Team for Research in
Ubiquitous Secure Technology

Citation
Chris Hoofnagle, Jennifer King. "Consumer Information Sharing: Where the Sun Still Don't Shine". Technical report, Samuelson Law, Technology & Public Policy Clinic, UC Berkeley, December, 2007.

Abstract
In late 2007, the popular social networking site Facebook.com adopted "Beacon," an application that informs Facebook users' friends about purchases made and activities on other websites.2 For example, if a Facebook user bought a movie ticket on Fandango.com, that user's friends would be informed of that fact through a news "feed" on Facebook. Some users objected vigorously to the Beacon application, because their activities were reported on an opt-out basis, meaning that the user had to take affirmative action to prevent others from learning about their activities. An activism website, Moveon.org, organized a protest, calling users to action by asking, "When you buy a book or movie online…do you want that information automatically shared with the world on Facebook?"3 Facebook responded to these critiques by changing its policy to obtain express approval before activities on other sites would be shared with friends. The Facebook folly demonstrates how intensely consumers reject the "sharing" of personal information for marketing purposes. In this instance, consumers learned of Facebook’s strategy because it was transparent and obvious to the individual. But what most do not realize is that, in the absence of a specific law prohibiting information sharing, businesses are generally free to monetize their customer databases by selling, renting, or trading them to others. In fact, the sale of customer information is a common, albeit opaque practice that, if disclosed at all, is usually mentioned in a "privacy policy." Facebook's Beacon simply made information sharing obvious to users. Studies have shown that most consumers oppose the sale of personal information. Unfortunately, most consumers are under the misimpression that a company with a “privacy policy” is barred from selling data. To learn more about information selling, the authors, using a California privacy law, made requests to 86 companies for a disclosure of information sharing practices. The results show that while many companies have voluntarily adopted a policy of not sharing personal information with third parties, many still operate under an opt-out model that is inconsistent with consumer expectations, and others simply did not respond to the request. Based on these results, the authors propose several public policy approaches to bringing business practices in information sharing in line with consumer expectations.

Electronic downloads

• sb27report.pdf · application/pdf · 1702 kbytes

• HTML

  Chris Hoofnagle, Jennifer King. <a
  href="http://www.truststc.org/pubs/323.html"
  ><i>Consumer Information Sharing: Where the Sun
  Still Don't Shine</i></a>, Technical report, 
  Samuelson Law, Technology & Public Policy Clinic, UC
  Berkeley, December, 2007.

• Plain text

  Chris Hoofnagle, Jennifer King. "Consumer Information
  Sharing: Where the Sun Still Don't Shine". Technical
  report,  Samuelson Law, Technology & Public Policy
  Clinic, UC Berkeley, December, 2007.

• BibTeX

  @techreport{HoofnagleKing07_ConsumerInformationSharingWhereSunStillDontShine,
      author = {Chris Hoofnagle and Jennifer King},
      title = {Consumer Information Sharing: Where the Sun Still
                Don't Shine},
      institution = {Samuelson Law, Technology \& Public Policy Clinic,
                UC Berkeley},
      month = {December},
      year = {2007},
      abstract = {In late 2007, the popular social networking site
                Facebook.com adopted "Beacon," an application that
                informs Facebook users' friends about purchases
                made and activities on other websites.2 For
                example, if a Facebook user bought a movie ticket
                on Fandango.com, that user's friends would be
                informed of that fact through a news "feed" on
                Facebook. Some users objected vigorously to the
                Beacon application, because their activities were
                reported on an opt-out basis, meaning that the
                user had to take affirmative action to prevent
                others from learning about their activities. An
                activism website, Moveon.org, organized a protest,
                calling users to action by asking, "When you buy a
                book or movie online�do you want that
                information automatically shared with the world on
                Facebook?"3 Facebook responded to these critiques
                by changing its policy to obtain express approval
                before activities on other sites would be shared
                with friends. The Facebook folly demonstrates how
                intensely consumers reject the "sharing" of
                personal information for marketing purposes. In
                this instance, consumers learned of Facebook�s
                strategy because it was transparent and obvious to
                the individual. But what most do not realize is
                that, in the absence of a specific law prohibiting
                information sharing, businesses are generally free
                to monetize their customer databases by selling,
                renting, or trading them to others. In fact, the
                sale of customer information is a common, albeit
                opaque practice that, if disclosed at all, is
                usually mentioned in a "privacy policy."
                Facebook's Beacon simply made information sharing
                obvious to users. Studies have shown that most
                consumers oppose the sale of personal information.
                Unfortunately, most consumers are under the
                misimpression that a company with a �privacy
                policy� is barred from selling data. To learn
                more about information selling, the authors, using
                a California privacy law, made requests to 86
                companies for a disclosure of information sharing
                practices. The results show that while many
                companies have voluntarily adopted a policy of not
                sharing personal information with third parties,
                many still operate under an opt-out model that is
                inconsistent with consumer expectations, and
                others simply did not respond to the request.
                Based on these results, the authors propose
                several public policy approaches to bringing
                business practices in information sharing in line
                with consumer expectations. },
      URL = {http://www.truststc.org/pubs/323.html}
  }
  

Posted by Mary Stewart on 18 Mar 2008.
For additional information, see the Publications FAQ or contact webmaster at www truststc org.