In 2009 the European Parliament passed a Directive, which require business to obtain the consent of a consumer (i.e. consumers must actively opt-in) in order to store or access information on his or her computer.
A fight has broken out between the self-regulatory body of the industry (IAB) and the regulator (OPTA), for the hearts and minds of our politicians and the public (you).
By breaking the discussion down into three different aspects I want to try to untangle the confusion and bring some insights in what is going on here.
- Discussion on the practical implementation
- Discussion on online privacy
- Discussion on regulation: Self versus State
This is part 2 of the series: Discussion on online privacy
The current discussion around the cookie law is complicated by a parallel discussion on online privacy. The big debate is whether information related to a computer is or should be considered personal data.
Personal Data
The EU has one of the most stringent privacy protection laws in the world. The scope of these laws is what we call personal data, meaning information related to a natural person. For instance, your name, address, phone number, social security number and your fingerprints are all personal data, since all of them can be used to identify you as an individual. In, I admit, an extreme simplification of the EU privacy laws covering this type of data, it is useful to understand three guiding principles:
- Clearly explain what the purpose is of the personal data you collect and get permission
- Only collect personal data for that purpose and only use it for that purpose
- The personal data is not yours, as a good custodian keep the personal data safe and protected and only keep it for as long as you need it for the stated purpose
If any information related to a computer, for example using a cookie or an IP address, is considered personal data than these stringent laws should apply. In that case a cookie law or any other law on top of the privacy law is just superfluous for protecting our privacy online. But you can argue that information related to a computer is anonymous information, not personal data, so these laws do not apply. To put it simple: you have no way of knowing who the individual is sitting behind the computer at any given moment.
How personal is a computer?
It’s hard to tell exactly. I am the only person that uses my work laptop (as far as I know, the EU directive is aimed at protecting my laptop from secretly installed software that uses my computer without me knowing about it). This natural person is not the private-me but the business-me. My iPad during the day is the same business-me but in the evening it can be my 4 year old daughter playing online games. The computer in my home can be anybody, including friends and family.
OPTA in her report seems to regard profiling information related to a cookie that is used for advertising purposes as personal data, subject to the stringent privacy laws. Maybe in the digital age, where more and more of our live is lived in cyberspace, information related to a personal computer is indeed the online identity of an individual. I am just not convinced that this view currently is a legally accepted definition of personal data supported by appropriate jurisprudence. Furthermore, the ramifications of this position are enormous and will impact the very fabric of the internet.
IP Address is not a telephone number
You can skip the next paragraph if you know all about IP addresses.
An Internet Protocol (IP) address is an address for any device on the Internet, which exists to allow data to be delivered to that device. So when a website needs to send your computer something, it needs your IP address to send it to the right computer. The often heard statement that an IP address is the same as a telephone number is wrong. A telephone number is personal; any given IP address is used by numerous people because the IP addresses that people use can change frequently. Your Internet service provider (ISP) may have a block of 20,000 IP addresses and 40,000 customers. Since not everyone is connected at the same time, the ISP assigns a different IP address to each computer that connects, and reassigns it when they disconnect (the actual system is a bit more complex, but I promised to keep it simple).
How personal is an IP address?
Back to the burning question: is an IP address personal data, or, in other words, can you figure out who someone is from an IP address? The statement that all IP addresses are always personal incorrectly suggests that every IP address can be associated with a specific individual. The IP addresses recorded by every website on the planet without additional information should not be considered personal data, because these websites usually cannot identify the human beings behind these number strings.
However, if you’re an Internet Service Provider (ISP), like KPN or UPC, and you assign an IP address to a computer that connects under a particular subscriber’s account, and you know the name and address of the person who holds that account, then that IP address is more like personal data, even though multiple people could still be using the computer. ISP’s are obligated by law to store the IP addresses they assign for law enforcement purposes; the government will use that information against you if you do bad stuff online or offline. But I think it is legally stretching it a bit to say that the anonymous data a website collects is personal data because someone else (the ISP) has the key to unlock the individual behind the IP Address
The impact on the fabric of the internet
Again, it is all down to asking permission. Under privacy laws you would need to ask permission before you collect personal data. There’s nothing wrong with that, until someone decides that an IP address is considered to be personal data. So before I store your IP address, I should be asking you for permission. Except that, if you visit my website, how can I ask you for permission before you visit it? The very moment your computer starts loading the page, it tells my web server the IP address it wants the page delivered to. As said, this radical position has an impact on the very fabric of the internet.
I use data analytics for the website you are now visiting and I did not ask permission to collect data from your computer. Does OPTA consider me a law breaker? Herrrr Johannes Caspar, Germany’s data protection commissioner, certainly thinks so. According to Johannes, tracking IP addresses of web users without permission should be illegal. He has already decided that Google Analytics is illegal because the “personal” data is exported out of the EU.
The scary stuff: profiling
The problem is that cookies and IP addresses allow profiling. The fact that it can be done is sufficient to make OPTA nervous and some data protection officials very upset about its use, especially in Germany. And although this data is anonymous, I do understand their concerns. The question is how many non-personal data elements become personal data? If I have an IP address, cookie or any other identifier to a computer and start tracking you and collect vast amounts of data, when do I have enough data to actually being able to identify you as an individual (name, address etc.)? If I know your gender, location, type of business, the sport you practice, your marital status, could I find out your name and address? Probably I can, with some effort, and considering that some of the profiling technologies use up to tens of thousands of attributes to segment an audience, then indeed a very rich profile will become quite unique and personally identifiable.
OPTA wants to make a distinction between group profiling (gender, interests, nationality) and individual profiling (‘looking for Hotels in Dubai’). The distinction is actually between audience data and what you can call ‘intent data’. The last data is mostly collected from web shop comparison sites and other e-commerce sites where you reveal your intent on buying something. I am not convinced that the last category is more individual than others.
Advertisers are not interested in you personally
The fact is, and that must be a little bit re-assuring for us all, that advertisers are not interested in individuals, at all. Why make all the effort to target an individual if you want to sell as much as possible? Even for intent data an advertiser will only be willing to pay if you can offer a large group of people who are looking for hotels in Dubai. So if you are profiled for advertising you are always in the comfortable anonymity of a group (you are not the only one!). If there are just a couple of individuals interested in your product or service and you need to track them down online, you should be worried more about your business than about advertising it.
Too close for comfort
But off course, some of the targeted advertising can become quite personal in the perception of the user, or weird. For some people, my father for example, it is creepy that somehow his favorite online news site suddenly seems to know that he is travelling to Lisbon (to protect the privacy of my father, I changed the destination). Partly fear based on ignorance but on the other hand perception is reality and his private comfort zone is invaded. And for some (including me) the now common practice of re-targeting using intent data (showed interest in something online but decided not to buy it, now I am targeted for this product or service constantly) is simply annoying. It feels like you walked into a shop and now the shopkeeper is following you on the street and keeps on asking you: “Do you want it? Are you sure?”. The same reason I intensely dislike visiting a Souk, but that is personal.
Privacy also means the right to be left alone. This is something the advertising industry should be worried about in terms of effectiveness and acceptance of their practices and I think lends itself perfectly for self-regulation. But more about self-regulation in the final part of the Cookie Wars.
The cookie law is not meant to regulate online advertising
The debate on online privacy has only just started and it is a very important debate that will determine much of the future digital world we will live in. The question if information related to a computer is personally identifiable information is fundamental but also very difficult because that is what the internet is designed to be; huge amounts of information related to computers. My point is that this key question should be dealt with separately from the discussion on the new EU directive as the issue of online privacy is certainly related to the cookie law, however it is not the issue they try to regulate.
The principle behind the EU directive is that a computer is personal property and that access to this property is at the discretion of the owner. If the regulator is concerned about the privacy implications of collecting information on profiles and preferences related to a computer, the current proposed law is simply inadequate. The problem is that you can collect and use this type of information using any persistent identifier to a computer, without actually storing information on the device like a cookie. Techniques like device fingerprinting, for example using information like IP address in combination with browser type and settings, are well known alternatives for cookies.
I am not saying that the lawmakers overlooked this and made a mistake. I am just saying that regulating targeted advertising was not the intent and purpose of the EU directive. So in my view it is confusing and a mistake to make online privacy part of the discussion on the cookie law or try to regulate targeted advertising with a law that is not meant to do that.
To be continued
