Much has been written about Facebook’s upcoming initial public offering—which, if successful, will raise more than $5 billion, making it one of the largest IPOs in history. The information about Facebook’s operations that has been released paints a picture of a company that is certainly not without risks to investors. But with a customer base of nearly 800 million, who cares? We’ve also been reading a lot about Google’s attempt to change its privacy policies and how governments in the United States, Europe, and elsewhere have reacted with significant concerns about the consumers who will be affected by the revisions. Adding to the paternalistic instincts of legislators and consumerists is Facebook’s planned “timeline” profile page and the privacy concerns surrounding it.
Combined, Facebook and Google are once again profoundly changing the world in which companies operate, as they already have so many times in the recent past. This time, however, those changes may go to the core of how companies deal with their customers in the cyber marketplace. This column addresses what may be next on the horizon and why corporate counsel need to be concerned.
In the February 5, 2012, New York Times Sunday Review, Lori Andrews, a law professor at Chicago-Kent College of Law, writes in her editorial, “Facebook Is Using You,” that Facebook, unlike other companies, doesn’t manufacture anything. They sell nothing to consumers. What they have, however, is one of the largest inventories of personal data—from nearly 800 million people—ever assembled. That inventory, when sold to marketers trying to reach consumers, makes Facebook a fortune without a single assembly line or plant. Likewise, Google, another company that makes nothing and sells nothing to consumers, has proposed changes in its privacy policies in hopes of reaping even greater profits, trading in the personal data of everyone who searches for a product or uses its services.
While much of what Prof. Andrews fears is true, she is dead wrong that Facebook and Google don’t “make” anything or “sell” anything to consumers. They create more commerce and conversation than just about any brick-and-mortar company could ever dream of exploiting. They deliver, with great precision, what marketers used to pay to very inefficient list brokers. And they deliver to consumers, with equally great precision, exactly what consumers want, whenever and wherever they want it. In short, they unite the two ends of the business cycle—the manufacturer (or service provider) and the consumer—more efficiently than ever before.
But with this precision has come great concern about whether doing this is taking unfair advantage of consumers, duping them into a false sense of security as they share what is often the deepest of personal information, at times shockingly so. It also raises significant fears among the law-enforcement community about what privacy thieves and online criminals and predators can do with all that information.
In response to pressures from the U.S. Congress and the European Union, the marketing industry proposed—and in the United States adopted—robust self-regulatory rules to control what is collected, who uses it, and how consumers can control it. The U.S.-based Digital Advertising Alliance, under the umbrella of the Council of Better Business Bureaus and in response to pressure from the Federal Trade Commission and Congress, enacted rules for online behavioral advertising (OBA), the details of which can be viewed at aboutads.info. As I’ve written in a past column, every company needs to review those rules and, where appropriate, comply with the mandates. Similar self-regulatory rules proposed in Europe were dismissed as insufficient. Time will tell how the conflicts between what European industries want and what the EU will accept will be resolved.
So if corporations adopt the OBA rules, why should they worry about what Facebook and Google are doing?
A key to the OBA rules is that they do not apply to information about consumers that a company learns from visitors who directly come to its sites. In those instances, companies do not have to give consumers the right to opt out of receiving messages from them via pop-ups or other online enticements during their visits. That information is subject only to the terms and conditions and privacy policies posted by the website owner. And as long as the company does not sell that data to others or purchase it from others, it’s pretty much free to use that data as the company pleases. Of course, companies can elect to give consumers additional rights, but they are not mandated to do so by law or self-regulation.
But that may soon change if the pundits lining up against Google and Facebook have their way. At the core of their objections is what the Internet giants do with the products they manufacture by compiling personal data on the consumers who visit their sites. In a sense, that’s no different from what any company does with the information derived from its customers. Except in the case of Google and Facebook (and others in the search and social media cyber-realm), they reach hundreds of millions of consumers worldwide. Their efficiency and clout are overwhelming compared to what the biggest among the brick-and-mortar crowd could ever hope to achieve. So when Google and Facebook agree to (or are forced to accept) limitations on what they can do with personal data, corporate counsel need to take careful note as the slope is very slippery indeed from what search and social media concede and what will impact offline corporations.
It is not a stretch to expand consumer rights to the information they volunteer when visiting a corporate website, using the same arguments advanced in the turf wars underway with Google and Facebook. After all, the underlying principle is that a consumer should control his or her personal data no matter who collects it. And this is particularly true, some critics say, since consumers don’t receive a dime for the valuable information they contribute to the e-commerce ecosystem.
But they do, indeed, receive great value through the most efficient information filters and finders ever invented, which could never be delivered offline. It is foolish to say that such cost-effective advances are not of great value to the entire commercial chain. Moreover, limiting the opportunities these filters and finders provide, would, without question, raise the barriers to entry for would-be entrepreneurs dependent upon the opportunities a well-tuned and targeted promotional campaign provide.
So with this backdrop of hysteria in the halls of legislatures over what Facebook and Google are doing, what should corporate counsel be doing? In addition to making sure someone in their organization is watching these developments (on a global basis), corporate counsel are well advised to take another look at their own privacy policies and determine if (1) they’re being followed, and (2) if they’re too restrictive. They should also take a close look at what their companies are doing. What are they doing on Facebook? Do they have their own “channel” on You Tube? What are they doing on Twitter, Four Square, Linked In, and the growing community of social media sites? What are they blogging and where?
While it may be difficult to change current corporate polices and procedures to unleash the potential of the data collected from their own site’s visitors, now is the time to undertake that review, before scrutiny gets worse, as comparisons are made to the upcoming voluntary or imposed restrictions on Google and Facebook. It will make a difference. Understand that when Google or Facebook make a concession, they’re doing so from a base of hundreds of millions of consumers. They can easily give away informational real estate without suffering serious losses. But even the best among social media-savvy companies have only a few million loyalists, and the impact of any limitations would be far more significant.
