Disclosing Data Collection Practices: is an Opt-Out Program Enough?
Verizon Wireless announced last Friday that its customers will soon be able to opt out of the tracking identifiers Verizon uses to target ads at its customers. These tracking identifiers, dubbed supercookies, are unique customer codes that track customer internet activities. Verizon’s move to an opt-out system for its ad targeting is a major change for the company.
Whether Verizon’s opt-out program will adequately address issues related to the disclosure of Verizon’s data collection policies in an open question depending on the nature and manner of disclosure. Several recent district court decisions shed some light on whether the affected consumer has received sufficient disclosure about the data collection involved:
- On December 23, 2014, Facebook lost its motion to dismiss against plaintiff Facebook users who claimed that Facebook is scanning users’ private messages for advertising purposes. U.S. District Judge Phyllis J. Hamilton in the Northern District of California found that Facebook’s consent agreement was insufficient to establish user consent to Facebook’s scanning activities because Facebook simply disclosed that it “can use the information [it] received about” users for “data analysis.”
- On the other hand, Google Inc. won a decision in March 2014 by U.S. District Judge Lucy H. Koh in the Northern District of California. Though Judge Koh had previously denied Google’s motion to dismiss the case in its entirety, she denied class certification in a suit challenging Google’s policy for scanning and mining emails for advertising purposes in violation of the Electronic Communications Privacy Act. Judge Koh held that the user class could have been exposed to differing disclosures related to Google’s scanning and mining policy and, thus, individualized inquiries would overwhelm the common questions required for class cert.
Regardless of how a company tracks customer data, careful attention should be paid to the disclosures about collecting and using customer data. Those terms are often disclosed in various places, including terms and conditions, click through/clickwrap agreements, or End User License Agreements, but the manner in which they are disclosed can make a difference.