I consent: search, privacy, behavioural advertising and the Cookie Directive

1. I consent: search, privacy, behavioural advertising and the Cookie Directive Andrew McStay School of Creative and Media Studies, Bangor University, UK Interdisciplinary privacy course, KU Leuven 2012

2. Privacy and search: context • Changes in advertising • Economic • Industry organisation • Potential for merges between creativity and behavioural strategies? • Commodification of informational mobility • Homogeneity vs. heterogeneity • Not just demographic and psychographic signifiers, but phenomenological: • experience, preferences, desires, orientations, semantics, moods and sentiments that reflect ways of being, or what we might conceive in terms of interiority

3. Opt-out vs. opt-in?

4. Privacy: who cares anyway? • Industry: rational actors/traditional economics • Problems: • Awareness of processing? • Sharing/trading • Lifecycle • Value • Disclosure for one but not the other • Heuristics/cognitive limitations/behavioural biases/time • Too complicated? • Who do we complain to anyhow if we feel privacy has been violated?

5. Key change in European policy • The past version of Article 5(3), states: access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that thesubscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. • The new version of Article 5(3), states: gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing.

6. Article 29 Working Party on consent (see Opinion 15/2011 on the definition of consent ) • Affirmative action (opt-in where one clicks to assent rather than leaving as is) • Freely given, specific and informed • Consent has to be given before the data gathering starts (prior?) • Data should not be repurposed, sold on or used for any other purpose than that which was actively consented to • Similar to medical consent: understandable, upfront, easily available and active, not passive (e.g. leaving a box unticked)

7. The UK’s approach to the matter 6 (1) Subject to paragraph (4), a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met. • (2) The requirements are that the subscriber or user of that terminal equipment-- • (a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and • (b)has given his or her consent. • What happened to “prior”? • How then should we best define consent?

8. Conceptualising consent • Deontology, autonomy and freedom (Kant) • freedom: underpinned by a belief in autonomy, self-mastery, free choice, voluntariness, privacy and accepting responsibility for one’s choices. • ‘Act in such a way that you treat humanity, whether in your own person or in the person of another, always at the same time as an end and never simply as a means’ (Kant, 1993 [1785]: 23). • Opposed to pragmatism where ethics are subject to change (see Richard Rorty for example, although for Rorty privacy is close to being intrinsically important) • So: • nothing wrong with using people as a means to advance one’s goals as long as people’s rights are also respected

9. Defining consent: political philosophy (John Locke) • Tacit vs. expressed consent • Expressed: clearly given • Tacit: silently given as users enjoy services and platforms • Default position of the search and behavioural advertising industry, and the trade associations that represent them • By dwelling in the dominion or domain of those who use third-party cookies, consent is deemed to have been granted. • If people have not actively dissented, then consent has been obtained. Silence and doing nothing has been, until recent changes in legislation, the default position on consent. • This is consent by contract: i.e. if I use your service, you get to take my data. • This is “contractual theory”

10. Problems with contractual theory • Contracts are undefined, so the nature of relations between users and behavioural advertisers and third-party operators cannot be characterised by consent. • Akin to: • ‘We may as well assert, that a man, by remaining in a vessel, freely consents to the dominion of the master; tho’ he was carry’d on board while asleep...’ (David Hume, 1753: 313). • Can we dissent if we are asleep? • Does it follow that being somewhere constitutes consent? • Consent: cannot be passively given, but only be actively given

11. Lessons from health • Privacy is not negative (what is being hidden?), but positive (dignity, autonomy, freedom and boundary maintenance) • It is about control • Consent is upfront • It is informed: • deception of any form guarded against • voluntary consent is impossible when the participant is captive • no greater good (for example, benefit to wider society or progression of science) • Mid-operation consent?!

12. Conclusion • Consent by definition has to be clear and upfront. • It this does not happen something else has taken place? An act of force perhaps?