Recently, The Federal Trade Commission (FTC) released a staff report titled “Cross-Device Tracking” (staff report). As the title suggests, this staff report addresses the practice of cross-device tracking and builds from the FTC’s November 2015 Cross-Device Tracking Workshop (workshop), where stakeholders and others discussed cross-device tracking, its benefits and challenges, and industry efforts to address privacy and security concerns created by the practice. As a result of these efforts and discussions, the staff report recommends, in accordance with the FTC’s “longstanding privacy principles,” that companies engaged in such tracking: (1) provide transparency about their data collection and use practices; (2) provide consumers choices to control their data; (3) provide heightened protections for sensitive information, such as health, financial and children’s data; and (4) provide reasonable security for the data.

Cross-device tracking is, generally speaking, the practice of associating or linking multiple devices with the same person, such as smartphones, computers and tablets. The staff report first describes the evolution of behavioral advertising, from cookies that track a consumer’s activity on a single browser, to Flash cookies and browser history sniffing, to “onboarding” where companies combine offline and online data to create detailed consumer profiles, and finally to cross-device tracking where companies gather information about consumers across their connected devices, including smartphones, tablets, personal computers, and other “smart” devices. While the technology has evolved, the underlying goal remains – collecting information about consumers’ interests and purchasing habits and creating detailed “profiles.” More and more companies are using this technology to reach their customers and determine the effectiveness of their advertising.

The staff report also addresses the many benefits and challenges associated with cross-device tracking, as primarily raised during the workshop. One benefit is that cross-device tracking creates a seamless experience for consumers across their devices, which may be beneficial to users reading books or watching movies on multiple devices. Another benefit is that cross-device tracking provides added fraud detection and account security by knowing which devices are associated with a particular account and which aren’t. Additionally, cross-device tracking not only enables marketers and website hosts to provide consumers with a better online experience, but may even enhance competition in the advertising ecosystem.

Cross-device tracking may also impose numerous privacy challenges, according to the staff report. The first is transparency, as consumers may be unaware that their browsing behavior on one device will inform the ads they see on another device. The second challenge is that consumers who are uncomfortable with the practice may have limited choices to control it. Moreover, there are security concerns associated with cross-device tracking. For example, companies utilizing this technology collect and aggregate vast amounts of data about sites visited and apps used, often in conjunction with raw or hashed email addresses, and these large caches of data are ideal targets for hackers who may publicize that information without the consumers’ permission or otherwise use it for blackmail or spear phishing campaigns.

Driven by these concerns, the staff report concludes with several recommendations for implementing transparency, choice and security into the realm of cross-device tracking. For example, FTC staff encourages entities with direct consumer-facing relationships and those working in cross-device tracking behind the scenes to truthfully disclose their tracking activities, and to provide meaningful information that will permit consumers to make informed decisions regarding whether to use opt-out tools, to silo their activities, or to stop using a website, app, or service altogether. The FTC also recommends offering choices to consumers about how their cross-device activity is tracked, and reminds companies that the FTC Act requires them to respect such choices and to clearly and conspicuously communicate the parameters or limits of such choices. Additionally, the FTC advises that companies obtain consumers’ affirmative express consent before engaging in cross-device tracking on sensitive information and before collecting and sharing precise geolocation information. Finally, the FTC encourages companies to maintain reasonable security to avoid future unexpected and unauthorized uses of data.

The FTC has once again made clear that they expect consumers to be provided with accurate and non-misleading notice and choice about your tracking practices, as well as reasonable security for data collected. For questions on cross-device tracking or privacy policies, please contact Heather Enlow-Novitsky, Scott Guttman or your Vorys attorney.