Next week, the Federal Trade Commission (FTC) hosts a public workshop on cross-device tracking, with an aim toward examining tracking technologies that link user devices (such as their smartphones, tablets and laptops) to build robust consumer profiles for targeted advertising, website analytics, attribution of ad revenue, improving user experience and security and fraud prevention.

Get up to speed before the FTC Workshop: The IAPP Westin Research Center Practice Guide on Cross-Device Tracking provides background and resources on how cross-device tracking technologies work and discusses privacy concerns, solutions and applicable laws and guidance.

More than 30 parties have already submitted comments to inform the FTC workshop on various aspects of cross-device tracking, the benefits for companies and consumers, the privacy and security risks, how to make cross-device tracking more transparent and how industry self-regulatory programs may apply. Primary concerns about cross-device tracking focus on the effectiveness of existing opt-out mechanisms, the sensitive nature of a user’s cross-device information and whether combining a user’s information across devices may lead to harmful (and erroneous) assumptions.

Regulators and technologists are working to address the concerns and provide solutions. Last month’s IAPP KnowledgeNet in Boston provided an overview of cross-device tracking and the policy issues surrounding it. Participants voiced concerns over the “creepy” nature of increasingly personal online advertisements. Noga Rosenthal, CIPP/US, general counsel of the Network Advertising Initiative (NAI), explained that for legal as well as business reasons, ad networks do not want to identify the individuals to whom they advertise. Ad companies prefer to avoid the liability associated with maintaining PII. Moreover, knowing the real world identity of individuals is not helpful to ad companies, the goals of which are to maximize ad exposure in aggregate numbers.

Rosenthal, together with the NAI’s Anthony Matyjaszewski, also noted that while data may not be considered sensitive on one device, it may become highly sensitive when devices are linked together. For example, a job search on a home computer may result in job advertisements on a work computer, which are visible by a user’s employer; or advertisements for a product purchased as a gift to a family member may show up on devices linked in the same household. The sensitivity challenge is difficult to address through policy because it is hard to create an exhaustive list of data that may become sensitive when devices are linked.

Also at the KnowledgeNet, Joseph Calandrino, director of security science at Stroz Friedberg, outlined commonly used probabilistic methods of cross-device matching, such as through device IDs, but also described some lesser known techniques companies are deploying, such as timing analyses and hashing. Timing analyses correlate what time of day an individual uses a device with typical log files to determine which devices are likely used by a specific individual. Hashing is a technique of obscuring identifiable information to allow linking between devices without directly exposing or using PII. Hashing is used not only in online applications but also to link consumer patterns between brick-and-mortar stores and their online counterparts.

Hashing slides from Calandrino’s Presentation

Businesses and regulators agree that cross-device tracking mechanisms and technologies are complex and varied. In comments to the FTC, the Future of Privacy Forum (FPF) identified transparency as a key issue and described newer techniques of linking that raise additional privacy concerns, including the use of audio and non-audio beacons and location-targeting across devices. Similarly, the Center for Democracy and Technology (CDT) proposed a solution based on increasing transparency, including a robust opt-out system. The CDT supports regulation of cross-device tracking by the FTC to ensure “users are informed and given a meaningful choice to protect their data.” The NAI, meanwhile, believes that effective self-regulation is the best solution to respond to complex and evolving cross-device tracking technologies. The NAI intends to apply its self-regulatory framework based on the FIPPs to cross-device tracking.

The FTC’s public workshop on Monday, November 16, 2015, may shed light on how self-regulatory programs apply to cross-device tracking, whether new regulations may be needed and how regulations will be enforced.

photo credit: Device landscape via photopin (license)