Last week, at a Committee on the Judiciary hearing, lawmakers were seeking answers from witnesses on how companies profit from users’ personal data. They also want to know whether consumers should be given more choice in the matter, as Congress considers a future federal privacy law.
The hearing, entitled GDPR & CCPA: Opt-ins, Consumer Control, and the Impact on Competition and Innovation, began with a brief introduction by Chairman Graham, who then invited Senator Dianne Feinstein, D-Calif., to make her opening statement.
Sen. Feinstein started by saying:
“I want to be clear. I think protecting personal privacy is critical and we must do all we can to get people control over their data. The two laws that we’re reviewing today are the European Union’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA). Our goal in this hearing should be to understand what impact these laws are having and how well they’re protecting our consumers. …In the past few years, hundreds of thousands of consumers have had their sensitive personal data stolen as a result of data breaches.”
Feinstein noted the half-billion people world-wide who had been affected by major data breaches and continued by stating her concerns about the trend toward consumers’ responsibility to opt out of agreements with the businesses and online services they use, versus opting in.
Much of the day’s proceedings appeared to be focused on Google’s senior privacy counsel, Will DeVries, who gave a short presentation on Google’s privacy framework and principles. This was countered with probing questions concerning Google’s monetization of consumer data via its location-tracking technology and behavioral advertising.
Senator Josh Hawley, R-Mo., spent several minutes grilling DeVries on whether Google’s practices met with consumer expectations. Starting with the example of Google’s Android phones, Hawley asked:
“Did you think the average consumer would be surprised to learn that her location is recorded and sent to Google hundreds of times every day, even when she is not using her phone?”
DeVries clearly did not provide a satisfactory answer when he tried to explain:
“… I know that it’s a complicated topic and that we could communicate it better …I don’t think we track information to that level without communicating…”
Hawley cuts DeVries short by interjecting:
“I don’t know that it is all that complicated. I believe that when a user turns off their user information, their location history, they expect the location tracking to be off. But it’s not in fact. They don’t have a way, apparently to turn it off.”
Hawley continued with another example:
“Do you think that an average consumer who is using your products fully understands that Google builds a profile about her, tracks where she goes to work, tracks where her boyfriend lives, tracks where she goes to church, tracks where she goes to the doctor? Do you think that an average consumer would anticipate that?”
Again, DeVries attempted to respond by saying:
“…I know that we have a duty to communicate this information clearly. I don’t believe we track information at that level without communicating….”
“Do you think the user expects that? Do you think you’re communicating it clearly when a user cannot turn off their location tracking?” Hawley countered once more.
DeVries responded by saying Google’s use of location tracking is to make its services more effective, not to make money.
He added that it’s “necessary to make services work, …If we turned those off, your phone wouldn’t work like you’d expect,” and explained that the operational aspects of it are complicated.
Unfortunately for DeVries, Hawley was unimpressed, as he retorted:
“It’s not complicated, …What’s complicated is you don’t allow consumers to stop your tracking of them. You tell them that you do. …the consumer would have a reasonable expectation that they’re not being tracked, but in fact you’re still tracking them. You’re still gathering the information”
As his time was up, Sen. Hawley concluded:
“Here is my basic concern – Americans have not signed up for this, they think the products you’re offering are free. They’re not free. They think they can opt out. They can’t opt out. It’s kind of like that old Eagle’s song, ‘You can check out any time you like, but you can never leave.’ And that’s a problem for the American consumer; it’s a real problem. And for somebody who has two small kids at home, the idea that your company and others like it are sweeping up information to build a user profile on them that will track every step, every movement and monetize that, and they can’t do anything about it, and I can’t do anything about it, that’s a big problem this Congress needs to address.”
Next up, Alastair MacTaggart, Chairman of Californians for Consumer Privacy, spoke about consumers’ control of their personal data:
“It seemed to me that knowledge would inevitably lead to a desire on the part of consumers, to be able to control the information they uncovered. This conviction led to the “Right to Say No,” the right for a consumer to tell a corporation not to sell or share his or her personal information. It’s one thing to do business with a company intentionally, but I hear d from many advocates and consumers that the most objectionable part of this new, data-driven economy, was that their daily interactions ended up in the hands of hundreds of corporations they’d never heard of. The right to control who could obtain your personal information, seemed fundamental to any law designed to increase consumer privacy.”
Gabriel Weinberg, CEO of search engine, DuckDuckGo, which does not create user profiles from personal data, referred to the 50% annual growth of his company, as evidence that consumer privacy doesn’t have to be a business killer; rather, it’s a net win.
Feinstein then pressed the witnesses on whether they thought federal legislation should mandate users’ abilities to opt out, Weinberg and Mactaggart agreed. Referring to the do-not-track function, Weinberg added:
“A lot of this easy opt-out is already open to browsers, …If it was mandated, people wouldn’t have to worry about reading all these policies. Right now, hardly any company in the world respects do not track in the browser,”
Mactaggart, whose consumer privacy initiative helped to instigate what became the California Consumer Privacy Act, commented that the law’s “do not sell my info” button is the solution to the law’s “built-in do not track.” feature.
Senator Mazie Hirono, D-Hawaii, indicated her support for an opt-in scheme and asked DeVries whether Google would support this. DeVries responded that it would be very disruptive to the ad tech ecosystem. However, Senator Marsha Blackburn, R-Tenn., later said that Google is simply concerned about an opt-in regime hurting its bottom line.
Intel’s global privacy officer, David Hoffman, said he thinks that the opt-in feature is too burdensome for consumers, and while certain sensitive data might deserve an opt-in requirement, a law that is stronger than the CCPA is required, in order to protect consumers who were never even offered an opt-in choice. Intel has introduced its own version of a federal privacy bill, which would include stronger controls over third parties’ use of data. Hoffman testified:
“A new model of privacy protection that does not rely primarily on consent is needed. Data brokers are poisoning the well of trust out of which real technology companies like Intel and our customers must drink,”
However, Senator Thom Tillis, R-N.C., had some concerns about over-regulation. He said:
“If we’re not careful, we could actually have this sort of populist reaction, that at the end of the day could be to the detriment of the consumer.”
He added that he is impressed with California’s work on a privacy law but feels that it should be pre-empted by federal law. He also expressed concerns about the ability of small businesses’ and startups to survive in an over-regulated environment.
“We should make sure the most innovative nation in the history of this planet can continue to be that. We need to get this right.”
You can view a video of the hearing here.
Sources: Committee on the Judiciary,
