How Will The FTC Privacy Report Affect Your Online Marketing Efforts?
As consumers increase their online presence, businesses, including car dealers, are turning to the internet to market to new customers and generate business. Many dealers now have websites where they display current inventory and even accept credit applications. Some dealers also use online lead generation services to attract new customers. The Federal Trade Commission has recently proposed a new framework for protecting consumer privacy. Dealers with any kind of online presence should review their privacy practices in light of the report—“Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers.”
The FTC Report addresses any online activity that involves the collection and use of consumer information. Although the framework is voluntary for now, it will likely serve as a model for any future privacy regulation at the federal level. Additionally, if businesses abide by the proposed framework as a self-regulatory measure, it could deter lawmakers and regulators from adopting a more formal privacy regulation regime. As if dealers needed any more reason to take the FTC’s Privacy Report seriously
, the FTC (along with the federal banking agencies) recently revamped the Gramm-Leach-Bliley model privacy notices and obtained new rulemaking authority over dealers under the Dodd Frank Wall Street Reform and Consumer Protection Act. Dealers and privacy appear to be on the forefront of the FTC’s regulatory agenda.
The impetus for the report and the proposed framework stems largely from the FTC’s concerns about the way businesses collect and use consumer information in an online environment. Specifically, the FTC notes that the internet allows businesses to collect and use consumer information easily and at a relatively low cost. At the same time, consumers understand very little about how their online activities can result in the collection of personal information and how businesses can use that information.
For example, in offline activities, a business generally has to specifically request a consumer’s information, such that the consumer knows she is providing personal information to the business. In contrast, businesses can collect consumer information online simply by monitoring a consumer’s browsing habits. Consumers are largely unaware that this passive collection of data takes place and that it allows businesses to develop a user profile and to tailor advertising campaigns to their individual browsing habits. The FTC acknowledges that this kind of targeted advertising and the anticipation of a consumer’s wants and needs can be very valuable to consumers. In fact, consumers have expressed a desire to receive these kinds of personalized benefits. The FTC, however, wants consumers to understand how businesses collect and use their information and to have the option to choose not to share their information for this purpose.
Traditionally, the FTC has required businesses to provide consumers with notice of their privacy practices, and, in certain cases, to provide consumers with a choice to limit how the business will use their information. As privacy notices grow longer and more complex, however, consumers understand less about how businesses use their information. This means that even when businesses give them a choice to limit this use, consumers sometimes fail to make an informed choice, because they are overwhelmed by the complexity of the notices. To protect consumers, the FTC has sued businesses that have not adequately explained how they use consumer information or that fail to keep promises they made in their privacy notice. This harm-based approach only targeted the worst offenders, however, and only provided consumers with after-the-fact redress, rather than preventing the harm in the first place. Given that neither the notice and choice model, nor the enforcement or harm-based approach seem to work, the FTC decided to examine the state of privacy regulation and consider how it could change to provide better protection and more transparency for consumers.
The result is the FTC report, which involves three basic principles:
1. Privacy by Design: Businesses should incorporate measures to protect consumer information throughout their organizations and for the duration of the customer relationship. Businesses should safeguard data, collect only the data actually needed for a specific business purpose, dispose of data once it is no longer needed, and ensure accuracy of data.
2. Simplified Choice: Where consumers have a choice as to how a business will use their information, businesses should make the choices clear. Businesses do not need to offer consumers a choice in order to collect and use information for: product and service fulfillment (e.g., selling and financing a car), internal operations, fraud prevention, legal compliance, and public purpose (e.g. reporting delinquencies to credit bureaus), and first-party marketing. In any other event, businesses should offer consumers an opportunity to limit the use of their information in a clear, concise and easy to use way. The FTC specifically proposes a Do Not Track option to allow consumers to prevent the collection and use of their online browsing data.
3. Greater Transparency: Businesses should make privacy notices clearer, shorter, and more standardized to allow consumers to compare information collection and use practices between businesses. Businesses should also provide consumers with reasonable access to the information they maintain. Businesses should inform consumers and obtain their consent before using any information in a way that differs from the initial disclosure. Finally, businesses should attempt to educate consumers about data privacy practices.
The FTC has solicited comments on this proposed framework and expects to issue a final report in 2011. Dealers that operate online should consider the FTC’s proposal and how they can implement these principals into their business. At a minimum, this proposal will likely serve as a self-regulatory regime that all businesses should follow. However, chances are that the FTC or Congress will take a more formal approach and make this framework law.
In addition, although dealers have not typically attracted much attention at the national level, they are likely to be in the FTC’s crosshairs in the near future. The Dodd Frank Wall Street Reform and Consumer Protection Act gave the FTC new expanded authority to regulate dealers. The FTC has also been especially focused on privacy recently as evidenced by the new Gramm-Leach-Bliley model privacy forms. Clearly, dealers and privacy are at the top of the FTC’s regulatory agenda and dealers should take note.
Meghan Musselmanis a partner in the Maryland office of Hudson Cook, LLP. She represents motor vehicle dealers, sales finance companies, and lenders engaged in motor vehicle finance transactions, as well as trade associations. Meghan can be reached at 410-865-5403 or by email at email@example.com.