Effective Regulators, Effective Privacy Choices

Tracking individuals across devices as they stream video, browse on tablets and use apps and mobile websites on phones is now standard practice, according to ad industry publications. Enabled by ad networks, data brokers and companies that provide services across multiple screens, advertisers are focused on being able to attribute media content accurately and consistently to individuals, regardless of where content is viewed.

As audiences have dispersed across screens and devices, advertisers have worked with a wide range of companies seeking to link together the disparate mobile identities of customers and prospects. The number of devices and scale of this type of tracking is immense: Data firm Iovation claims it has detailed data on three billion unique devices.

What choices do consumers have if they don’t want to be tracked across devices? It depends …

Facebook, Microsoft, Apple and Google have policies and consumer choices for various kinds of tracking. ISPs offer similar policies and choices, but they are only able to track consumers on their network. The typical consumer today has one ISP at home, may use a different company for mobile data, relies on their office ISP service during the day and turns to other Wi-Fi networks during the day. Some ad networks offer an opt-out that breaks the link between devices, while others only agree to stop targeting ads across devices but to continue tracking.

The Federal Trade Commission has taken the lead in examining cross-device tracking with a recent workshop and has advocated for greater transparency and better consumer controls. The industry has started to respond by adding additional opt-out options to its self-regulation code, mandating that companies stop using data across devices for behavioral ads when users opt-out, but the FTC continues to advocate for broader consumer controls for such tracking.

Industry practices can be difficult to examine, as many privacy policies do not spell out the use of tracking in great detail, but top experts on ad tech, tracking and privacy who have recently joined the FTC should enable the agency to continue to examine the quickly developing business practices. Already, senior FTC officials have made it clear that failure to disclose cross-device tracking could amount to a violation of Section 5 of the FTC Act. Privacy advocates have urged the FTC to do much more to press this issue.

Cross-device tracking is but one issue the FTC is grappling with as the online data ecosystem becomes more complex. Oracle now offers data as a service, ensuring that every company has access to data on demand. PlaceIQ claims to track the location of 100 million devices. Mobile apps may have access to our contacts, text messages, photos, fitness data and more.

So, what role should the Federal Communications Commission play here?

In the upcoming months, as the FCC examines extending the privacy rules enabled by its recent broadband reclassification, it will need to decide the role it can play in setting rules for data use by ISPs. The FCC’s ability to impact the consumer experience in the online ecosystem will be less significant than the FTC’s, since its efforts will be limited to the tracking enabled by ISPs which are only one of many technologies and business models involved.

The FTC has been highly effective by basing its enforcement on the standard of whether companies are acting deceptively or unfairly. The FCC should study how consumers are protected online by a long series of FTC enforcement actions and adopt a consistent model that allows the two agencies to collaborate effectively.

One important consideration for regulators is the rapid pace of change in technology and the uses of data. A decade ago, the leaders in the world of ad tracking and targeting were the companies that had access to the most data. Today, data has been democratized. Data is available to any vendor with a credit card. Blue Kai, the key data provider in Oracle’s new data division, offers more than 80 comprehensive sources of data to its customers. Debates over which company holds more data miss the more central challenge ad companies are facing: The issue of state management of user identity in a world of diverse devices.

Many companies are providing consumers with information and choices, and the industry has taken steps to develop guidelines for expanded cross-device tracking. Historically, the brawny cop on the beat here has been the FTC, which has brought a range of actions focused on the misuses of identifiers against leading online companies, ad networks, apps, children’s sites and others. A new cop on the beat has also recently started to have an impact on online practices. The rise of the ad blocker, driven by a range of aggressive ad practices, has sparked an industry drive for reforms.

When it comes to the complicated ad tech ecosystem, what consumers need is regulators and technology solutions that work together to ensure easy to use and effective choices and cross-industry standards that are logical.

Jules Polonetsky is executive director and co-chair of the Future of Privacy Forum, a think tank committed to advancing responsible data practices. Reach him @Jules Polonetsky.

This article originally appeared on Recode.net.