I've been following the FTC's ongoing saga with website certification providers. There are a number of organizations that have been authorized to certify the privacy practices of websites. People pay money to these third parties, and they investigate the privacy practices of the companies and provide a certification. Additionally, receiving a certification from an entity that has been designated a "safe harbor" by the FTC means the website is deemed to be compliant with the Children's Online Privacy Protection Act (COPPA). One of the more widely known of these certification groups is TRUSTe.
Last fall, the FTC investigated TRUSTe for failing to actually check into more than 1000 companies it was "certifying" for their privacy practices. TRUSTe apparently just recertified a bunch of companies without checking to see if they merited the certification (other than payment of TRUSTe's fees of course).
Then back in November, the FTC settled with TRUSTe for $200,000. Following announcement of the settlement, several advocacy groups filed comments protesting the settlement with the FTC. The groups protesting included: Center for Digital Democracy, American Academy of Child and Adolescent Psychiatry, Campaign for a Commercial Free Childhood, Consumer Action, Consumer Federation of America, Consumer Watchdog, and The Rudd Center for Food Policy and Obesity. These groups all complain that the FTC settlement (at or below $200 per site) is too low to be a deterrent.
My completely unreliable web research indicates that TRUSTe's certifications cost more than $200 even for the most basic certifications. Of course this means TRUSTe makes money whether or not it actually does the certifications it is supposed to do. TRUSTeh?
It actually makes me wonder if these certification companies are capable of truly understanding and certifying the privacy practices of websites, companies and apps. Take your typical game app. It will have multiple advertising networks built into it, each sharing and using data in a different way. Typical apps will also feed data to third party analytics service. Typical apps also integrate with crash and bug reporting service.. Now let's start considering integrated social media through software developer kits for Twitter, Facebook, Instagram, SnapChat or whoever. We're almost there, but a lot of apps allow purchasing so they have application programming interfaces to third party vendors to accomplish these functions. All that is on top of the old-fashioned issue: did they remember to lock the door to the garage where the company server sits?
So what do I recommend to developers? Go ahead and get the certification for now. Know you are just buying a safe harbor and a sticker for your website. I also recommend doing your best to understand who is accessing your website's data and how they are using it. Probably the best thing you can do is to really understand how your (and your customer's data) is being shared and used by integrated third party systems. If you find you have a third party that cannot or will not tell you exactly how the data is being used, that is a red flag.
Here are links to a few helpful FTC resources:
Consumer Financial Information Compliance
Children's Information Compliance (COPPA)
EU/US Safe Harbor For Data Exportation
FTC 2014 Privacy and Data Security Update
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
