(1) “A Technical Fix for Opt-out Cookies” (2) “Privacy and Antitrust”

1. (1) “A Technical Fix for Opt-out Cookies”(2) “Privacy and Antitrust” Professor Peter Swire Ohio State University Center for American Progress Berkeley & Santa Clara Conference on Online Advertising April 18, 2008

2. A Current Issue • Swire & Anton comments to FTC last week on technical issues in behavioral advertising • FTC “Consumer Control Principle” – consumer choice • New consumer poll on how important to be able to choose to opt out: • 63% rate 10 out of 10 • 84% say 8 or higher • Industry (NAI) says need consumer choice • But, the tool for choice is the opt-out cookie, and it’s broken

3. Not a Good Thing for Choice • Monday I opt out of tracking, using an opt-out cookie • Tuesday anti-spyware software deletes all cookies • Wednesday I am being tracked again

4. Another Bad Thing for Choice • Monday I opt out of tracking • Tuesday I delete “all cookies” • Browser software now deletes the opt-out cookies • Wednesday I’m being tracked again

5. What to Do About It • Our comments to FTC explain simple technical fixes for anti-spyware & browser software • We acknowledge problems with opt-out cookie approach, but that’s the technically feasible & scalable approach now • If don’t do the technical fix, then industry & the FTC aren’t meeting their “consumer choice” goal

6. Antitrust & Privacy: The Basic Idea • Basic idea: • Price competition is part of antitrust • Non-price competition is part of antitrust • Privacy can be a form of non-price competition • All 5 FTC Commissioners recognized this idea in the Google/DoubleClick opinion • So, privacy considerations will be part of antitrust analysis going forward

7. Intro on Privacy & Antitrust • My background – teach antitrust & law review draft on this for June • Other arguments for how privacy matters to antitrust • Sen. Kohl: privacy and be skeptical of bigness • Rotenberg: privacy as fundamental right • Microsoft last fall: beware of exclusionary conduct • My approach: privacy as form of non-price competition

8. History of Privacy & Antitrust • Traditionally, mergers were for products • Exxon/Mobil • Beer manufacturers • Etc. • Information about individuals was not a major factor in the mergers • Practices about personally identifiable information were not a major factor in the businesses

9. My Approach:Privacy as Non-Price Competition • NY Times May 2007: “Strictly speaking, privacy is not an antitrust issue” • Swire testimony for FTC Town Hall in October, 2007, online at americanprogress.org • The basic idea: • Privacy can be an important aspect of competition • Where it is, then a merger or other practice can reduce competition, triggering antitrust scrutiny

10. Price and Non-Price • Traditional focus on price competition • Would G/DC merger affect prices of online advertising? • Longstanding antitrust attention to non-price competition • Imagine an agreement not to compete on warranties • Or, a merger where competition on warranties would be greatly reduced • On those facts, there would be an antitrust injury to consumers

11. Non-Price and Quality • DOJ 2001 speech where price is “synecdoche” • Price stands for the full range of issues that can affect competition in a market • Quality of a product one example, such as if quality of shirts would decline due to merger • Privacy as quality of a product or service • One quality of a service, such as surfing the net, is whether it is high-surveillance or low-surveillance • Consumers who care about privacy are harmed if there is less competition on privacy, and privacy protections decline

12. 2 Key Questions • Is privacy a non-price factor (a quality of a product or service) that is important to consumers? • Will the merger or other action reduce competition in privacy, creating antitrust injury to consumers?

13. Does Privacy Matter? • Quite possibly yes • Personal information practices – privacy & security – clearly more important in the information economy • Westin surveys consistently show: • “High privacy concern” group at 25-40 % • Large “medium privacy concern” group as well • For these diverse consumer preferences, there is competitive advantage to having a good privacy reputation

14. Competition in Privacy? • Again, often yes • Search privacy 2007-08: • Google announcement on deleting logs • Microsoft announcement on logs & other issues • Ask announcement of AskEraser • This is evidence of competition on privacy, by major players, in a major market

15. What Implications for Antitrust? • Have just said: • Privacy as potentially important non-price factor • Evidence of competition on privacy • Clayton Act § 7, for mergers: “may substantially affect competition” • This is the logic of how a merger could reduce competition in privacy, affecting competition in a significant non-price way • Could be reason to block a merger • Or, place “conditions” on a merger, to assure no harm to privacy

16. Current Mergers • I have specifically not taken a position on the facts for Google/DoubleClick or Microsoft/Yahoo • I have done work for companies potentially affected by these theories – the views here are mine, as an academic • My point – is part of the job for antitrust agencies to look at privacy as a non-price aspect of competition • The agencies receive confidential information & presentations • Those on the outside thus don’t see critical information on market definition and market effects

17. FTC Decision on Google/DoubleClick • Majority upheld Google/DoubleClick merger (4 votes) • It specifically referenced the approach here: “We investigated the possibility that this transaction could adversely affect non-price attributes of competition, such as consumer privacy.” • Accepted the analysis, but held the facts not there • Commissioner Harbour dissented • She cited my testimony, saying antitrust law should ensure competition “based on privacy protections or related non-price dimensions.”

18. Second Requests • Another important way that privacy may well become part of antitrust cases • Commr. Harbour: companies seeking a merger in data-rich industries may receive detailed questions about privacy in “second requests” • Companies can thus expect to provide detailed answers and data about their privacy practices, and how the merger will affect those practices • A new role for the CPO in mergers & other transactions

19. To Recap • Significant, but limited, effects of privacy issues on mergers & other antitrust analysis • The significant effects: • Unanimous FTC support for the idea that antitrust law should examine whether any loss of competition in privacy due to the merger • Increased questions likely as part of mergers about privacy practices, and thus a role for CPOs as part of the antitrust due diligence

20. Limits of This Antitrust Approach • This approach fits within existing U.S. law, with focus on competition & antitrust injury to consumers • Not treating privacy as a fundamental right • Not a free-floating investigation into privacy practices • Section 7 looks to the effect of the merger • If privacy practices are lousy, but unchanged by the merger, then antitrust authorities don’t intervene

21. More to Explore • Issues for possible discussion: • How should we assess the likelihood that a merger will reduce competition for privacy? • How should we weigh possible harm to privacy felt by some consumers with possible benefits to consumers from more intensive personalization? • How well will antitrust agencies deal with these privacy-based problems? Would the FTC do better at this than DOJ? • Let the debates begin