1. (1) A Technical Fix for Opt-out Cookies (2) Privacy and Antitrust Professor Peter Swire Ohio State University Center for American Progress Berkeley & Santa Clara Conference on Online Advertising April 18, 2008

2. A Current Issue Swire & Anton comments to FTC last week on technical issues in behavioral advertising Swire & Anton comments to FTC last week on technical issues in behavioral advertising FTC Consumer Control Principle – consumer choice FTC Consumer Control Principle – consumer choice New consumer poll on how important to be able to choose to opt out: New consumer poll on how important to be able to choose to opt out: 63% rate 10 out of 10 63% rate 10 out of 10 84% say 8 or higher 84% say 8 or higher Industry (NAI) says need consumer choice Industry (NAI) says need consumer choice But, the tool for choice is the opt-out cookie, and its broken But, the tool for choice is the opt-out cookie, and its broken

3. Not a Good Thing for Choice Monday I opt out of tracking, using an opt- out cookie Monday I opt out of tracking, using an opt- out cookie Tuesday anti-spyware software deletes all cookies Tuesday anti-spyware software deletes all cookies Wednesday I am being tracked again Wednesday I am being tracked again

4. Another Bad Thing for Choice Monday I opt out of tracking Monday I opt out of tracking Tuesday I delete all cookies Tuesday I delete all cookies Browser software now deletes the opt-out cookies Browser software now deletes the opt-out cookies Wednesday Im being tracked again Wednesday Im being tracked again

5. What to Do About It Our comments to FTC explain simple technical fixes for anti-spyware & browser software Our comments to FTC explain simple technical fixes for anti-spyware & browser software We acknowledge problems with opt-out cookie approach, but thats the technically feasible & scalable approach now We acknowledge problems with opt-out cookie approach, but thats the technically feasible & scalable approach now If dont do the technical fix, then industry & the FTC arent meeting their consumer choice goal If dont do the technical fix, then industry & the FTC arent meeting their consumer choice goal

6. Antitrust & Privacy: The Basic Idea Basic idea: Basic idea: Price competition is part of antitrust Price competition is part of antitrust Non-price competition is part of antitrust Non-price competition is part of antitrust Privacy can be a form of non-price competition Privacy can be a form of non-price competition All 5 FTC Commissioners recognized this idea in the Google/DoubleClick opinion All 5 FTC Commissioners recognized this idea in the Google/DoubleClick opinion So, privacy considerations will be part of antitrust analysis going forward So, privacy considerations will be part of antitrust analysis going forward

7. Intro on Privacy & Antitrust My background – teach antitrust & law review draft on this for June My background – teach antitrust & law review draft on this for June Other arguments for how privacy matters to antitrust Other arguments for how privacy matters to antitrust – Sen. Kohl: privacy and be skeptical of bigness – Rotenberg: privacy as fundamental right – Microsoft last fall: beware of exclusionary conduct My approach: privacy as form of non-price competition My approach: privacy as form of non-price competition

8. History of Privacy & Antitrust Traditionally, mergers were for products Traditionally, mergers were for products – Exxon/Mobil – Beer manufacturers – Etc. Information about individuals was not a major factor in the mergers Information about individuals was not a major factor in the mergers Practices about personally identifiable information were not a major factor in the businesses Practices about personally identifiable information were not a major factor in the businesses

9. My Approach: Privacy as Non-Price Competition NY Times May 2007: Strictly speaking, privacy is not an antitrust issue NY Times May 2007: Strictly speaking, privacy is not an antitrust issue Swire testimony for FTC Town Hall in October, 2007, online at americanprogress.org Swire testimony for FTC Town Hall in October, 2007, online at americanprogress.org The basic idea: The basic idea: Privacy can be an important aspect of competition Privacy can be an important aspect of competition Where it is, then a merger or other practice can reduce competition, triggering antitrust scrutiny Where it is, then a merger or other practice can reduce competition, triggering antitrust scrutiny

10. Price and Non-Price Traditional focus on price competition Traditional focus on price competition Would G/DC merger affect prices of online advertising? Would G/DC merger affect prices of online advertising? Longstanding antitrust attention to non-price competition Longstanding antitrust attention to non-price competition Imagine an agreement not to compete on warranties Imagine an agreement not to compete on warranties Or, a merger where competition on warranties would be greatly reduced Or, a merger where competition on warranties would be greatly reduced On those facts, there would be an antitrust injury to consumers On those facts, there would be an antitrust injury to consumers

11. Non-Price and Quality DOJ 2001 speech where price is synecdoche DOJ 2001 speech where price is synecdoche – Price stands for the full range of issues that can affect competition in a market – Quality of a product one example, such as if quality of shirts would decline due to merger Privacy as quality of a product or service Privacy as quality of a product or service – One quality of a service, such as surfing the net, is whether it is high-surveillance or low- surveillance – Consumers who care about privacy are harmed if there is less competition on privacy, and privacy protections decline

12. 2 Key Questions Is privacy a non-price factor (a quality of a product or service) that is important to consumers? Is privacy a non-price factor (a quality of a product or service) that is important to consumers? Will the merger or other action reduce competition in privacy, creating antitrust injury to consumers? Will the merger or other action reduce competition in privacy, creating antitrust injury to consumers?

13. Does Privacy Matter? Quite possibly yes Quite possibly yes Personal information practices – privacy & security – clearly more important in the information economy Personal information practices – privacy & security – clearly more important in the information economy Westin surveys consistently show: Westin surveys consistently show: High privacy concern group at 25-40 % High privacy concern group at 25-40 % Large medium privacy concern group as well Large medium privacy concern group as well For these diverse consumer preferences, there is competitive advantage to having a good privacy reputation For these diverse consumer preferences, there is competitive advantage to having a good privacy reputation

14. Competition in Privacy? Again, often yes Again, often yes Search privacy 2007-08: Search privacy 2007-08: Google announcement on deleting logs Google announcement on deleting logs Microsoft announcement on logs & other issues Microsoft announcement on logs & other issues Ask announcement of AskEraser Ask announcement of AskEraser This is evidence of competition on privacy, by major players, in a major market This is evidence of competition on privacy, by major players, in a major market

15. What Implications for Antitrust? Have just said: Have just said: – Privacy as potentially important non-price factor – Evidence of competition on privacy Clayton Act § 7, for mergers: may substantially affect competition Clayton Act § 7, for mergers: may substantially affect competition This is the logic of how a merger could reduce competition in privacy, affecting competition in a significant non-price way This is the logic of how a merger could reduce competition in privacy, affecting competition in a significant non-price way – Could be reason to block a merger – Or, place conditions on a merger, to assure no harm to privacy

16. Current Mergers I have specifically not taken a position on the facts for Google/DoubleClick or Microsoft/Yahoo I have specifically not taken a position on the facts for Google/DoubleClick or Microsoft/Yahoo I have done work for companies potentially affected by these theories – the views here are mine, as an academic I have done work for companies potentially affected by these theories – the views here are mine, as an academic My point – is part of the job for antitrust agencies to look at privacy as a non-price aspect of competition My point – is part of the job for antitrust agencies to look at privacy as a non-price aspect of competition The agencies receive confidential information & presentations The agencies receive confidential information & presentations Those on the outside thus dont see critical information on market definition and market effects Those on the outside thus dont see critical information on market definition and market effects

17. FTC Decision on Google/DoubleClick Majority upheld Google/DoubleClick merger (4 votes) Majority upheld Google/DoubleClick merger (4 votes) It specifically referenced the approach here: We investigated the possibility that this transaction could adversely affect non-price attributes of competition, such as consumer privacy. It specifically referenced the approach here: We investigated the possibility that this transaction could adversely affect non-price attributes of competition, such as consumer privacy. Accepted the analysis, but held the facts not there Accepted the analysis, but held the facts not there Commissioner Harbour dissented Commissioner Harbour dissented She cited my testimony, saying antitrust law should ensure competition based on privacy protections or related non-price dimensions. She cited my testimony, saying antitrust law should ensure competition based on privacy protections or related non-price dimensions.

18. Second Requests Another important way that privacy may well become part of antitrust cases Another important way that privacy may well become part of antitrust cases Commr. Harbour: companies seeking a merger in data-rich industries may receive detailed questions about privacy in second requests Commr. Harbour: companies seeking a merger in data-rich industries may receive detailed questions about privacy in second requests Companies can thus expect to provide detailed answers and data about their privacy practices, and how the merger will affect those practices Companies can thus expect to provide detailed answers and data about their privacy practices, and how the merger will affect those practices A new role for the CPO in mergers & other transactions A new role for the CPO in mergers & other transactions

19. To Recap Significant, but limited, effects of privacy issues on mergers & other antitrust analysis Significant, but limited, effects of privacy issues on mergers & other antitrust analysis The significant effects: The significant effects: Unanimous FTC support for the idea that antitrust law should examine whether any loss of competition in privacy due to the merger Unanimous FTC support for the idea that antitrust law should examine whether any loss of competition in privacy due to the merger Increased questions likely as part of mergers about privacy practices, and thus a role for CPOs as part of the antitrust due diligence Increased questions likely as part of mergers about privacy practices, and thus a role for CPOs as part of the antitrust due diligence

20. Limits of This Antitrust Approach This approach fits within existing U.S. law, with focus on competition & antitrust injury to consumers This approach fits within existing U.S. law, with focus on competition & antitrust injury to consumers – Not treating privacy as a fundamental right – Not a free-floating investigation into privacy practices Section 7 looks to the effect of the merger Section 7 looks to the effect of the merger – If privacy practices are lousy, but unchanged by the merger, then antitrust authorities dont intervene

21. More to Explore Issues for possible discussion: Issues for possible discussion: – How should we assess the likelihood that a merger will reduce competition for privacy? – How should we weigh possible harm to privacy felt by some consumers with possible benefits to consumers from more intensive personalization? – How well will antitrust agencies deal with these privacy-based problems? Would the FTC do better at this than DOJ? Let the debates begin Let the debates begin