1. Wrap Up on Privacy and Location Based Services Professor Peter Swire Ohio State University Federal Communications Commission: Helping Consumers Harness the Potential of Location Based Services June 28, 2011

2. Overview Outside DC: The sense of excitement and wonder about LBS Outside DC: The sense of excitement and wonder about LBS But, privacy risks But, privacy risks When to publish or withhold presence (Griffin) When to publish or withhold presence (Griffin) Notice/transparency Notice/transparency Choice and meaningful choice Choice and meaningful choice Getting to some new best practices Getting to some new best practices What will be obvious five years from now, and how can we get there sooner? What will be obvious five years from now, and how can we get there sooner?

3. Sense of Excitement & Wonder Tim S.: today consumers get real advantages from publishing their location Tim S.: today consumers get real advantages from publishing their location Coupons: from the Sunday grocery store circular to a basic tool of my law students lives – maybe you can pay your monthly phone bill with these discounts Coupons: from the Sunday grocery store circular to a basic tool of my law students lives – maybe you can pay your monthly phone bill with these discounts More gifts: from flowers on Mothers Day to BuyYourFriendaDrink More gifts: from flowers on Mothers Day to BuyYourFriendaDrink Serendipity: Serendipity: You find your old friend You find your old friend You dont miss seeing your old friend – fewer trains pass in the night You dont miss seeing your old friend – fewer trains pass in the night Game dynamic – life is more fun Game dynamic – life is more fun Carriers – a platform to make your device better Carriers – a platform to make your device better Many other advantages Many other advantages Fraud prevention, public safety (CPR) Fraud prevention, public safety (CPR) Dense mobile ecosystem, innovation, and economic growth Dense mobile ecosystem, innovation, and economic growth

4. Privacy Risks Privacy experts spot risks associated with location information Privacy experts spot risks associated with location information One-time shift to a world where we carry location tracking devices One-time shift to a world where we carry location tracking devices Government sees all: Government sees all: Surveillance of civil society Surveillance of civil society Location relevant to proving a large fraction of criminal cases Location relevant to proving a large fraction of criminal cases Supreme Court case next term on GPS tracking & Leahy bill Supreme Court case next term on GPS tracking & Leahy bill Marketers see all: Marketers see all: Current debates about targeted marketing & price discrimination Current debates about targeted marketing & price discrimination Blaze: Mobile aps are currently typically written by service providers, which want to collect as much user data as they can Blaze: Mobile aps are currently typically written by service providers, which want to collect as much user data as they can Others see all: Others see all: Burglars know Im not home, stalkers can find my kid, and teenagers might not want parents to track them Burglars know Im not home, stalkers can find my kid, and teenagers might not want parents to track them Which of these risks are realistic in practice? Which of these risks are realistic in practice?

5. Publish or Withhold Presence Familiar principles of notice & choice at center of policy discussion Familiar principles of notice & choice at center of policy discussion Notice: some background Notice: some background Future of Privacy Forum: 22 of 30 top paid aps no privacy policy Future of Privacy Forum: 22 of 30 top paid aps no privacy policy Brookman/CDT: most top aps gather geolocation Brookman/CDT: most top aps gather geolocation Similar history for web sites around 1997 of no policies Similar history for web sites around 1997 of no policies Notice: good practices Notice: good practices Panelists agree should have good privacy policies for geolocation Panelists agree should have good privacy policies for geolocation Limited real estate on mobile devices Limited real estate on mobile devices Usability on small screenUsability on small screen Just in time noticeJust in time notice Build smarts into notices, to comply with user preferencesBuild smarts into notices, to comply with user preferences Hard to be consistent across aps/devices/OSHard to be consistent across aps/devices/OS Evolve toward standard notices – financial privacy exampleEvolve toward standard notices – financial privacy example

6. Choice about Presence Broad acceptance of opt-in to collect geolocation information for aps Broad acceptance of opt-in to collect geolocation information for aps The basic choice – consumer chooses the ap/device or doesnt The basic choice – consumer chooses the ap/device or doesnt Some services have multiple opt-ins, stricter than in many other sectors Some services have multiple opt-ins, stricter than in many other sectors Some issues of meaningful choice Some issues of meaningful choice Active choice vs. passive collection Active choice vs. passive collection Glimpse vs. a service turned on once and then continuesGlimpse vs. a service turned on once and then continues Gather data only for a defined purpose vs. a bundled service (you use the service, we collect and perhaps sell all that data) Gather data only for a defined purpose vs. a bundled service (you use the service, we collect and perhaps sell all that data)

7. Moving Toward New Best Practices Rapid change and innovation (8000x increase in ATT mobile data traffic in 3 years) Rapid change and innovation (8000x increase in ATT mobile data traffic in 3 years) Optimism from some recent rounds of innovation: Optimism from some recent rounds of innovation: 1990s web privacy policies: 12% to 88% in three years 1990s web privacy policies: 12% to 88% in three years Software downloads – uninstall as standard feature Software downloads – uninstall as standard feature EULAs – can save and print now EULAs – can save and print now Spam, but CAN-SPAM and easy to opt out now from legitimate companies Spam, but CAN-SPAM and easy to opt out now from legitimate companies

8. Moving Toward Best Practices A problem: limited compliance staff in the garage A problem: limited compliance staff in the garage Over time, big fraction of Internet traffic in major players with privacy compliance; pattern may repeat for mobile aps Over time, big fraction of Internet traffic in major players with privacy compliance; pattern may repeat for mobile aps Long tail exists of smaller players Long tail exists of smaller players But privacy risks highest in big databases, where compliance staff does exist But privacy risks highest in big databases, where compliance staff does exist Trustmarks can help with smaller players Trustmarks can help with smaller players Length of time to retain data Length of time to retain data Search engines and every search you ever made Search engines and every search you ever made Now, major search engines anonymize after a number of monthsNow, major search engines anonymize after a number of months Location information and every place you have ever been Location information and every place you have ever been Many of the services (coupons, location of your friend) are for todays locationMany of the services (coupons, location of your friend) are for todays location Privacy risks reduced a lot if limit time that location is kept in identifiable formPrivacy risks reduced a lot if limit time that location is kept in identifiable form

9. Concluding Thoughts Two things to watch Two things to watch A risk that consumers cant turn on/off for location information that is widely shared A risk that consumers cant turn on/off for location information that is widely shared The eco-system must learn to work together to treat location data as sensitive The eco-system must learn to work together to treat location data as sensitive Lots of reason for optimism Lots of reason for optimism Sense of wonder, excitement, and growth Sense of wonder, excitement, and growth Consumers will learn to manage how to publish or withhold presence – Boyd research on how they do that already on social networks Consumers will learn to manage how to publish or withhold presence – Boyd research on how they do that already on social networks Emerging major players will develop privacy practices Emerging major players will develop privacy practices Government can play a role for now in increasing transparency and encouraging best practices Government can play a role for now in increasing transparency and encouraging best practices