Our comment on the OMB's proposal
Thursday, August 6th, 2009Webtrends has the following comments on the OMB’s proposal:
1. Webtrends supports privacy guidelines focused on transparency and control. Under the OMB’s proposed framework any federal agency using web tracking technologies on its Web site would be required to adhere to the following basic privacy principles:
• Adhere to all existing laws and policies (including those designed to protect privacy) governing the collection, use, retention, and safeguarding of any data gathered from users;
• Post clear and conspicuous notice on the Web site of the use of web tracking technologies;
• Provide a clear and understandable means for a user to opt-out of being tracked; and
• Not discriminate against those users who decide to opt-out, in terms of their access to information.
Webtrends recently stated its support for broad privacy principles such as these in the context of government Websites. In applying these principles, we respectfully recommend that the OMB focus on principles of transparency and control applied proportionately to the privacy risks. The OMB should also avoid being overly prescriptive about how agencies are expected to comply. Specifying technological methods that should be utilized can be overly burdensome and could even prevent the use of more protective privacy solutions that are constantly being developed. Instead, agencies should have flexibility to find effective solutions that work best for their Web sites and citizens’ needs, while taking into account the privacy impact of the level of tracking being conducted and the type of information being tracked.
2. Webtrends recommends additional tracking levels based on additional factors. The OMB has offered for consideration a three-tiered approach to the use of web tracking technologies on federal government Web sites:
• 1st – Single-session technologies, which track users over a single session and do not maintain tracking data over multiple sessions or visits;
• 2nd – Multi-session technologies for use in analytics, which track users over multiple sessions purely to gather data to analyze web traffic statistics; and
• 3rd – Multi-session technologies for use as persistent identifiers, which track users over multiple visits with the intent of remembering data, settings, or preferences unique to that visitor for purposes beyond what is needed for web analytics
In addition to these three tiers, we respectfully recommend that the OMB consider other levels based on the following factors:
• Whether First Party Cookies Are Implemented. Federal web administrators that choose to serve first party cookies should have less stringent privacy requirements than those that use third party cookies. Third party cookies are served up by, and data collected using, applications on third party servers. In contrast, first party cookies are served up, and data collected, using applications on the agency’s own servers. By storing their own cookie data, federal agencies can better control access and use of the data collected from visitors to government Web sites. Further, because first party cookies are only delivered by the sites they are visiting, privacy issues are minimized. With first party cookies, citizens know who is collecting their data and who they can contact if they have a problem with a cookie.
• Whether Web Analytics Data is Anonymized. A distinction should also be made based on whether personal information is tied to cookies or if visitors remain anonymous. Processes have been developed that obscure or eliminate IP address and other potential identifiers. Such techniques further enhance privacy, while still allowing for meaningful analytics. Whether these processes are used should be taken into account as additional factors in determining what levels of privacy protections should be applied.
Webtrends encourages the OMB to take its comments into consideration as it continues to develop its policy. We also urge our federal government clients to submit input to the OMB Proposed Revision of the Policy on Web Tracking Technologies for Federal Web sites to make sure their concerns are addressed. Comments can be posted until August 10th on the Office for Science and Technology blog, in response to the Federal Register Notice using methods described in the notice, or emailed to: oira_submission@omb.eop.gov.


Follow us on Twitter




