Evan Schuman's StorefrontBacktalk

• Opt-in for sensitive data: The new guidelines would provide that merchants would have to obtain express consent of the consumer before they use sensitive data – for example, data about children, health or finances. However, as companies merge – with health insurers acting as banks, etc., the same company collects the sensitive information. A better approach is that the information collected can ONLY be used for the purpose for which it has been collected without the specific consent of the consumer. If I buy a widget online, I expect the merchant to need my name and address for shipping, and my credit card for payment. Once the sale is completed and the item is shipped and accepted, do they REALLY need the information anymore?

What is Missing

The big thing missing from these voluntary guidelines was pointed out by Saul Hansell of the New York Times. There is no mechanism for a consumer to know what information about them has been collected, stored, shared or distributed, and with whom it has been shared. Most people don’t care about this because they are blissfully unaware of the threat to their privacy. For example, when the data broker ChoicePoint suffered a breach several years ago, consumers were not up-in-arms because they had no idea what kind of information ChoicePoint had about them.

If consumers could see what advertisers and behavioral marketers know – or, in the near future, could know – about them, they might be shocked and outraged. Marketers can know, for example, that six years ago I was searching for information about liver failure (for a research paper, but they wouldn’t know that.) They might know that I like electronics, read liberal and conservative political blogs (and how often I read each) and where I’m physically situated when I do this.

They can collect, combine, collate and cross-reference this data, creating a valuable profile of me and my activities – both online and off. They can combine this data with a background investigation, scouring public records to find out my real estate holdings, past residences, educational information, licensing and litigation history and even who my cell phone provider might be. The data can go back as far as they have records and be kept and shared for so long as they feel there is a business need or a law enforcement need.

Consumers have no way to access this information about themselves. This transparency is necessary in order for the consumer to adequately decide whether they truly want to enter into these bargains with merchants and Web providers. The merchants and behavioral advertisers rely on the fact that consumers don’t know what they are giving up.

Reversing the Bargain

What’s worse is that, if consumers are unhappy with their end of the bargains they have no effective recourse. For example, in order to drive traffic to its new search engine, “Bing,” Microsoft announced a program called “Bing Cashback” where consumers who used Bing to search for products or services, and clicked on specific “sponsored links” to Microsoft’s business partners, could buy products at a discount – sometimes a substantial discount.

In fact, as soon as the new Apple iPhone 3GS was announced, I bought two of them, and a third phone, from AT&T through the Bing site, hoping to take advantage of the Bing Cashback discount. However, Microsoft contended I didn’t complete the transaction in a “single Web session,” as required in the Bing contract, because – during the course of my making the order, I was redirected back to Bing to provide additional personal information. So Microsoft gave me no discount or “cashback,” but still got my personal information and had induced me to buy the phone on the AT&T site instead of at Best Buy, where I could have used a bunch of gift certificates I’d accumulated and wouldn’t have had to wait a week for delivery.

Yes, I can return the phones for a refund if I want. But how do I get back from Microsoft my personal information? How do I get it back from AT&T? How do I make sure that it isn’t used in any way? That’s the problem with the information-for-reward “bargain.”

There is an old saying that if something looks too good to be true it probably is. The same is true of these programs that trade privacy for small discounts – the discount may or may not come, but the privacy violation continues indefinitely.