By Adam Thierer & Berin Szoka
Opt-in mandates may soon be coming to an Internet near you! Rick Boucher, House Energy & Commerce Committee Chairman, is expected to soon introduce the privacy bill he’s been working on behind closed doors for many months. At the heart of the bill is supposed to be a mandate that websites and services obtain opt-in consent prior to collecting information with users—at least if they plan on sharing that information with any third party or doing with it beyond what a narrow safe harbor would allow.
Boucher is apparently trying to strike the right balance between “protecting privacy” and the benefits to users of advertising and data collection. But there may be significant costs to an opt-in regime that are little appreciated by privacy advocates, who tend to think of opt-out as meaningless and opt-in as the ideal of user empowerment. In their new paper “Opt-in Dystopias,” Google’s Senior Policy Counsel Nicklas Lundblad and Policy Manager Betsy Masiello provide a sophisticated analysis of the dark side of opt-in. They argue that “mandatory opt-in applied across contexts of information collection is poised to have several unintended consequences on social welfare and individual privacy,” specifically:
• Dual cost structure: Opt-in is necessarily a partially informed decision because users lack experience with the service and value it provides until after optingin. Potential costs of the opt-in decision loom larger than potential benefits,
whereas potential benefits of the opt-out decision loom larger than potential costs.• Excessive scope: Under an opt-in regime, the provider has an incentive to exaggerate the scope of what he asks for, while under the opt-out regime the provider has an incentive to allow for feature-by-feature opt-out.
• Desensitisation: If everyone requires opt-in to use services, users will be desensitised to the choice, resulting in automatic opt-in.
• Balkanisation: The increase in switching costs presented by opt-in decisions is likely to lead to proliferation of walled gardens.
Lundblad and Masiello discuss each of those concerns in great detail, so read the paper for further elaboration. They do a particularly good good walking the reader through the complexity of even defining what we mean by “opt-in,” which is far trickier than most people imagine.
Despite doing so a wonderful job laying out these costs and unintended consequences of a potential opt-in regulatory regime for online privacy / data collection, Lundblad and Masiello don’t quite make clear the big picture: that the most dangerous unintended consequence of this new regime is the derailing of the Internet economy as we know it. As we have noted many times in our work:
the overall health of the Internet economy and the aggregate amount of information and speech that can be supported online are fundamentally tied up with the question of whether we allow the online advertising marketplace to evolve in an efficient, dynamic fashion. Heavy-handed privacy regulation (or co-regulation) could, therefore, become the equivalent of a disastrous industrial policy for the Internet that chokes off the resources needed to fuel e-commerce and online free speech going forward.
Still, this is a truly excellent paper that deserves to be taken very, very seriously by lawmakers on the verge of imposing the very sorts of opt-in mandates Lundblad and Masiello warn about. The article appears in SCRIPTed, (vol 7, issue 1), a UK-based “Journal of Law, Technology & Society.” Read it now.
The Technology Liberation Front is the tech policy blog dedicated to keeping politicians' hands off the 'net and everything else related to technology.