with multiplying global markets and regulatory regimes. and we need to hear from you.

how the u.s. government can strike the right balance between privacy and innovation. we can't address these issues without your help. so thank you for your participation in today's symposium. we look forward to continuing this partnership as we move in to this next chapter of the internet age. thank you. [applause] >> if the panelists for the next session wouldn't mind coming up and populating the seats, i just want to come back to a point i raised earlier. before taking this job, i worked in corporate america for 20

years and 12 of those years with one particular company. and i worked on many, many public policy initiatives. and the public policy initiatives succeeded when we had support as policy advocates from the executive suite. and i think we just saw another indication of the strength of the support that we have as policy staff at the commerce department from our executive suite. cam kerry couldn't have been more articulate and demonstrable in showing the high level of support for this initiative across the executive tier across the department. with that, we'll return to geek and wonk speak. [laughter] >> we have pretty much a continuation of the conversation that we had before lunch. although, this panel has more

folks from the business side than the earlier conversation and we'll be drilling into breaks tax issues a little bit more. we'll also not be endeavoring to do live demos of technology 'cause we know that's fraught with challenges. but we will be throwing up a few screen shots so people can see what some of the developments in the privacy tools arena have been occurring. but before -- before we move on to the brief demos and the conversation, just a few framing remarks. i'm one of those people who enjoys looking at the internet economy and the internet as a whole through an evolutionary lens. that we see speciation on the internet. we see the emergence of things

that people couldn't have seen 5 or 10 years ago. and one of the things that paleontologists will tell us there were periods of seeming stability. and then -- what they called punctuated equilibrium. and during these periods of punctuated equilibrium, the pace of evolution speeds up dramatically. and the outcomes are highly unpredictable. and what we've got, i think, in the internet era is we're fortunate in many respects to be living through this. is that type of rapid evolution but in the commercial space and in the development of social technologies, communications technologies, for example. and this brings, you know, tremendous benefits. cam went through them. we all know them and also policy challenges as we know. and one of the biggest challenges we see the pace of innovation of products and services moving out so fast.

and we all know the pace of regulation and legislation and policy development moves at a tortoise speed by comparison and so what do you do about the difference in time scale. we also in this space, in the privacy space, we know that corporate leaders, innovators are constantly developing privacy enhancing technologies. i think we need to be honest that the development of privacy enhancing technologies is not quite yet at the same space as development of internet technologies and services. so we have racing out ahead of us the development of new services and new technologies. we have at a slightly different pace the development of privacy enhancing technologies. and then lagging far behind we have the development of policy and regulation and legislation. so what do we do about the fact that all these three things are in play and moving at different time scales? i don't have the answer.

i don't know if any of us do. but that's one of the purposes of this inquiry that we're conducting. and one of the things that i hope our panel can focus on. so with that, let me pass it over to a handful of folks who actually have been in the midst of developing these privacy enhancing technologies. they have been adapting. mike from the internet advertising bureau will lead off and then we lead to lee who's representing bbb. bbb is a great example of what i'm talking about in terms of adaptivity. if that's even a word. [laughter] >> evolution. >> bbb -- bricks and mortar companies or organizations representing bricks and mortar companies yet 10 years ago recognized that the internet was a new thing. and they established a seal program and were the leader then and they've continued to adapt it. and then we have representatives from yahoo! and at&t who are

also leaders in this phase. and once we get through a few of their presentations, we'll discuss what people think of them. so with that, mike, you want -- >> thanks, mark. i appreciate it, marc, the opening comments. i think i would, you know, kind of reconfirm or repeat general counsel kelly's statement that innovation and privacy can stand together. i think there's no question since that's the point we're at as an industry than we are looking to innovate. we're looking to push the privacy envelope and i think i probably have the best job here today. 'cause i actually get to stand up and represent the collective wisdom and work of literally hundreds of companies who have come together to push the envelope on new, innovative ways in pushing consumer notice and empowering consumers choice

specifically in the online behavioral advertising space. i don't want to spend a lot of time with the history and the process. suffice it to say, we took a lot of cues from the federal trade commission when they put out their online behavioral advertising principles for self-regulation. it's been a long process. it's been an inclusive process. and really resulting last july in a send of privacy principles than really seven principles i'm going to talk about the choice and the transparency principles today 'cause that's what we're here to focus on. but these principles truly are revolutionizing the way consumers get information about how data is collected and used online. and it's also revolutionizing the scope in which they're empowered to opt out of that. and to say, no, i don't want to be targeted. so, you know, just a little bit about the scope. when all is said and done, when you look at the steering committee made up of our partners with the direct

marketing association, the council of better business bureau s and the american association of advertising agencies and then when that grew to many more trade associations, and literally at the end of the day hundreds of companies come together to consider these principles at the board level of these steering committees and approve these and as we move towards implementation and i want to point out because principles are great but until you see it in the marketplace then you don't really have a whole lot to stand on. and so you look at the collective membership of these trade associations. you're talking about 5,000 leading companies, advertisers, agencies, marketers, publishers, ad networks, portal search engines. and i'd also commend the direct marketing association. they've already incorporated these principles into their member code of conduct. and so their members are already beginning to come in to compliance as are some of the other trade associations putting these into the code. but let's really look at what

we're talking about because fundamentally there's sort of two ways that you can deliver -- that you can deliver notice to consumers. you can do it through the website, the first party publisher. or you can do it through a third-party. i want to focus here on an example. this is live. it went live this week. on publishers clearinghouse. a new service, pilot program empowered by trustee who everybody knows as an enforcement compliance third-party program across the industry. and if you look, this is an entire website. but if you look at the ads, you can see it's targeted. they know that i live in vienna, virginia, probably through the ip address. and if you loohin the ad itself, you'll see the icon of trustee and you'll see a notice there. interspaced advertising i think is that particular link. jessica is going to hold our feet to the fire if we're not living up to our expectations. but i think the key here that it's in real time. it's easily discoverable and most importantly it's outside of

the privacy policy because that's something something the commission told us was really important. that you can bury in a privacy policy. if we go to the next slide, if the consumer clicks on that link, it takes over the panhandle. remember, this is a publisher notice. it has very clear information, plain english about what the data collection practices are. and if they click again, if they're concerned and they want to opt out, it's very easy for them to opt out. of this targeting. i think that's a powerful tool. this is -- this is not the common place. this is not how the industry has worked for the past 15 years. behavioral advertising. so let's look at the other example of consumer notice. this is third-party notice. so whether it's an ad network or something like that, it's probably most common way people think about this. if you look -- this is not a live demo. ieb -- we don't have the budget to do advertising.

but this was mocked up by better advertising and it helps people come in to compliance and live up to the oba privacy principles. and you have the notice within the ad. nothing could be more easily discoverable by consumers than a notice of data collection practices within the targeted ad itself. and so if you go through and consumers want to find more information and you click on it -- actually on the ad, you get an overlay that takes over the ad. remember, this is different from the first publisher notice. because the third-party doesn't have access to the entire website. so they kind of have to respect that territory. but it takes over the -- you can see right there if they want to -- if they keep going forward and if we keep -- if they want to opt out of data collection, and out of the targeting, it's very easy for them to do. and if we just go to the next slide, you'll actually see how easy it is to opt out all this targeting.

and so this is the landing panhandle. i want to show you two representations of innovative and creative ways that industry is implementing new type of notice and the key with choice is to make sure for the first time everybody in the ecosystem is complying and participating. and everybody is respecting consumers privacy. that's a real, i think, evolution. there's nothing new about opt out but have everybody doing it. even people that aren't sort of front-facing or consumer-facing is the real key here. and so, you know, principles are great. we're seeing notice. we're seeing choice. but in the end, we also need accountability. and i just want to highlight -- lee is going to talk about council better business bureaus who has been a partner since day one and i highlight the self-regulatory program which has a long history in this area. and then certainly trustee, we showed the treatment from trustee and the service. there's a serious commitment to enforcement here and to

compliance. and with that, i think i'll let lee take over. >> am i on? how about now? no. >> i'm an executive vice president of the council's better business bureau. and as marc said, we are in the process of adapting. we'll be 100 years old next year. i wasn't there when it started but close. [laughter] >> one of the -- but what i wanted to do -- say, talk about how self-regulation can fit in with the department of commerce's overall look at privacy principles because i think one of the themes from this morning was what this space needs more than anything else is standard flexibility. and one of the hallmarks of any

self-regulatory approach is flexibility. the problem is that when you go out and just do, you know, your basic google search on self-regulation, you come up with some pretty pejorative widely held misconceptions about what self-regulation is. my favorite is -- was an article in a newspaper that describes self-regulation as the bubonic oxymoron. i don't think it can get much worse than that. but there's a different view of self-regulation that we're trying to develop in this process that mike was just talking about. and that's basically making a third-party accountability program. and in the principles that were adopted both we and the direct marketing association has undertaken to construct just that. and the idea is that you would have a third-party, either the bbb or the direct marketing

association, conducting monitoring and oversight of companies compliance with the principles and that's not very remarkable. but in addition we've -- we both committed that we'll be transparent about the monitoring. that if we find violations, we will report them publicly. and if the violations aren't corrected, we will refer them to the government. now, there's actually a track record here that shows that approach could work. we have administered for years an organization called the children's advertising review unit that looks at all advertising directed to children. and any media. it has the specific set of principles on privacy. and those principles both parallel the children's online privacy protection act and in some instances go beyond it. these are standards developed by the industry. they are applied across-the-board to every industry member. whether or not the industry member has said they agree to comply with them.

the children's advertising review unit monitors that space. they've had in the last two years more than 50 reported decisions in that area. they have 100% compliance. now, one of the reasons we have 100% compliance is 'cause we get great, wonderful support and backup from the federal trade commission. and certainly that is one version of self-regulation. the self-regulation is something that supports regulation. there's another version of self-regulation that -- where it is in lieu of regulation or goes beyond regulation. and, in fact, most of the self-regulatory activities for children's online privacy do involve provisions that go beyond the basic provisions of the children's online privacy act and require age screening by sights that may be attractive to a significant number of children. so going back to where i started, i think one of the things the department of

commerce could be doing is of trying to develop more of an intellectual basis, intellectual support for the process of self-regulation. as part of the privacy protections. and i just came from a meeting at the ftc, the international consumer protection enforcement network, which is a groundbreaking organization, the ftc put together to bring together consumer protection officials from all over the world to talk about coordinated standards and coordinated consumer protection. i can tell you that the concept of using self-regulation in many countries is not as well developed as it is in this country. and even in this country, it could be better developed. so that's an explicit goal of this program that we've undertaken with the support of many of the companies in the room and all of the advertising trade associations. thank you. [laughter]

>> so those of us on the panel can't actually see the slides. so we're reaching over. i wanted to talk a little bit and just get some examples of how we're dealing with notice and choice today. i've been to a lot of panels like this. and it sort of starts off with the -- with this these ideas are dead. old and antiquated ideas and i think what nicole said this morning is really instructive. notice and choice 10 years ago was kind of a two dimensional thing. i don't think -- in fact, interestingly enough when i was looking at the yeebd for this event, i did a little search. i came up with an agenda that came up in 2000. a lot of the same topics were being discussed. 8, 10, 12 years ago. but what i think is different is the way we're approaching them. and so when we think about notice and choice today, we're thinking about it in a different kind of a web world than we were

thinking of notice and choice 10 years ago. when i first started at yahoo! we drafted a privacy policy. we put links to it on every single page. and we thought that was kind of revolutionary that a company would tell consumers what we collect and how we use it. and i still think it's an important thing to have. but we have tools today that we didn't have available to us 10 years ago because we have evolved. the web is a very different place. if we were talking about this two years ago, we wouldn't have been talking about pharmaceutical or twitter. -- facebook or twitter. so what we have done on yahoo! actually if you go back, i missed my clicker. i miss that control. we have implemented an icon on our front page and on our mail page with the ads that we show there. those are some of the most heavily trafficked pages on the internet today. we have been thinking about how do we provide contextual privacy notices to consumers because what it is about today is not having a document or a number of choices that you go tell consumers. go find it, read it.

manage all of them someplace. it's about giving users the choices and the information that they need in the context of their experiences. and advertising and privacy in that context is just one way that we're doing that. and this is an example of that. so when we first started thinking about this actually was about three years ago when we -- when yahoo! entered into the third-party advertising space. yahoo! has been serving ads on yahoo!'s own site for 15 years. but the idea of serving ads off of our site put us as a third-party ad network and we worked with a number of great partners including ebay and wal-mart and we spent some time talking with him how do you provide privacy noise so that your consumers know that yahoo! is involved in this transaction. that we're providing some customization services and ad-serving services for you. and what we came up was this idea of providing that information and that notice contextually.

and doing this from a publisher standpoint they have to go in and make changes on their site, on their templates. that's a rather difficult problem from a scalibility standpoint. on the internet we're always thinking in terms of scale. because we have -- this is a fast-moving medium. the partnerships and the arrangements are changing daily. and the advertising ecosystem has gotten -- it's very different than it was 10 years ago when you had a publisher and an ad network and there was a contract. and those two entities worked together and all the ads were shown by one ad network and two. today you have a lot of different players and the ecosystem is a a lot more complicated. so we were trying to figure out how to make it scale. and we thought we could do this better from the ad network perspective than we could necessarily from a publisher perspective. so we worked -- we've actually been testing a couple of different models. this is one that we're working on. the ad label appears next to a little eye and a circle. jewels over here with the future privacy forum and a number of other companies work together to actually test this out.

i think what was important if you go to the next click, you'll see a blowup here. our friends hp are very well represented on our front page. the idea here was to give somebody -- give consumers a meaningful marker that would let them know here's where you would find more information about privacy. now there's ways to convey privacy information that aren't so terribly helpful. i'm sure everyone has a credit card and at some point you got a privacy notice and how many of you read them. that's still not very many even in this audience. many, many billions of dollars have been spent in compliance and i'm not sure that consumers are necessarily better off. one of the things that we were really keen on doing here is to test this out. to actually test this with consumers and find out whether it's helpful to them. if you click again, this is actually right now our landing page. and it shows you a little information conveyed through some educational information.

our goal actually in the future is to really boil this down. and right now we're not using our testing and developing for later this year this idea of transmitting with the ad some data about the ad. and it's referred to as metadata. the idea is when we serve an ad with an icon, we can convey through that ad some information who the tideser was, who the ad network is and where you can go specifically with your information. we're going to be doing a lot more of this in the next year. if you click one more time. this is actually where it takes you today. so this is where you would go to express your choices with yahoo!. we launched the ad interest manager in december of last year. and our goal here was -- and this is a long time in the works was to be able to actually convey to a consumer some of the information that we're using as part of this customization process and to let them exercise their choice here. it's very simple. you can still opt out of all by exercising just that one big yellow button. but we're giving a lot more

information to consumers about what information we hold and how we're using it. and, you know, a few years ago there was a great deal of concern about showing this much information to consumers. but what we find is that actually by being this transparent and giving consumers this much information, it's incredibly empowering. and it demystifies this whole process to a large degree. when you talk to a consumer about what information has been collected and used, there's this sense that, you know, it's going to be awful. it's going to be everything. and i got the spammy message. and i clicked to this porn site and i didn't mean to click on the porn site. we show what we're using them and we give them control over it. and it's allowing the consumer to engage with that. and we are finding that it's demystifying and giving people a great deal more comfort how this whole process works. so this is the clear ad notice process. this is what we've launched. i encourage you all actually to go take a look at. it's at privacy.yahoo!.com/aim.

and i just want to emphasize there's been a lot of conversation about opt in versus opt out and we seem to always try to boil these privacy discussions down into that very binary set of choices. i think a lot of people in our industry would say it's really a spectrum of choice. it's not -- there's not one way to do it or another way to do it. we tend to think of o asing mor but we're doing that form of opt out with exceedingly clearer, i think, notice to consumers with this kind of transparency control, i think it's a very -- it's a very good way to go. >> i also have slides. go to the first slide. we'll start right off.

ann mentioned the industry is getting really challenging because you have web publishers, ad networks, isps, all kinds of actors in the ecosystem. i would just tell you that my company is highly challenging because we're all of those. so within one company, trying to manage the different business interests as we talk about privacy has been actually -- produced, i think, some pretty good results. and with our partnership with yahoo! which, in fact, att.net is powered by yahoo! and all the innovation she's talking about we get the benefit and the innovation with the bb we're getting the benefit of. we're the living laboratory of this as a major advertiser online, top five advertiser on line. we're the number isp, so we play and web publisher we've got top 50 websites. so we really do play all these roles. how does one navigate through that in the new era of privacy. and it starts really in the

foundational and our privacy policy. i know it's tried and true and old and we can talk a lot about whether notice is sufficient, but i'd like to point out one feature. we collapsed our privacy policy a year ago from seven privacy policies to 1. we did a great redraft and we did one stop shop for all our business, wireless, isp, publishing all of that. all included and we did so by drastically reducing the number of words. but i could talk a lot putting our videos up and all that. the one feature i would highlight for this audience that we haven't really talked about is the intentional intent to engage our customers. in the privacy policy. and we did that by actually rolling out the new privacy policy with a 45-day preview period. we sent over 100 million -- 100 million notices to our customers through their bill inserts and

through a web campaign to say, check out our new privacy policy. drive them to our site and on our site, just when you first got onto the single unified privacy policy, we said tell us what you think. and by the way, the privacy policy is not going to be effective for 45 days. so if you want to tell us what you think, we will, in fact, wait to hear what you have to say and we'll listen. we found -- we answered every one of our customers inquiry. and, in fact, 45 days later when we made the privacy policy effective, we did, in fact, change the policy reflecting some of the concerns about language that wasn't clear. despite the fact that we had focus groups and early previews of all of this, we found that, in fact, our customers made some really good points about unclear language. and we changed it. and it was -- it created all kinds of worry with our lawyers and all kinds of worries internal to the business. you're letting customers tell you how to write a policy. but it turned out to be a

tremendously effective tool. it was well received. as we all know as privacy professionals, changing our terms of service on your privacy policy is a flashpoint in any corporate life. and the fact that we used the customers really as our own kind of laboratory was highly effective. and i would encourage everyone to do so. and it was -- part of this process at least for us internally of recognizing engagement is the key to being an effective policy -- privacy policy advocate for our customers. so lipping. -- flipping. oh, i don't know where we are on this. okay. a couple of other things. that's where the yellowpages.com -- a couple of other things. that are interesting. one is we also are a major publisher and beyond our att.net we also -- yellowpages.com is now yp.com. and we looked hard saying are we, in fact, looking at our

privacy -- the most positive towards our customers as a website publisher? and realized in that context that we needed to be even clearer. so we added a link at the bottom of the page that says advertising choices. you click on that link. you turn and, in fact, as others described as ann described, comes the ability to do so things. one clearly opt out if you want to not be part of any kind of collection of data. it links into the nai opt out. it brings you right there very quickly. it also tells you what our advertising policies are separate from our privacy policy. if you want to understand that, we try to do it very clearly. in addition to that, you can click. we also worked with our friends at blue fly to create a profile manager. we're talking a different scale than yahoo!'s publishing site. but, in fact, we ended up creating the customer preferences allowing the customers to find out what was being collected.

how we were making interest space advertising. and allow manipulation of the interest categories depending upon what the customer felt they wanted including not just the interest categories only. in addition to that -- see we are the living laboratory. we also took the icon idea and said let's see whether that makes a difference. not just having advertising on the bottom page. but let's take an icon. working with jewels fisher of privacy forum, we took -- we picked one of the top three that had been tested, the icons that had been tested well. sadly for us it's not going to be the asterisk man. it will be the eye. we will move to the eye because that is the industry selection. we like the asterisk man because it looks like that singular guy. [laughter] >> but it tested well. like ann, we also have been testing it and the consumer factors context where we see people where did their eyes go and drop on the panhandle. are they understanding it? does this verbiage help.

so we've been trying to be a living example of what the industry innovation -- anytime there is one we jump in and say we'll test it and try it. in addition to that, as an ad, you know, yellowpages.com is a local search engine. very, very popular local search engine. in addition to that, we have gone beta in the last several weeks on a buzz product, not the other buzz product, just to be clear. this is a recommender site that allows our customers, when they're looking for local search entry, to actually say i want to know recommendations -- do you want to participate in a recommendation from your family and friends? on the best, for example -- you're looking for a sushi restaurant in san francisco. you want to send that question out to your group of friends or family. you can send that out and expect

answers to come back so your local search is enhanced by your recommendations of people that you know. go on. i should have said -- if you go back for just one slide. at the bottom -- oh, a couple of things that we did here really adds to the discussion. wanting to engage the customer in the actual privacy design of this, we, first of all, at the bottom -- we don't say link to your privacy policy. we say very clearly, here's how we're going to share information on this site. so -- and we make that very clear. and identify it for what it is, the sharing of information not for the protection of privacy. then go next. and then once you get -- if you click on that and you understand it, part of the feature of the product when you're engaged into the -- when you go to the recommender site is a feature of it is identifying who you are. and who you are reflects how you want your privacy settings to be.

so as a part of the actual product you have to identify at the outset, are you shy? are you outgoing? and we use words that people understand. not some tricky word. shy or outgoing and we explain by what we mean by shy or outgoing by identifying what that, in fact, means for the customer. shy, more protecting of information. outgoing, you really want everybody to see what your recommendations are. and in addition, the final feature of this is we actually say, by the way, shy is anonymous but it may not be anonymous because you're asking for the best sushi restaurant in madison, wisconsin, and you have four friends. and you are anonymous but you're the only one living in madison, wisconsin. people may figure out who you are from the context of that. even though it's anonymous. so we make clear in the statement very upfront, by the way, don't send sensitive information thinking it's anonymous because it may not be. you know, that's a balance.

that's a we hope people want to use this service but by the way, let's be aware anonymous does not mean private. it means anonymous unless the context suggest otherwise. so, you know, it's a real early on site. we tried to build in all these privacy features as an element, privacy by design, as an element of the product. and working with our business we didn't go out and say let's figure out whether this works and pull it back, which is a challenge for us because the industry is really a little -- a little two-sided on that point. some people go out and make mistakes and come back. and we're all there 'cause we've made mistakes in -- in a corporate setting as well. but in this context, we deliberately tried to go forward and create the right privacy settings from the outset. we'll see if it works and see if people take -- like it. thanks.

>> jessica, would you like to rejoin us? >> yes. [laughter] >> jewels doesn't have slides. both you and he are the respondents really. >> oh? >> so getting back to where i started, you know, i think we see an extraordinary amount of adaptation in the privacy tool development space. the last time i engaged in this, when danny and i first met and we were working on the platform for privacy preferences p3p. and, you know, whether we were giving people too much choice, too much granularity, et cetera, and we were also working with bbb on the bbb seal and with trustee on the trustee seal, i think it's fair to say the world was two dimensional and we have lots of examples of much more

sophisticated privacy-enhancing technology. and i think what i'd like to hear the panel discuss and start off with -- jessica and then move to jewels is, how far does this get us? i mean, there are a number of issues. ann mentioned the importance of scale. well, scale is important for one company. but scale is also important for the entire ecosystem. one of the things that lee mentioned that might have been passed over people's heads is bbb is actually going to go out and they're going to probe sites that haven't signed up for some of these processes. and so just like in the example, somebody could be sitting out there just as any business that doesn't have a privacy policy and they could get a note from the bbb saying, guess what? we observed your site. and you're not following industry best practices. does that get us there in terms of scale? the other -- the other

interesting thing is we see a lot of experimentation in the different companies approaches which is great.confusion on the part of the consumer? when do we get towards something that's more standardized? is it important to press standardization? and then i think the big question is, you know -- we see that this is effective for -- for i assume these tools would be effective for u.s. consumers in the u.s. context. people noted that overseas the sophistication of self-regulation is not there and so where does this get us in terms of of a global dialog. those are a pressing questions that, i don't know, jessica if you want to take a few of those. >> okay. >> we need the microphone for the tape. >> oh, yes, it's on.

okay. so i'll start with your middle question, i think. and see if i meander over towards some of the others. so i think it really spoke to me to say -- is this going to be confusing for consumers? so just to start off, i mean, everything everyone describes here today is exactly what the federal trade commission called for when it asked for self-regulation. it asked for greater transparency in behavioral advertising in particular is what i'm referring to is when we did a project in that area. we asked for notice -- you know, for certain notices to be more contextual outside the privacy policy so that consumers would be more than likely to see it. and we're seeing a lot of activity in development that we're very encouraged by. in the short run, it's going to be very, very confusing for consumers. as these models are developed, they're different from each other. maybe people are using different icons. i know jewels probably wants everyone to use his icons but we

know there's competing icons right now even in jewels' model, there are three different phrases you might be able to use. in ad choice and why did i get this ad and interspace ads, yeah. and then we've got the preference managers. and they're similar but they're not the same. and so -- and on top of that, consumers will be needing to do this on a site by site basis. so i think in the short run there's going to be a massive amount of confusion. but we're learning. and we're experimenting. we're -- many of these companies and certainly at&t in what you described are learning what consumers are responding well to and what they're not. and so -- so i think this is a healthy process but it's not like this is what we wanted and it's here and consumers are now going to understand everything. it's a process.

there's a lot of other things that need to shake out before we see whether -- how successful these efforts are. will there be accountability? that's what lee is here to make sure of. if you have a self-regulatory scheme and there's no enforcement or accountability, it's not very -- it's not very meaningful. maybe -- and actually the ftc has been working to -- to broadcast that message. we brought cases in this area recently against a seal program called control scan that was flapping seals on companies and we alleged they didn't do any checking of the privacy and security and yet these companies are getting these seals and it's important for us to call that out. enforceability is another thing we're going to need to be -- to look for. and as mike said, whether companies actually use it and implement it, he said principles are one thing. but actually implementation is another.

and then this question of, if consumers -- are the choices going to be site by site and are consumers going to be confused by that? you know, they go -- they opt out of something and then the next time they go to a similar site, they think maybe they've opted out. it's an unrelated site. why am i now still getting ads? so there's a lot of things to be worked out. a lot of -- a lot of progress and growth that needs to be made before we see how this works. >> maybe i'll jump in and say day by day, the only way there are self-regulatory advances, you know -- it's not like there's nothing that happens and then all of a sudden the entire thing would agree on the new. what happens is companies individually start to lead. they say well, what can i do better? i want to do something. if you wait until there's consensus, you know, perhaps it never happens because everybody

is waiting to see who plunges into the water first. and so i think one of the reasons why today we updated what we call our gallery of leading practices, not best practices, not industry practices but we kind of took things someone is doing somewhere that just go a little bit further. those are the things people see. people didn't -- it's feasible. i could do this, too and then you get consensus saying you have progress. i urge you to take a peek at some of the things we pointed out because you saw varying examples that happened over the last couple of years that aren't done and aren't perfect but are all sort of baby steps towards more transparency and more control. you know, a decade ago when a lot of us started focusing on this, retention policies, what do you mean it was my data. i was the business and i had the data. and i wasn't going to throw out data that might have some value. and today search data, you know,

from some companies have three, six-month policies and log files gosh four or five years ago i don't think there was anybody who had a policy that said here's how long i'll keep that record of all the sites you've been to. again, three, six, nine, twelve -- whatever the period is, you've got dozens and dozens of companies having policies. you have policies that are now hashing or whatever they're doing so ip addresses recognizing that's a bit more sensitive a data field than others. you saw sort of behavioral notices. i guess one point to note for jessica, most of these things point to the nai site or to a similar process. so at one place you actually are going to opt out of 40, 50, 60, 100s of different ad networks and so you actually don't need to do so again. now, again whether users understand this process i think it's still a big challenge. when we did our consumer testing and we asked users in focus

groups, you know, if they knew what it was, you know, the one remark that i remember well, yeah, yeah, i know it's when you're watching a movie and all the all of a sudden you get hungry for popcorn because they flashed it. no, no, no. it's hard to explain to somebody and give them some control when they don't know it's happening and steps shifting from privacy policy when most of us are not in the privacy business. most of us are in the here's how we're using data for you to help you to serve you, to tell you in a way that frankly a bit more transparency would go a long way. there's more opt out in the cookie and you're deleting your cookies and you're back in. it could be chutzpah in the mood of most consumers. there are pluggings that can download. a mobile -- i like to kind of keep going. so we start a profile. what about the mobile world, you know?

they're not off the hook, are they? and so you saw the first mobile profile viewer launched last week so that the data that's used across the sites that you're going to see when you circle in your smart phone now, also will let you do that and let you have the opt out. saw that with ford and other systems as well the iphone for -- that when your location is being shared, there will be a symbol indicating, you know, somebody is getting your geolocation and then control over those apps. i don't want to argue all is well because i think there's a whole host -- in two or three years because of europeans, because of the ftc and companies leading and competing a lot of progress, but a budget of other areas where frankly it isn't innovation and rocket science. come on, just do this right s e

some -- but can i target you based on the fact that you searched for the word cancer or something sexual or something embarrassing? many of the leading companies have kind of internal policies. but we're all over the map and you've got every kind of practice, you know, going on in the world there. and again, it's hard to do that perfectly but not that hard to say, here are the terms that we'd just be too embarrassed to tell you as a consumer that this is the kind of thing, you know, we're keeping about you to tailor you based on what you looked up. the usedibility of some of the privacy controls. we complained about facebook but there's a lot of -- you know, programming the vcr which if not for the advancement of some of the sophisticated things we have

in the home they would still be blinking zero and some of the consumers would be blinking zero on the controls. people are designing icons now and they are turning them loose on those pricing controls and make those features so that people don't feel like they're flossing the teeth. this is how i use this thing because it's a key part of why i'm here. >> can i make an comment on the icon since you raised it again. just as they did two years ago when the ftc presented their original draft of the privacy controls on the oba and jessica put her fingers on the right issues here again today. but there are -- there are areas where we want innovation and there are areas where i think we want standardization. and those sometimes are mutually exclusive. and so in the icon space as jules said, you don't want, you know, people going out and freelancing because from a consumer experience, it needs to be a common experience and

easily understood so that we can educate as an industry and as the government can go back and educate the public at large. this is an icon that means something. and so you're going to see it. it's going to become ubiquitous. and over time people will understand because it's easily discoverable and that's why our cross-industry group put out an icon, not a series of icons. we did put out three links worded sort of verbiage that goes along with that. and that is sort of set as well. and that's for different reasons you all wanted one. some other companies wanted another and there were space limitations so we needed to have a shorter one. we can standardize what got us there -- we need wide scope so we can easily adopt. on the back end we need innovation. >> lee, do you want to interject there? i do want to get the audience to ask one or two questions if you

could keep your comments -- >> i just think the whole panel is sort of demonstrating sort of the wisdom of the approach that the ftc took actually twice. i mean, if you would have thought the ftc came up with regulation? -- in 2000. we're a world away from that. from that approach. you know, the whole discussion that you heard today about these wonderful preference manager technologies, you know, that really wasn't on the table or focused on during the first ftc set of recommendations for self-regulatory guidelines which was in itself an innovation. the ftc stepping forward and saying here's what we want to see and we want you to go out and develop it was a real innovation. and i think, you know, what you heard today is that people have

really responded to it. and the last thing i want to emphasize we are shooting for consistency. i don't think it has to be complete uniformity on the wording. the ftc has warnings where you have to hide the warnings so the consumer doesn't lose interest in them. >> can i just say one word before ann which is education. we should emphasize that. that all of this depends on educating consumers so they can recognize this icon. >> let's see if there are any questions in the audience. oh, did you want to throw something out? >> innovation is often a little bit messy, right? when things first hit the marketplace, companies are thinking of different ways to do things and we all have different technologies. so the way in which we surface transparency and control might be a little bit different but that gives consumers something to bang up a little bit. and we learned from that.

so i think it's actually -- there's a lot of excitement and energy around a lot of this and i think we will -- weaver seen some standardization. we may see more. but we're learning all the time. there are very few products that any of us can think of that hit the marketplace fully formed and perfect. even the iphone apparently is going to come out with a new model soon, right? [inaudible] [laughter] >> so the goal is to -- the goal -- the goal is to continually improve over time. and you're seeing competition around this, too, among industry players. and that's summer healthy. >> so -- [inaudible] >> your microphone is not on. >> the only thing that's not perfect is we're 5 minutes over time so we're going to have time for two very quick questions. is that all right? >> sure. >> i'm sure the questions will be quick. i hope the answers will be quick, too. >> my won't be because it's in three parts. >> well -- >> along with a icon has anyone

thought a tone with the mouse as identifying the privacy motion. it works in radio brilliantly. second is what about over collection? why does sites need to know my hair color, eye color or other data in order to register me. and isn't that a continuing problem? and the third goes to the question of the international body. can we do this alone. we've got 300 million users the rest of the world has a billion users. i welcome the idea of an internet body of privacy officials but is that a way to get a u.s. regime integrated with a global regime? >> well, let me -- the overcollection issue, i'd love to address. because the ftc has harping on that for a long time in addition to the data collection security and initiatives and it's been a fundamental privacy principle internationally for many years that don't collect what you don't need. and, in fact, if you don't collect it, it's not at risk. so if you don't need it, you really don't want it.

>> on the collection piece, i think, you know -- we collect a good deal of data. we use it for a lot of different purposes across the site. and when we -- when we let you opt out, we're opting out of one particular use. there's a lot of uses that relate to simply operating our site. there's a lot -- and i think this is where retention is important to talk about in minimizing retaining data in an identifiable form. i can't stress enough that when we talk about opt outs and choices and what have you we're really talking about use based frameworks and not collection based framework. >> and the international piece just since you've asked it, he's asked it and nobody said anything about it is normals. -- enormous. transparency is a piece of it and that's what we're talking about. the challenge of this global

economy and data flowing and coming up with some common understandings internationally is extremely important. >> i think it's always worked at the europeans. the goal is to say stop treating this as an human right and as part of your country because we're cool country and we have innovation. forget about it. [laughter] >> but if it's a matter of, look, here's the status quo in your country and ours here's how the data is being kept. here's an improvement which you don't need to bless and say now there's world piece. -- peace. and we'll give them more dignity and putting them in the framework that they want it in, many of the data regulators will at least grudgingly in practice accept that. we yell about the advertising. they've given privacy seals backed by the government of germany. they have rules about sensitive information. you know, they don't like to announce that because this is a horrible american invention but the reality is defacto

improvements couched in the right way, remember it's about people they're not completely wrong and human rights. >> on the international front, in a couple months -- we've exported this self-regulatory program to the e.u. and a couple of months you could have this exact same discussion with their own privacy principles as they roll out very soon. >> marc, real quick. >> secondary use. i may not care about the use of my information for behavioral advertising. but i don't want to use it for anything else. does your system allow for controls over there? >> so when you come to yahoo! we're collecting it to operate the site and advertising is one of the things that we do. what -- one of many different uses. we have an integrated number of websites that offer very different services. so we're allowing -- we are allowing choice in this one instance. there are a lot of other things that we do with the data that's directly relevant to the experience of the users there to

have. i don't know -- so when we think about secondary uses, all of our uses we tend to think of primary rather than secondary. because it has to do very much with simply being able to operate the site and give you the experience that you're there for. >> so i'd like to thank the panel a closing thought and request for purposes of our noi. i think the dialog here as well as other comments that in the united states we've developed an innovative way of doing policymaking, sort of a push me-pull you between civil society and the government on the one hand. and industry on the other. and, you know, many of us go back to the year 2000 and there was a debate about privacy legislation then. there's a discussion about privacy legislation now. but the push me-pull you in between, those points in time has really yielded change. and i think the question for us

is, is that a workable model? does it need to be supplemented by something federally? if it doesn't need to be supplemented by something federally domestically, what about the international question? can this push me-pull you approach actually be sold internationally and work internationally? those are the types of questions we'd like to you address as you follow up with us. so please thank our panelists. [applause] ..