Ready for a good news/bad news joke? Here goes.
Legislators in California have introduced a "Right to Know Act” that would compel companies operating in the state to disclose any data they have collected about you, as well as the names of any other organizations to whom they’ve disclosed that information over the past year. Organizations would have 30 days to respond with the names and contact info for any business that has your data.
It’s actually an amendment to existing California privacy law that extends the law to any company that retains information, not simply the original collector of it. The new law defines “personal information” as not merely name or email, but also “age, gender, race, income, health concerns, and recent purchases.” And it gives private citizens and law makers the right to sue for damages if the law is ignored.
Sounds reasonable, right? That’s the good news.
Now for the bad: Most of the companies that retain information about us have no direct business relationship with us. They have no idea who we are, and most of us have no idea who they are. In fact, the vast majority of the 1300-odd companies that track users across the Internet wouldn’t be able to respond to a request for data under this statute, even if they wanted to, because the data was collected anonymously. And that makes most of this moot. According to the new language being proposed:
A business is not obligated to provide information to the customer pursuant to subdivision (a) if the business cannot reasonably verify that the individual making the request is the customer.
Let’s take the site you’re now reading as an example. The Ghostery browser plugin identified 18 trackers on ITworld.com alone, ranging from a company called Adhere to one known as ValueClick Mediaplex. Not exactly household names to anyone outside the Internet advertising community.
But ValueClick describes itself as “one of the largest and most trusted display advertising networks in the world,” reaching nearly 600 million unique visitors per month. It operates as both an online behavioral advertising (OBA) company that collects demographic information anonymously, and a lead generation firm that collects very identifiable information. I don’t know which of those is at work here. Maybe both.
But you’re not ValueClick’s customer, you’re ITworld’s customer. And in fact, ValueClick may not even have a direct relationship with ITworld either. According to the most recent Evidon Global Tracker Report, more than half of the tracking cookies deposited on users’ hard drives are left there by third party companies brought in by big ad networks like DoubleClick. In other words, they’re uninvited guests, sucking up your information and then using it for Lord only knows what purpose. Demanding to know what ITworld knows about you, and what it’s shared with others, probably won’t get any closer to the answer. Even ITworld may not know.
But if the data is collected anonymously, there’s no harm, right? Not exactly. As we perform more and more transactions across the Net, Web sites and the algorithms that power them won’t need to know your identity to make decisions about you. All they need to do is deposit the right cookie that marks you as, say, a luxury buyer who can afford to pay a few dollars more for a hotel room or flags you as a questionable credit risk.
So when you’re planning your next vacation or looking to get pre-qualified for a loan, that cookie can tell the Web site to display higher prices or deny your application. You’d never be the wiser. You’d never know how it happened or why. You may well have a Right to Know, but having the right -- and being able to actually exercise it -- are two vastly different things.
It is a joke, just not a very funny one.
Got a question about social media or privacy? TY4NS blogger Dan Tynan may have the answer (and if not, he’ll make something up). Visit his snarky, occasionally NSFW blog eSarcasm or follow him on Twitter: @tynanwrites. For the latest IT news, analysis and how-to’s, follow ITworld onTwitter and Facebook.
Now read this: