Safe Harbor Draft Complaints 14 August 2014 The Center for Digital Democracy examined the EU Safe Harbor certification documentation of a number of industry-leading U.S. companies involved in digital profiling and online targeting and identified 30 of them that we believe are in violation of that framework. (See attached legal analysis for a more detailed discussion of Safe Harbor generally and the groupings of the specific violations that we found.) Although the companies on our list differ in the details of their various approaches to the digital data collection and profiling and targeting of individuals, five broad themes emerged in the course of our investigation, trends that underscore the fundamental weakness of the Safe Harbor in its current incarnation. First, privacy policies in general, and Safe Harbor declarations in particular, fail to meet the needs of EU consumers. The shortcomings of corporate privacy policies are well known: they are too long, too arcane, and most consumers refuse to read them. Additionally, most of these policies fail to disclose adequately the companies’ actual data-collection and consumer-targeting practices. The contrast between a company’s description of its services in a corporate privacy policy, and what the company actually does in terms of its real-world consumer data collection practices, is stark, and figures prominently in the complaints presented here. Even the clearest, most concise of the policies we examined tended to cover data collection on the corporate website that few consumers were likely to visit rather than the data- driven advertising products and applications that they were likely to encounter on websites, mobile devices, and other platforms.1 Safe Harbor declarations, in contrast, which in our study ranged from eight words to eight sentences, are too short, too vague, and are shared in a manner—on the DOC’s safeharbor.export.gov website and buried within corporate privacy policies—that few EU consumers are likely to see. This combination of faulty disclosure, alternately difficult to read and difficult to find, falls far short of adequately serving EU consumers seeking guidance on Safe Harbor and the privacy implications of these companies’ actual data practices, which these companies readily reveal to their own corporate customers. Such admissions, offered by the companies themselves in their product literature and financial reporting, reveal the extent to which they are engaged in the very acts of data collection and consumer tracking that their Safe Harbor and privacy statements attempt to disavow. Second, most of the companies we analyzed insist that they are “data processors” rather than “data controllers”—with the former ostensibly relieved of the obligation of upholding some Safe Harbor principles. The organization that engages the services of the online marketing specialist (or purchases its applications) is ultimately responsible for meeting the Safe Harbor requirements on behalf of all of these “processors” regardless of their data practices, or so the argument runs. But this assertion of “processor” status, of legal importance to EU consumers, is contradicted by the companies’ own statements, which we quote at length in the summaries that follow. These statements, gleaned from corporate websites, product 1 data sheets, and financial reports to the SEC and others, are replete with references to the power and precision of the latest online advertising technologies—showing these companies have sufficient power over user data to make them data “controllers” under the applicable definition. For example, companies summarized here that create profiles on consumers from different data sets are “controllers” according to the applicable definition in the EU Safe Harbor agreement, and all of the companies at issue here determine the “means” of processing—sufficient dominion over EU personal information to become a data controller.2 Third, the environment in which these companies operate is nothing less than an “online marketing ecosystem” that continues to grow more complex and more powerful with every new breakthrough in “Big Data” technology and every new partnership and alliance, merger and acquisition. Many of the companies on our list, for example, have been materially affected by these changes to corporate structure in recent years, and even those that have remained more or less independent readily boast of their ability to “onboard” vast quantities of consumer data from a wide variety of sources, online and off. Nowhere in the Safe Harbor documentation or privacy statements that we examined, however, are such developments mentioned and clearly explained, even in passing. Nor is real-time bidding (RTB), or programmatic buying, the increasingly prevalent data-targeting industry practice that U.S. companies have promoted in the EU, in which millions of individual users (whose personal profiles are stored in targeting databases) are effectively “auctioned off” to the highest bidders (companies that want to reach particular audience segments with their advertising) in the milliseconds before a given web page loads. All of this personal data flows from the EU to the U.S. in a fraction of a second—without the knowledge or consent of the consumer whose profile is being traded.3 Fourth, most of the companies we cite do not provide meaningful opt-out mechanisms that EU consumers can find and use to remove themselves fully from privacy-harming data collection and processing. Opt-out mechanisms are more often than not available only on U.S. corporate websites that EU consumers are unlikely to visit, while the outsourced, third-party mechanisms that many companies employ turn out to be questionably effective cookie-based solutions to cookie-based profiling. Such opt-outs are ineffective in many popular technologies that do not include cookies.4 In many instances, moreover, it is not clear whether consumers are actually opting out of data collection and processing covered by Safe Harbor Choice obligations, or simply getting less targeted advertising that results from such invasive practices. As consumers are increasingly tracked and targeted across various devices and applications, tagged with a variety of orchestrated cookie and non-cookie unique identifiers, EU (and other) consumers require greater transparency and control—safeguards that are not offered by the companies we identify in this complaint.5 Finally, while the companies on our list use terms like “anonymity” and “non- personally identifiable” (“non-PII”) with abandon, they operate in a manner (again, based on their own statements) that is quite the opposite. The reality, as our 2 complaints make clear, is that dozens if not hundreds of companies alternately compete and cooperate in collecting detailed information about individual consumers, processing that data for the insights therein, and then transferring those insights to their partners and affiliates for the purposes of targeted marketing and advertising. The oft-expressed claim of “anonymity,” ironically, is based simply on the absence in these digital consumer dossiers of any given names or government ID numbers (which have been discarded in favor of a more precise alphanumeric IDs in any case). But with a sufficient number of details about personal needs and interests, employment and social status, location and income, antiquated PII data concepts are not needed to track and target particular individuals. And neither— thanks to inadequate provisions of the Safe Harbor, inadequate FTC enforcement, and cynical corporate implementation of the Safe Harbor—is that consumer’s permission. 1 Aleecia M. McDonald and Lorrie Faith Cranor, “The Cost of Reading Privacy Policies,” I/S: A Journal of Law and Policy for the Information Society,” (2008): 540-565, http://moritzlaw.osu.edu/students/groups/is/files/2012/02/Cranor_Formatted_Final.pdf (viewed 15 July 2014). 2 See discussion of Article 29 guidance on the definition of “controller” in accompanying legal analysis document. 3 See, for example, “Criteo Gets Great Results Retargeting Audiences at Scale with Real-Time Bidding,” DoubleClick Advertiser Blog, 1 June 2011, http://doubleclickadvertisers.blogspot.com/2011/06/criteo-gets-great-results- retargeting.html; “Creatives Meet Coders: Pierre Naggar, Turn Europe,” Turn, http://www.turn.com/news/creatives-meet-coders-pierre-naggar-turn-europe; Jay Stevens, “Summary of IAB Italy Seminar on RTB: ‘Keep Calm, Test & Learn,’” Rubicon Blog, 8 July 2013, http://www.rubiconproject.com/blog/summary-of-iab-italy-seminar-on-rtb- keep-calm-test-learn/ (all viewed 10 July 2014). 4 Increasingly, and especially as mobile Web traffic grows, companies are turning to non- cookie-based approaches to profile consumers, through device-identification technology and device fingerprinting, with varying impacts on consumer privacy. 5 Gavin Dunaway, “ID Is Key: Unlocking Mobile Tracking & Cross-Device Measurement, Part 2,” AdMonsters, 3 Aug. 2013, http://www.admonsters.com/blog/id-key-unlocking-mobile- tracking-cross-device-measurement-part-2; Joanna O’Connell Luca S. Paderni, Samantha Merlivat, and Collin Colburn, “Solving the Cross-Platform Targeting Puzzle,” Forrester, Aug. 2013, http://www.acxiom.com/resources/solving-cross-platform-targeting-riddle/ (both viewed 15 July 2014). 3 Acxiom Corporation Complaint number 1 Company profile Acxiom Corporation is a data broker engaged in digital data profiling of individual consumers. According to a recent FTC report, “Acxiom provides consumer