Law Students

Quick Reflection on New Government Web Privacy Regs

By Casebook Sherpa

The Obama Administration recently suggested a reform to the government’s policy on data collection by government websites. The proposal was met with a wave of dialogue over the nature of government data collection and expectations of privacy:

Supporters of a change say social networking and similar services, which often take advantage of the tracking technologies, have transformed how people communicate over the Internet, and Obama’s aides say those services can make government more transparent and increase public involvement.

Some privacy groups say the proposal amounts to a “massive” and unexplained shift in government policy. In a statement Monday, American Civil Liberties Union spokesman Michael Macleod-Ball said the move could “allow the mass collection of personal information of every user of a federal government website.”

via The Washington Post

Among those who have responded, the Electronic Frontier Foundation and Center for Democracy and Technology suggested several rules of thumb that would ensure the spirit of the old rule (maxmizing user privacy) is not lost in the new regulations. While praising the proposed rules generally, the EFF and CDT’s case boils down to two primary points:

• ensure effective disclosure of data collection procedures and policies; and
• adopt the easiest, most effective, and most technologically-feasible opt-out mechanism for users.

While the proposed rule largely meet these goals, the EFF and CDT have concerns which I share. An issue with data collection is ensuring that users know what data are being collected, who sees the data, what the data are used for, and how to data collection by that site altogether.

But what’s the issue? And why the need for change?

To answer those questions, let me explain how these rules have impacted what I do. As part of my job, I work on some web marketing and search engine optimization (SEO) projects. One of these is for a government client, for whom we make online pay-per-click (PPC) ad buys and perform basic SEO of a website as part of our work. For those who know what these are, pardon me as I take a moment to explain to those who may not be as familiar…

• PPC is the shorthand for purchasing keywords through a search engine so that your site is displayed in a sponsored listing alongside “organic” search results (the sites that appear in the list of search results). Roughly speaking, you pay each time a user clicks on one of your ads.
• SEO is the process whereby you ensure that keywords for your website are displayed throughout the site in the text the user sees as well as in the unseen components of the site (image tags, page metadata, conforming header formats and page organization, etc). Basically, you’re organizing your site in a way that allows the search engine to catalog it in the appropriate places.

The technology that drives much of the web, including these commercial and marketing activites, relies on the placement of tracking cookies on users’ machines. These small data files tell websites you visit information about you – where you’re located, how you got to that site, how long you stay, whether you’ve been to that site before, etc. The results are (1) an Internet, or at least certain aspects of it, that is more customized to your preferences and (2) databases of your web usage habits housed on company servers around the world.

Per an OMB guidance memo from 2000, government websites can’t do this. Depending on the agency hosting the website, they can place a cookie on your machine (if certain requirements are met) but it can’t be what’s called a “persistent” cookie. It can’t track your movements once you leave that government site. In other words, it expires once you leave the site. When you return to the page, you get a new cookie and the site cannot read any information from your old cookie (nor has it saved any of the information gathered from your previous cookie). This is a HUGE challenge when tracking the effectiveness of SEO and PPC efforts, which means that any government public education initiative that relies on a web component will only be so successful. It is also a fairly significant barrier to government adoption of social networking technologies (though there are a growing number of government agencies who actively use twitter, facebook, youtube, linkedin, etc). There are means of extrapolating from certain data points we do receive, but it’s nowhere near as effective as it could be. The result is a fairly good picture of how effective the government investment has been, but not the best picture allowed by technology.

So, from a commercial and effectiveness standpoint, the government policy has significant drawbacks. But from a privacy standpoint it has very real benefits. The last thing many people want is a growing database of the personal surfing habits of millions of Americans. You can’t control what’s done with that information and once it’s stored somewhere by the government or by a large company you no longer control the security of that information. I’m concerned about privacy too. While I don’t believe that multi-national companies or black helicopters are coming for me, I do try to avoid sharing information about myself that can be used in ways that I don’t approve, don’t want, or outright oppose. Yet, at the same time, I expect websites to become more responsive to what I want. To be organized in ways that I think makes sense. And to display ads and content that are relevant to my interests and values. That can’t magically happen.

Much of this discussion turns on the issue of how government websites are changing and whether they will continue to change. Growing swaths of the web are being customized based on what users are choosing and how they are behaving. Your YouTube page probably looks different than mine. Some of this is done through creation of personal accounts. Some of it is done through the use of tracking technologies like cookies. Either way, web development allows for micro-customization of websites based on your preferences and previous use habits. In the past, government web content has been largely static, but as more information is shared online the government is becoming more effective at updating websites, using the web to communicate with constituents and incorporating the web in public education efforts and strategies.

As EFF and CDT point out, the risk with government use of new web tracking rules to accomodate these advancements is that users are singled out or their access to information is limited in some way based on what they say or do on a government website. Ensuring that the individual’s data is not organized or classified in a way that prevents this will go a long way towards making sure that a user’s privacy will not be compromised while ensuring that government websites become more responsive to the needs of a citizenry increasingly turning to the web to communicate with its government.

Full post as published by Fight The Hypo on August 17, 2009 (boomark / email).