Online Privacy Regulation

Federal policy makers are considering “baseline privacy regulations” for the Internet that would limit the collection of data about online web surfers—data which, in turn, powers the online advertising engine that generally supports most online content and services. The debate is unfolding on multiple fronts—in Congress, within the Federal Trade Commission, and throughout the Obama administration more broadly. Some of the biggest names in the high-tech sector are involved in the battle. Surprisingly, however, many of them have signed off on a new regulatory regime for the Internet. Some of them cite “greater certainty” as their rationale, although it may be the case that some of those larger players believe it will be to their competitive advantage in the long run since they can absorb the increased regulatory burden while smaller competitors cannot.

The stakes in the debate are significant since regulation could fundamentally alter the nature of online commerce and the future of how digital content and services are provided.  In light of the importance of this debate to the Internet economy and the future of online content and digital services, the Mercatus Center's Technology Policy Program will be expanding its coverage of this issue and commissioning more research about the potential costs of increased online privacy regulation. This short research note describes some of the themes, conclusions, and recommendations that will guide our ongoing research in this field.

Research Findings

• Privacy is a highly subjective condition and no two people share the same privacy concerns. That fact will complicate regulatory efforts significantly, especially if lawmakers take extreme steps to regulate personal information flows.

• It's also unclear what the "harm" or market failure is here that requires government intervention. Regardless, there must be a showing of concrete—not conjectural—harm before policy makers intervene. Simply stating that online advertising is “intrusive” or “manipulative” will not suffice since those are the same criticisms that have long been leveled at advertising more generally. Tailoring advertising to consumers to offer them goods and services they might find more desirable should be considered a benefit, not a harm.

• There is an economic tradeoff between locking down information and the many benefits for consumers of the free flow of information. The Internet economy is built on information; there is no free lunch. If privacy regulation restricts data collection and limits online advertising and marketing, it will have a direct cost for consumers in terms of increased prices for previously free content and services. (Who wants to pay $19.95 a month for Facebook?)  Worse yet, it could result in the disappearance of some of those sites and services. In essence, to curtail data collection and online advertising in this fashion would be killing the goose that lays the Internet’s golden eggs. Such regulation will have a particularly deleterious impact on small publishers and service providers, who depend almost entirely upon online advertising. In turn, this could curtail new entry and innovation.

• Regulating privacy requires an information-control regime. Government would need to limit data flows of facts about individuals, which raises questions about the conflict between privacy regulation and free-speech rights. In essence, privacy regulations limit the right of people to talk about other people, or communicate facts about them.  This raises serious First Amendment concerns and has particularly troubling ramifications for press freedoms. Restrictions on advertising could also have an effect on non-commercial speech, such as political ads or nonprofit communication. Ironically, some proposed privacy regulations, such as the so-called “Do Not Track” list, would require individuals to surrender more personal information about themselves to the government for purposes of authentication and enforcement of the rule.

• Regulatory advocates must prove that there is no less-restrictive alternative to regulation, such as user-empowerment strategies, educational approaches, or industry self-regulation. Additional steps along these lines would, ultimately, be more constructive than a costly and onerous privacy regulatory regime for the Internet economy.

• Finally, many layers of privacy regulation already exist, and the Federal Trade Commission (FTC) already possesses general enforcement authority to police unfair and deceptive practices. If companies are not living up to contractual promises they made to their customers about the use of personal information, the FTC has the ability to hold them accountable. New laws are not needed to accomplish that.

Conclusion

Some advocates of intervention on this front don’t hide their desire to move the United States in a direction the European Union has followed with “data directives” and more stringent forms of privacy regulation. But America’s refusal thus far to walk down that more regulatory path offers scholars the chance to evaluate Europe’s more-restrictive approach and study whether America’s lead in the global digital marketplace might be tied to its more “hands-off” approach to online regulation.  A recent study by Avi Goldfarb and Catherine Tucker found that “after the [European Union’s] Privacy Directive was passed [in 2002], advertising effectiveness decreased on average by around 65 percent in Europe relative to the rest of the world.” They argue that because regulation decreases ad effectiveness, “this may change the number and types of businesses sustained by the advertising-supporting Internet.” Regulation of advertising and data collection for privacy purposes, it seems, can affect the global competitiveness of online firms.

As noted, there is a better path to balancing privacy interests and economic growth than through an onerous privacy regulatory regime. Educating and empowering consumers with more and better privacy-enhancing tools can help alleviate much of the concern about data collection or advertising intrusiveness. The most-downloaded add-on for both the Firefox and Chrome web browsers is AdBlock Plus, which blocks advertising on most sites. A host of other tools are available to block or limit various types of data collection, and every major browser has cookie control tools to help users manage data collection. Again, because privacy is a subjective condition, not everyone takes advantage of these empowerment tools, much like not every parent takes advantage of the parental control tools at their disposal to block or limit objectionable media content. In both cases, however, the crucial point is that the tools exist. Importantly, those tools need not be perfect to be preferable to government regulation, which, as noted above, can have significant downsides and unintended consequences. 

Adam Thierer is a senior research fellow in the Technology Policy Program at the Mercatus Center at George Mason University.