Putting the FTC’s privacy report in context

The FTC released a report Monday detailing its guidelines for consumer privacy. Privacy has become a growing issue in recent years, in part because of a number of incidents, ranging from changes in privacy policies to shoddy security practices that allowed hackers to steal confidential information. With the rise in internet advertising and the soon-to–be-ubiquitous use of of big data by large companies, privacy concerns won't be going away anytime soon.

I was curious about what affect the FTC report would have on the debate over consumer privacy, so I sent Kent Grayson, an associate professor of marketing and expert on consumer trust, a few questions. He replied with a thorough and well-reasoned essay on the topic, which I'm posting in full. Read on for Grayson's take on consumer privacy in the internet age.

—

First of all, it’s important to recognize that the FTC report focuses merely on recommendations, and does not carry the weight of new regulations or legislation. Nonetheless, the report highlights many interesting issues for companies and their use of the internet.

Regardless of federal guidelines, it’s important for businesses to understand their customers in terms of two key dimensions. The first dimension relates to customers’ level of sensitivity regarding the collection and use of their personal information. People differ in terms of how comfortable they are with the collection of personal information, and with what levels or kinds of information are collected. The second dimension relates to customers’ level of understanding and knowledge about what kind of information companies can collect and what they tend to do with that information.

Some are unaware of the existence of data brokers and believe that companies collect less personal information than they actually do. At the other extreme are those who believe that companies collect more information—and more personal information—than they actually do. In between those extremes are customers who have an accurate sense of the kind of information that companies collect, and what they do with it.

Most business units will cater to customers who can vary across those two dimensions. However, most also tend to depend on a core of relatively homogeneous customers, and it’s likely that these customers will also be similar with regard to their knowledge of the kind of information that companies collect and their sensitivity about it.

Regardless of federal guidelines, companies should craft their privacy policies and procedures—as well as the way they communicate to customers about them—based on an awareness of where their on these dimensions key customers tend to sit.

Although these two dimensions are important now, it is inevitable that customers will gain a more and more accurate understanding of the kind of information that companies collect and what companies can do with that information. Reports like this one from the FTC help with communicating accurate information and can indirectly prompt companies to be more transparent with their privacy policies. They can also commend companies that help consumers track the private information that is collected about them. Let’s not forget that consumers also gain more accurate information about internet privacy when they read about hacked company databases and the kind of information that was stolen, or when they are unpleasantly surprised to discover something that a company knows about them.

Regarding knowledge and sensitivity there is one big problem: technology is advancing faster than ever. Companies are finding more ways to track personal information—for example, using GPS data—and more interesting ways of using that data. Although technology advances do not always change the rules of the game, over time they can make knowledgeable customers less knowledgeable and they can make less sensitive customers more sensitive. Although the bureaucratic workings of government make it difficult for bodies like the FTC to keep up with changes in technology, I think it’s important that the FTC report includes some strong encouragement for mobile service companies to improve privacy and transparency. As I mentioned, companies are finding ways to make GPS data more and more useful to them—some consumers may be pleasantly surprised when they are shopping in a store and they suddenly get a competitor’s coupon. Others may be less than amused.

Having said that, I think we have quite a way to go before the average customer has an accurate understanding of what information companies collect and what they do with it. My suspicion is that too many customers remain unaware of what kind of information is sold by data brokers and how companies use this information. While I feel confident that many customers would not be upset to learn—for example—that the search terms they used in a previous search can immediately affect the kinds of ads that appear in a subsequent search, it seems likely that others would be. So I think the FTC’s focus on encouraging more transparency by data brokers is both helpful and appropriate.

It is less clear whether customer sensitivity regarding the collection of personal information will also become more homogeneous. Much has been written about generational differences regarding these preferences—that younger consumers who grew up with Facebook are less sensitive than older consumers. While this may be true, we can’t ignore the fact that Facebook users have been vocal about Facebook privacy policies and seem to have their own sensitivities. At this point, it would probably be a mistake for a company to assume, based on the age of its customer base, whether its core consumers tend to be relatively more or less sensitive about the use of personal information.

Photo by Yuri Long.