Parity in Consumer Information Collection

Paul Misener, Vice President, Global Public Policy
Amazon.com

Parity in Consumer Information Collection [pdf]

Much of the discussion about privacy protection for consumer information has centered on the application of fair information practices to the collection and sharing of data about consumers. However, as discussions have moved toward questions about the appropriateness of legislation to protect consumer privacy, considerably more attention has been paid to whether that legislation should apply to information collected online, offline, or both. This paper will discuss why, in the interest of fairness to consumers and businesses, people from all sides of the legislative debate have come to recognize that privacy law must be applied equally to information collected in both the offline and online environments.

The sensitivity of consumer information is not determined by the medium through which it is collected. The fact that a consumer last year purchased both a pair of blue jeans and a cordless drill is not affected by whether this fact was learned online (e.g., through a website purchase) or offline (e.g., through an in-store credit card transaction or mail-in warranty registration card).

It thus would be unfair and potentially very misleading to consumers to treat the privacy of such information differently based solely on the medium of collection. Unfortunately, however, many proposals to regulate the privacy of consumer information have been limited to online collection.

Even if the term online had clear meaning in today's world of converging technologies (is a communication via web-enabled mobile phone or a virtual private network online or not?), transactions of the face-to-face, mail-order, and telephone-based varieties still account for some 98% of consumer purchases. An online-only approach to privacy, therefore, would completely miss the vast majority of consumer transactions. Moreover, online shopping simply is not available to many consumers with limited financial resources or educational backgrounds. It would be perversely unfair to treat their information differently merely because they are not able to shop via a particular medium. Lastly, it also would be unfair to a particular mode of commerce and, indeed, to particular companies, to saddle a certain medium of consumer information collection with regulatory burdens not applied to the same information collection conducted through other media.

It has been said, however, that the online medium is sufficiently different from other media to justify disparate regulatory treatment. The key difference, it often is assumed, is the online environment's heavy use of data processing computers. But this distinction is illusory, at best. Companies that collect consumer information offline store, process, and disseminate that information using sophisticated computer databases, programs, and transmission technologies.

Of course, to the extent there are real differences among information collection media, different regulatory treatment may Ð but not necessarily Ð be in order (just as blue cars are not regulated differently from green cars, some differences among media are not worthy of disparate rules). And, again, in fairness to consumers and companies, if discriminatory rules are adopted, they should be limited to the actual and important differences between online and offline media.

Some differences give consumers more privacy while online than while offline. For example, offline consumers reveal their physical location: although online companies have no way to track their customers around the country, gasoline companies routinely do exactly that. And, unlike while online, consumers in the brick-and-mortar environment reveal their physical characteristics including sex and race; whether they are pregnant or anorexic; how well they dress; and whether they have acne.

The one key difference that potentially gives online consumers less privacy protection is the availability of so-called click-stream information, by which a website operator can observe what individual visitors to their site see while visiting. In the retail context, this means web-based retailers can tell what a customer looks at, not just what he buys. Many retailers have turned this technical capability into customer-friendly personalization features that enhance the online shopping experience. But it is important to recognize that, if a consumer is particularly concerned about the collection of personal information at a website, she easily may cloak her identity by disabling the cookie functionality on her computer's software or by using any of a variety of free online anonymizing services.

In sum, consumer information itself is the same regardless of the medium through which it is collected and, thus, in fairness to consumers and commercial entities, the privacy of such information should be treated the same. If any disparate regulatory treatment of online and offline information is warranted, it must be limited to the few actual and important differences between information collection via those media.