At a U.S. Senate Committee on the Judiciary hearing Tuesday, lawmakers sought answers from witnesses on the ways companies are monetizing users' personal data and whether consumers should have more choice in the matter as Congress looks toward crafting a federal privacy law — at some point.
At the outset of the hearing, called "GDPR & CCPA: Opt-ins, Consumer Control, and the Impact on Competition and Innovation," Sen. Dianne Feinstein, D-Calif., said she's concerned with the global trend toward consumer obligations to opt out of agreements with the companies and services they use versus opting in. Notably, much of the day's questioning focused on Will DeVries, senior privacy counsel for Google.
Lawmakers seemed especially concerned with Google's monetization of consumer data via behavioral advertising and its location-tracking policies.
Sen. Josh Hawley, R-Mo., spent his five minutes drilling DeVries on whether Google's practices aligned with consumer expectations. Hawley had just that day released legislation with Sen. Ed Markey, D-Mass., that would update the Children's Online Privacy Protection Act by expanding protections by requiring companies to be more transparent about how they're tracking kids online, prevent them from targeting ads toward them, and changing the age threshold from 13 to 15.
Hawley's line of questioning, direct and passionate, began with asking DeVries if he thinks a user would be surprised that Google is tracking them using location data, even if the user is not using a service like a map app and has location services turned off.
He wanted to know whether DeVries thought a user would expect that Google tracks "where she goes to work, where her boyfriend lives, where she goes to church" or to the doctor. "Do you think the user expects that? Do you think you're communicating it clearly when a user cannot turn off their location tracking?"
DeVries said Google's use of location tracking is to make its services more effective, not to make money.
It's "necessary to make services work," DeVries said. "If we turned those off, your phone wouldn’t work like you’d expect," adding that the operational aspects of it are complicated
But Hawley wasn't satisfied with that.
"It’s not complicated," he said. "What’s complicated is you don’t allow consumers to stop your tracking of them."
He continued, "Here is my basic concern: Americans have not signed up for this, they think the products you’re offering are free; they’re not free. They think they can opt out; they can’t opt out. It's kind of like that old Eagle's song, 'You can check out any time you like, but you can never leave.' And that’s a problem for the American consumer; it’s a real problem. And for somebody who has two small kids at home, the idea that your company and others like it will sweep up information to build a user profile on them that will track every step, every movement and monetize that, and they can't do anything about it, and I can't do anything about it, that’s a big problem this Congress needs to address."
Gabriel Weinberg, CEO of DuckDuckGo, an internet search engine that doesn't rely on personal data to create user profiles, pointed to his company's growth — a 50 percent increase year over year, as reported by TechCrunch, as evidence that privacy doesn't have to be a business killer; rather, it's a net win.
When Feinstein pressed the witnesses on whether a federal legislation should mandate users' abilities to opt out, both Weinberg and consumer advocate Alastair Mactaggart agreed.
"A lot of this easy opt-out is already open to browsers," Weinberg said, speaking of the do-not-track feature. "If it was mandated, people wouldn't have to worry about reading all these [privacy] policies. Right now, hardly any company in the world respects do not track in the browser, even with the [EU General Data Protection Regulation]."
Mactaggart, whose consumer privacy initiative incited what would eventually become the California Consumer Privacy Act, said the law's "do not sell my info" button is the solution to that. It's the law's "built-in do not track."
Sen. Mazie Hirono, D-Hawaii, said she supports an opt-in regime and asked DeVries if Google would support such a scheme. DeVries said it would be very disruptive to the ad tech ecosystem. Later, Sen. Marsha Blackburn, R-Tenn., said she thinks Google is simply concerned about an opt-in regime hurting its bottom line.
David Hoffman, CIPP/US, global privacy officer at Intel, said at the hearing that he thinks opt-in is too burdensome for consumers, and while certain sensitive data likely does deserve an opt-in requirement, a law stronger than the CCPA is necessary to protect consumers who were never even offered an opt-in choice in cases where, for example, their data entered the ecosystem via a data broker. Intel has introduced its own version of a federal privacy bill, which would put strong controls over third parties' use of data.
"A new model of privacy protection that does not rely primarily on consent is needed. Data brokers are poisoning the well of trust out of which real technology companies like Intel and our customers must drink," Hoffman testified.
However, Sen. Thom Tillis, R-N.C., indicated his concerns about over-regulating. He said doing so could have a "Dodd-Frank-like overreach on consumer data. If we're not careful, we could actually have this sort of populist reaction that at the end of the day could be to the detriment of the consumer." He did say he is impressed with California's work on a law but thinks any federal law should pre-empt it and has concerns about small businesses' and startups' ability to survive in an over-regulated environment.
"We should make sure the most innovative nation in the history of this planet can continue to be that. We need to get this right."
If you missed the hearing, you can watch the recording and read the full witness testimonies here.