippery slope that, as Adam and I have suggested, will result in "High-Tech Mutually Assured Destruction" and the death of Real Internet Freedom.

Ironically, this push for increased government meddling--a veritable "New Deal 2.0"--is all justified by the need to "protect freedom." But it would hardly be the first time that this had happened. As the great defender of liberty Garet Garrett said of the New Deal 1.0 in his 1938 essay The Revolution Was:

There are those who still think they are holding the pass against a revolution that may be coming up the road. But they are gazing in the wrong direction. The revolution is behind them. It went by in the Night of Depression, singing songs to freedom.

That theme lives on in the works of those like antitrust warrior Gary Reback, an anti-Google stalwart whose book Free the Market: Why Only Government Can Keep the Marketplace Competitive Adam savaged in his review last year. Reback argues:

Google is the "arbiter of every single thing on the Web, and it favors its properties over everyone else's," said Mr. Reback, sitting in a Washington cafe with the couple. "What it wants to do is control Internet traffic. Anything that undermines its ability to do that is threatening."

Move over, ISPs! Search engines are the real threat! Somehow, I feel fairly confident in predicting that this will be among the chief implications of Tim Wu's new book, The Master Switch: The Rise and Fall of Information Empires, to be released in November, which his publisher summarizes as follows:

The genuinely tragic case Viacom v. YouTube is now hosting a new amicus brief filed "in Support of the Defendants." In it, familiar arguments made by familiar amici illuminate both the illegality and the immorality of what can be called the "takedowns-and-daiquiris" interpretation of the "hosting-service safe harbor" enacted in § 512(c) of the Digital Millennium Copyright Act, (the "DMCA").

In effect, this "takedowns-and-daiquiris" interpretation of § 512 attempts to abrogate the Supreme Court's unanimous decision in MGM Studios Inc. v. Grokster Ltd., 545 U.S. 913 (2005). Again, its advocates interpret another federal law to grant a "safe harbor" to online service providers who intend to profit by letting unsophisticated consumers assume potentially ruinous direct liability for the millions of infringing acts required to build an Internet business based upon mass piracy.

Below, I explain why these efforts to imagine that the DMCA overturns or limits Grokster should fail just as miserably as the defense of the indefensible Grokster Defendants.

PFF Hill Briefing 5/24 @ Noon: Nuts & Bolts of Online Privacy, Advertising, Notice & Choice

In light of the discussion draft of privacy legislation recently released by Chairman Rick Boucher (our comments here and here), PFF is holding a special "Nuts & Bolts" luncheon briefing on the technical underpinnings of the ongoing privacy policy debate on Monday, May 24, 2010, 12-2 p.m. in 2123 Rayburn House Office Building.

Our panel of distinguished experts will provide an overview of the technical mechanics of online advertising and associated concerns about data collection, and discuss challenges and opportunities for empowering privacy-sensitive consumers to manage their online privacy without breaking the advertising business model that sustains most Internet content and services. I'll moderate a terrific panel:

Lorrie Faith Cranor, Associate Professor, Computer Science, Engineering & Public Policy at Carnegie Mellon University; director of the CyLab Usable Privacy and Security Laboratory

Ari Schwartz, Vice President & Chief Operating Officer, Center for Democracy & Technology

Shane Wiley, Senior Director, Privacy & Data Governance, Yahoo!

To Register: Space is limited, so an RSVP is required to attend. Please register online here. Event questions should be addressed to Adam Marcus at amarcus@pff.org. Media inquiries should be directed to Mike Wendy at mwendy@pff.org.