All that’s digital isn’t goldThe challenges and risks of the digital ageLucy Hopkins

Consumer Focus

About Consumer Focus

Consumer Focus is the statutory consumer champion for England, Wales, Scotland and (for postal consumers) Northern Ireland.

We operate across the whole of the economy, persuading businesses, public services and policy-makers to put consumers at the heart of what they do.

Consumer Focus tackles the issues that matter to consumers, and aims to give people a stronger voice. We don’t just draw attention to problems – we work with consumers and with a range of organisations to champion creative solutions that make a difference to consumers’ lives.

Following the Government’s consumer advocacy reforms, we will continue to act in the consumer interest across a wide range of sectors until our general advocacy role passes to Citizens Advice in April 2013.

As part of the reforms, Consumer Focus will establish a new unit to identify and represent consumers’ interests in complex, regulated sectors, including energy and post issues and, in Scotland, water.

Our Annual Plan for 2012–13 is available online at www.consumerfocus.org.uk.

This report is based on research by Ctrl-Shift. See Defining and defending consumer interests in the digital age.

Photo creditsCover image: James Lee, license Creative Commons; page 28: JISC infoNET, license Creative Commons; page 32: Indi Samarajiva, license Creative Commons; page 37: Paul Hamilton, license Creative Commons; page 39 (top): Mary Woodard, license Creative Commons; page 39 (middle): Liz Henry, license Creative Commons; page 39 (bottom): Stitch, license Creative Commons.

Consumer Focus is not responsible for the content of external websites and resources cited in this report.

For regular updates from Consumer Focus, sign up to our monthly e-newsletter by emailing enews@consumerfocus.org.uk, see our blog at www.consumerfocus.org.uk/blog or follow us on Twitter http://twitter.com/consumerfocus.

Contents

All that’s digital isn’t gold

Executive summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Transition is underway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

But what about the challenges and risks? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

The nature of the challenge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

What we want to achieve with this report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

What we did . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Potential downsides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Privacy and data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Digital identity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Information access, power and trustworthiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Regulations, rights and e-commerce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Consumer empowerment and education . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Research and understanding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Creating 'real' choice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Regulation and enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

4 Consumer Focus

Executive summary

Transition is underway

The world as we know it is changing. We are seeing huge transformations in technology, demographics, business, the global economy and the environment which are bringing about changes in the way consumers participate in the economy and society. In particular, these technological developments such as social networks and peer-to-peer networks are enabling consumers to act in more demanding, better informed and increasingly empowered ways. Forrester1 is calling these changes the ‘age of the customer’; a time when focus on the customer will matter more than any other strategic imperative. This challenges the existing customer relationships of both companies and public sector organisations. For example, with online reviews and mobile web access, consumers can know more about a company’s products, their service, competitors, and pricing than companies do. Customer word of mouth has the capability to undo huge brand investments.

However, things have not always looked this promising for consumers. Contrast Forrester’s outlook with how things were in the not-so-distant past of 2004, with an example from Guardian journalist Jonathan Freedland who was unsuccessful in getting a refund from UPS2. He stated:

1 Forrester Research, Competitive strategy in the age of the customer, 2011

2 http://bit.ly/JK20W6

‘In case after case, the evidence points to consumers all but impotent in the face of companies and, sometimes, governments... the consumer is not so much king as downtrodden subject... Consumer power is an illusion. Companies like to tell us they listen and they care – but peel away the PR slogans and there is nothing there... But you have to have infinite amounts of time, clear writing skills, and be at home during the day – and you are still likelier than not to fail. Organisations know this and exploit it. They are quite happy that there is a hassle bar standing between them and their customers.’

Quite the contrast between this gloomy assessment and what Forrester is now observing.

Clearly a big change is underway. In just a short space of time, consumers have progressed from Freedland’s ‘downtrodden subjects’ to, as Clay Shirky describes, consumers who can ‘talk back to business and speak out to the general public, and they can do so en masse and in co-ordinated ways’3 This change reflects a pretty extraordinary change in the market. Thanks to the web, markets are becoming better informed, smarter, and more demanding – qualities missing from most business organisations.

3 Clay Shirky, Here comes everybody, 2008, p179

5All that’s digital isn’t gold

Widespread access to the internet and the new technologies that are built upon it are making powerful new approaches to consumer empowerment possible. We are seeing extraordinary advances in our ability to communicate with each other, that will have a more profound and transformative effect on society and the economy than previous advances in communications technology. This is primarily because it enables many-to-many communication at a mass scale for the first time in human history4.

As a result were not only able to do the same things better, we’re able to do things differently and in powerful new ways. This is having a huge impact on the ability of consumers to act in empowered ways.

With consumers becoming better connected and thus more powerful in the marketplace, they are changing the behaviour of producers and providers as well as altering the dynamics of markets. The barriers to consumers participating in this changed environment are collapsing and we are seeing consumers forming their own networks and taking part in co-operation, collaboration and collective action. As Charles Leadbeater describes:

‘People can become organised in new ways, at low costs, without many of the paraphernalia of traditional, hierarchical organisations – head offices, layers of bureaucracy, departments, job titles and so on. That capacity for collective self-expression and self-organisation creates new options for us to become organised, to get things done together in new ways.’5

4 Clay Shirky, Here comes everybody, 20085 Charles Leadbeater, We think, 2009, p2

People are engaging in new forms of sharing and mutual support. They are amassing and expressing their individual experiences of consumption so everyone can see almost instantly their feedback on the goods and services they are receiving through sites such as Reevoo, Amazon and Ebay. Collectively they are amassing buying power and focusing it in new directions, such as with collective switching, where it’s possible for an intermediary to convert the demands of consumers and combine them into a big enough slice of market share that companies are unable to ignore.

We have seen great strides in getting UK homes online. The majority of homes are now connected to the internet, up from 25 per cent in 2000 to 76 per cent in 20116. However, take-up of broadband continues to vary between the nations, with just 61 per cent of Scottish homes having broadband access compared to 71 per cent in Wales and 75 per cent in Northern Ireland7, showing us that there is still work to do to get people connected so they have the option of engaging in the digital revolution.

6 http://bit.ly/JwFL1C7 Ibid

6 Consumer Focus

We are also seeing a huge increase in people using the internet for online transactions. Online sales totalled a modest £0.8 billion8 in 2000. By 2010, 37 million online shoppers9 had undertaken 89 million online transactions10, pushing sales totals towards the £59 billion mark11. That figure was forecast to grow by a further 18 per cent to £69 billion during 201112. Ofcom, reports that nearly three-quarters of UK internet users use their broadband connection for purchasing goods or services, making it their third most popular online activity13.

Alongside this, since 2009 there has been a 90 per cent increase14 in the number of contactless cards distributed across the UK, and during 2010, over 1.7 million contactless transactions were processed. PayPal is projecting that it will process $7 billion in mobile payments in 2012, almost double the $4 billion mark recorded in 201115.

8 Online retail sales up 5,000% since 2000, high street up by 21%, Internetretailing.net, 9 June 2009: http://bit.ly/HnmXAP (citing Interactive Media in Retail Group/Capgemini Index)

9 See: Interactive Media in Retail Group (IMRG) industry dashboard: http://bit.ly/HTuH2N

10 Ofcom, The Communications Market, 2011 – Section 4: Internet and web-based content citing 2009 Mediascope Europe findings that UK internet users estimated they spent an average of £1,031 online, across an average of 19 transactions, p236: http://bit.ly/pW1mhy

11 See: IMRG/Capgemini e-Retail Sales Index: http://bit.ly/HL6sDy

12 Ibid13 Ofcom, The communications market, 2011 – Section 4:

Internet and web-based content, p236: http://bit.ly/pW1mhy

14 http://bit.ly/LaOjfw15 http://bit.ly/JiD6hg

The development and expansion in ownership of mobile and smart phones is increasing consumer use of the internet at a great pace. In 2010, 91 per cent of adults in the UK owned/used a mobile phone16 and in October 2011, around 50 per cent of the UK population owned a smart phone17. In 2010, the UK had the highest number of smart-phone users in Europe, at 11.1 million18. That year, 31 per cent of people in the UK browsed the internet on their phones compared with 22 per cent in Europe as a whole and 18 per cent accessed social media compared to 11 per cent in the EU19.

More than one in every five hours spent by UK users on the internet in April 2011 was on social networking sites and in the first quarter of 2011 nearly half of all UK internet users (46 per cent) claimed to have used a social networking site in the past week, up from just one in five three years previously20. This illustrates the scale of migration online for social interactions as well as online shopping.

16 http://bit.ly/Ks5QPe17 http://bit.ly/JyNjGO18 http://bit.ly/KekWMf19 Ibid20 Ofcom, The communications market, 2011, p226

7All that’s digital isn’t gold

But what about the challenges and risks?

Most observers would say that these new technologies have brought significant benefits to consumers. However, these technologies can also present real and potential downsides too. There has been less focus on what the potential risks and challenges might be for consumers who are already adopting these technologies or who will take advantage of the new digital services and opportunities as they start to enter the mainstream in the next few years. This may well be because we already appreciate and understand many of the benefits whereas a number of downsides are only just emerging or are just potential problems that have not yet blown up. In addition, this area is such a quickly developing field with many opportunities for downsides to overlap. It is sometimes difficult to get a firm grip on what this means for consumers now and in the future, the extent to which they might cause detriment and what action should be taken to protect the interests of consumers.

So although we are seeing a new era where inevitably there are new benefits and opportunities, these will also be accompanied by new problems and new forms of detriment. For example, social networks and digital media companies are building all these fantastic services and applications for people to use for free but they are imposing inscrutable and longwinded terms and conditions on their hundreds of millions of users.

Users may not realise what they’re surrendering in order to access the free service. Through the one act of clicking ‘I agree’, the only choice someone can make if they want to use the service, users are unknowingly setting a range of processes in place, of which they have absolutely no understanding and, most importantly, over which they have no control.

Another high profile issue is data security. Thinking about electronically held data, centralised customer databases are a natural target for thieves and fraudsters. There have been a number of high profile cases of companies’ databases being compromised and records stolen. According to the Norton Cyber Crime Report for 201121, 431 million adults worldwide were victims of cybercrime in 2010. The total cost of those crimes amounts to $114 billion. The report also found 10 per cent of respondents had experienced cybercrime on a mobile device.

There have also been high profile cases of data being mislaid through careless handling. In healthcare, for individual patients, there are many benefits that emerge from electronically held patient records such as access to good care becoming easier and safer when records can easily be shared. Important information – such as blood type, prescribed drugs, medical conditions and other aspects of our medical history – can be accounted for much more quickly. However, the NHS has lost millions of patient records22 through careless handling, leading to the Information Commissioner calling for tougher penalties for NHS Trusts and hospitals which lose data.

21 http://bit.ly/LaOLKP22 http://bit.ly/LumWmF

8 Consumer Focus

Alongside these problems are also many areas where we are seeing mixed blessings for consumers. Successful companies, such as Google, can be both a solution and problem, offering great services to consumers but with practices that can affect outcomes in ways that are not always transparent to users. For example, the services that Google provides, such as its search engine, are incredibly popular with consumers. Google has 91 per cent of the mobile and tablet search engine market and 83 per cent of the desktop search engine market in the UK in February 201223.

However, this popularity can be a double-edged sword. In December 2009 Google started tweaking the search results it shows individuals according to the data it holds on them – for example, what they have searched for before. This means that, over time, no two individuals putting in the same search query will see the same results. What search results show is not ‘what’s available out there’ but ‘who Google thinks you are’. What’s more, people are unaware of this bias because it’s invisible. This causes its own problems because in polls, a huge majority of us assume search engines are unbiased. More and more, your computer monitor is a kind of one-way mirror, reflecting your own interests while observers watch what you click24.

23 http://bit.ly/LcZR4L24 Eli Pariser, The filter bubble: What the internet is hiding from

you, 2011

The nature of the challenge

An important feature of all of the issues raised above is the pace of change we are seeing; it is, in many cases, faster than the wheels of regulation can turn. But speeding regulation up may actually be undesirable and counterproductive – it will never be able to keep up with new technological developments and may not be the right solution to the problems. There will need, instead, to be a blend of different responses and solutions.

While these may include traditional regulation, even this will require regulators to adapt the way they work to find new forms of response. All bodies charged with consumer protection, from government to regulators, will need to consider how emerging detriments overlap with traditional rigid regulatory boundaries. For example, potential detriment emerging from new electronic payment methods could fall within different regulators’ remits, such as Ofcom and the Financial Services Authority. The responses to this will therefore need to go beyond the traditional organisational boundaries so these emerging issues don’t fall between the gaps. This might well mean that cross-disciplinary and cross-regulatory task forces need to be established in certain areas to make sure that complex issues are tackled appropriately.

Regulators will also need to find other, more innovative, responses to solve fast-moving problems that cut across geographical boundaries and jurisdictions. Many of the issues in this report fall in to this category, such as establishing a set of standards that will apply to people’s online identities and data when they die (digital wills).

9All that’s digital isn’t gold

The solution is not as simple as the regulators in the UK imposing new rules and regulations because people’s online lives do not respect national boundaries. At the very least, it will require co-ordination on an EU level but most of the time, issues emerging are global and need global co-operation and responses.

What we want to achieve with this report

This report identifies what these emerging detriments might be for consumers. It is not meant to be an exhaustive list of downsides, nor one that will be agreed upon by everyone that reads it. These issues cover a wide range of potential downsides. Some of them, such as the role and exploitation of personal data in modern commerce, are still new. People are struggling to understand their implications. They involve conflicting interests, values and agendas which can only be resolved by society-wide debate. Others, such as misleading or ‘sharp’ practice in e-commerce, are simply old tricks reinvented for new times and contexts, a by-product of a still immature market. Nevertheless, they still need addressing.

In this report, we are using the words ‘downside’ and ‘detriment’ to mean situations where an individual, or groups of individuals, face a risk, suffer a loss (eg theft), incur an emotional cost (eg anxiety, stress), a material loss (eg time, money) or suffer a lost opportunity (eg forgo a potential benefit). It is important to include lost opportunities because some of the biggest downsides may be benefits that individuals could experience but which they miss out on partly because they are not aware that the opportunities exist in the first place.

The aim of highlighting these detriments is to prompt debate and persuade those who are in a position to pre-empt and prevent these to begin to think about, understand and respond to these consumer detriment issues now. They also need to start to consider how best they can respond to the challenges these detriments will present to our traditional regulatory frameworks.

With all the other issues being faced by consumer protection bodies, it’s easy (and understandable) to be preoccupied by the task at hand and the problems of the here and now. But, as this introduction outlines, change is happening fast and the window of opportunity to be proactive in addressing these problems is limited.

This report is not about making specific recommendations for each area but is intended as the start of a process; a prompt to those in a position to address these issues (regulators, enforcers, consumer groups and companies that operate in this area) to be proactive in minimising and preventing downsides emerging at the outset by identifying and addressing their sources before they become widespread problems.

10 Consumer Focus

What we did

We commissioned Ctrl-Shift25 to create a list of potential digital downsides to inform our work. The methodology involved targeted crowdsourcing of potential digital downsides by reaching out to Ctrl-Shift’s network (including academics, businesses and non-governmental organisations with expertise in this area) to build a list of potential detriments. Activities included:

● blog posts

● issuing a newsletter to a community of 600 people interested in consumer empowerment

● reaching out to consumer groups such as Consumers International and BEUC, the EU consumer organisation

● requesting feedback from the international ‘Project VRM’26 community (focused on empowering individuals by providing tools to help them manage their data and relationships with organisations)

● engaging with a number of experts to gather their feedback

The list of potential downsides was categorised under overarching themes. We held two workshops at Consumer Focus with a range of stakeholders to discuss this initial list to help provide us with further input on the findings.

This report covers a summary of those issues and highlights the key themes relevant for consumer protection. These are:

1. privacy and data

2. digital identity

3. information access, power and trustworthiness

4. regulation, rights and e-commerce

25 http://bit.ly/Lun99i 26 Project VRM is a research and development project of

the Berkman Centre for Internet and Society at Harvard University

It is important to remember that each of the issues and categories do not stand alone – they link and overlap with each other as well as crossing traditional regulatory boundaries. Also, some are well known, such as cookies, while others are just emerging, such as facial-recognition software. We have chosen to categorise these issues into four groups but there is a multitude of ways they could be categorised. It is not meant to be an exhaustive list of downsides, nor one that will be agreed upon by everyone that reads it. We hope that this list will be a starting point that will prompt consideration of these issues as well as the issues that we have not captured here.

This research does not cover issues emerging from the digital divide – some people being able to access digital technologies and some not. Instead, this project focuses on consumers who are already engaging in these digital technologies. However, Consumer Focus has done work on disadvantaged consumers and the digital divide, which can be found on our website27. We are also currently working with Citizens Advice on 'Tackling consumer vulnerability: An action plan for empowerment', a project to empower consumers in vulnerable positions (not yet published).

There are some issues that were highlighted in the initial horizon scanning research done by Ctrl-Shift that have not been included here. With such a long list of detriments, to make this report readable and manageable we have picked out the ones that we felt were most important. To see a copy of the full list of potential downsides highlighted by Ctrl-Shift in the report they wrote for us, please go to: http://bit.ly/JWSpwo.

27 http://bit.ly/JK3WOk

11All that’s digital isn’t gold

This section covers the four overarching themes that have come out of our horizon scanning research. These four themes provide a way to categorise the potential digital downsides we want to highlight in this report. As mentioned above, this is not an exhaustive list but a way to stimulate thought and debate and to help create an action agenda – to identify issues that need addressing. Please add any comments you may have on the categories and topics to our blog: http://www.consumerfocus.org.uk/blog.

Privacy and data

Not long ago ‘the consumer’ was perceived by companies as a faceless entity. Mass audiences consumed TV and other forms of media. When shopping, they paid with cash – a payment medium that kept them anonymous. Today, virtually every step of every part of daily activity generates some new digital data – data that is usually personally identifiable and captured, stored, analysed and shared. For example, through our use of Facebook, advertisers can now know what brands we and our friends like and talk about, helping companies to target us with specific offerings they think we will want. In this new kind of economy where our transactions, what we search for, who are friends are and how we live our lives becomes more visible, privacy is a real challenge.

Who controls personal data?Commentators have described personal data as the ‘new oil’28 – the commodity that will power the digital economy. As with any commodity, control of the resource confers or consolidates power. Competitive advantage and therefore profit in the 21st century will increasingly align with the effective collection and application of personal data. Control of personal data is therefore set to become one of the major consumer issues of the current decade and of the digital economy.

The extent of individual’s ‘digital footprints’ left by their daily online activities is rapidly expanding. There are now a huge number of websites and technologies that are automatically collecting our personal data as we do things online. Consumers leave a trail whenever they log onto the internet, use their mobile phones and even use public transport. While the motives for data collection might be benign (recommending new music you might like, or contacts you might know), there are significant implications for the protection of personal privacy.

This information also has huge and growing commercial value. One debate is how big a share of this value individual should receive (if any). Individuals are often not aware that the data is being collected, exactly what data is being collected, by who, who has access to it, or how the data is being used. 88 per cent of US consumers say they feel companies are primarily collecting personal information for their own benefit, and 85 per cent are often concerned about how much of their personal information is held by others29.

28 http://slidesha.re/K7SUkG; http://bit.ly/K5nJI4 29 http://bit.ly/J8FB0R

Potential downsides

12 Consumer Focus

They have little or no control over data collection decisions that companies make even though they may also result in a loss of privacy. 57 per cent of US respondents say it is important to know exactly how their data is going to be used, selecting this as one of the most important criteria when deciding whether to trust a brand30.

In the UK, two-fifths of consumers (40 per cent) strongly agree that they would be more willing to share personal data and information if the recipient was clear about how the information would be used and if permission could subsequently be withdrawn31. For this reason, none of the downsides listed below that flow from this issue should be considered solely in isolation – but in the general context of the question: who should control, determine access to and benefit from the use of our personal data – the consumers whom the data concerns or the organisations that gather it?

Geo-location data

Geo-location32 data is a new opportunity for data gathering which could result in a range of valued new consumer services. GPS-enabled applications on smartphones such as Foursquare, Brightkite and Gowalla can let your friends know where you are, check you in remotely at clubs, bars and restaurants, or find places recommended by people you know.

30 http://bit.ly/LuzgDf31 ICM Research omnibus survey carried out on behalf of

Consumer Focus between 10 and 14 February 2012 on a sample of 2,002 people (not yet published)

32 The identification of the real-world geographic location of an object

Yet there are many questions still to be answered around who owns the data collected, how much should be collected, how much knowledge and control consumers should have of the data that is collected about them, who should have access to it and what the legitimate use of this data is. In addition, specific risks could emerge if parties with malicious intent know where certain people are or aren’t.

This is particularly relevant because of the huge expansion in our use of mobile phones. In 2010, 91 per cent of adults in the UK owned/used a mobile phone33 and in October 2011, around 50 per cent of the UK population owned a smart phone34.

This huge increase in mobile and smart phone use means that mobile phone companies are seeking to maximise geo-location data as a new revenue stream. Location data is some of the most lucrative information a mobile phone can provide, since it can tell advertisers not only where someone’s been, but also where they might be going, when they get there, and what they might be inclined to buy when they get there. In effect, mobile companies are becoming consumer data companies collecting information about: who is talking to who, when; where people go, when; what services they use on the internet via their phones; what they buy using their phones; what media they use on their phones etc.

33 http://bit.ly/Ks5QPe34 http://bit.ly/JyNjGO

13All that’s digital isn’t gold

However, consumers are often unaware of the amount of information that is being collected about them when they check in at a certain coffee shop, take pictures at a favourite park and post them to Flickr or relay their Foursquare location to their Twitter account. Many people do not understand the potential consequences of these actions. Social networks have increased enormously in size and number and most of them allow you to relay messages between different sites. Information people trust to their friends might end up somewhere else. This means it’s very easy to lose track of just how much information you might be giving away and how many people have free access to it. People might be over-sharing without knowing about it.

We are seeing very little scrutiny or regulation of these new geo-location data streams, and very little understanding of the unintended consequences of their collection, analysis or use by corporations or parties with malicious intent. Although we’ve seen some investigation into these practices abroad35, full oversight of these kinds of activities and what they mean for consumers is needed.

Cookies

Cookies are small files placed on a person’s computer by sites they visit, which capture information about their movements online. Some cookies are strictly necessary for online operations to work, such as completing online shopping.

35 http://bit.ly/JwSrp4

Others are not ‘necessary’ for a specific function; their main purpose being information gathering. Many cookies are used for the purposes of behavioural targeting, which lets organisations track an individual’s movements across the internet, gathering a record of which websites they visit and which items they click on. Individual pieces of data deposited by a person’s web browser are gathered and reassembled by dozens of companies and sold36.

Making money out of this is now big business. For example, the world’s largest advertising agency WPP recently launched XAXIS37 which claims to allow advertisers to target consumers with what they want, in real time. This is described as ‘the Holy Grail of online advertising', meaning that advertisers can find customers who are inclined to buy immediately without needing to scatter their messages across countless media options.

Advertisers say there are no privacy problems with behavioural targeting because it uses no personally identifiable information. Individuals are identified via the IP address of their computers. But this is only one small step away from identifying the individual. Many organisations can link a name and address to an IP address, and there are widespread concerns that ‘pseudonymous’ information of this sort, where a name is replaced by a number, does little or nothing to protect privacy38.

36 http://bit.ly/MAzmbM37 http://bit.ly/Lhyh6u38 Paul Ohm, Broken promises of privacy: Responding to the

surprising failure of anonymisation. UCLA Law Review, Vol 57, 2010 p1701

14 Consumer Focus

In addition, there are different types of cookies such as functional, session and persistent cookies installed by first or third parties. From a consumer perspective especially, there are concerns over installation of third-party cookies. These are particularly privacy invasive due to the fact that they are sent to invisible third parties that the user does not have knowledge of.

In our research in 201039, 47 per cent of consumers were either unsure, did not know or had never heard of cookies, showing that we are dealing with low levels of understanding and that low awareness that cookies are being placed on their computers. They do not understand what different cookies are being used for and have no say or control over these practices.

This creates three potential detriments:

● invasions of privacy

● new intrusive and irritating forms of advertising

● inequitable monetisation of individuals’ data – companies are making money from their use of individuals’ data, often without consumers’ expressed permission, and leaving consumers’ powerless to take control of their own information

39 ICM Research omnibus survey carried out on behalf of Consumer Focus between 10 and 14 February 2012 on a sample of 2,002 people (not yet published)

Current EU law40 requires users’ consent before a cookie is placed on their computer. Before this law was implemented at the end of May 2012, the large majority of consumers (85 per cent)41 were not aware of any of the existing internet cookie ‘opt-out’ solutions. Therefore we welcome the spirit of the new provision under the revised ePrivacy Directive granting consumers the right to prior consent to installation of cookies – ie the option to opt in42.

However, last minute changes by the Information Commissioner's Office state companies can assume that, by clicking to dismiss or accept a message about cookies, website users have given their consent. This could undermine the opt-in aspect of the original law. The next few months will show if this proposal is workable or if people will just accept cookies without reading any information in order to access the service, in the way they do with terms and conditions.

New technological developments need to take into account what we know about how often consumers pay attention to opting in or out of services. Solutions should be sought that will help consumers better understand what different cookies do and systems implemented with certain defaults that will help them navigate their way through cookies.

40 Article 2 of Directive 2009/136/EC amends the ePrivacy Directive 2002/58/EC setting out the fundamental rights and freedoms of EU citizens when using electronic communications

41 Department for Culture, Media and Sport. Research into consumer understanding and management of internet cookies and the potential impact of the EU Electronic Communications Framework, 2011

42 Recital 66 of the EU ePrivacy Directive 2002/58/EC

15All that’s digital isn’t gold

Facial recognition

A recent study in the US43 found that it is possible to start from an anonymous face in the street, and end up with very sensitive information about that person. The study concluded that this was made possible by the convergence of facial recognition, social networks, data mining and cloud computing.

For example, once a photo is snapped on the street, facial-recognition software can be run to identify a person online. Some data mining could possibly uncover the city and year the subject was born. A little knowledge of how social security numbers get assigned will enable identity thieves to narrow down the range of numbers to work with.

We are seeing facial-recognition technologies being applied in a range of settings. For example, Facebook deploys facial-recognition technologies to identify the names of individuals posting pictures of themselves and their friends on the internet. Facebook introduced facial recognition by default earlier in 2011. All uploaded photos are run through this software, which users have to opt out of, rather than opt in to. Courts in Germany have threatened legal action44 over the facial-recognition software, quoting concerns over privacy and security.

43 Alessandro Acquisti, Ralph Gross, Fred Stutzman, Faces of Facebook: Privacy in the age of augmented reality, Heinz College and CyLab Carnegie Mellon University, 2011

44 http://bit.ly/MfSw4e

Consider that Facebook is already in the cloud, its privacy terms are ever-changing and, while you can opt out of automatic facial recognition, the fact is there are probably hundreds of photos already tagged to your name. This means, to some extent, that we’ve already unwittingly lost control of our digital selves.

The seamless merging of online and offline data that facial recognition and social media make possible raises the issue of what privacy will mean in a world where we merge online and offline data. This will force us to reconsider our notions of privacy as our identities become ever more vulnerable.

Unfair terms of data sharingIn May 2011, Gordon Crovitz of The Wall Street Journal45 stated ‘If you’re not paying for the product, then you’re not the customer—you’re the product being sold.’ In other words, a service makes its money by selling the data it collects about a person in the course of using the service. Just as all the internet sites that we use for ‘free’ are finding ways to make money from all of our personal data, internet users need to realise that their personal data has value.

There is an explosion of companies being set up to help organisations collect and utilise this data, such as GraphScience46, but individuals mostly have no idea just how much commercial value they are giving away ‘for free’. Alongside this, people also don’t have control over who this information is shared with or what purposes it is put to. This can become a highly profitable way of exploiting consumers’ ignorance about the value of their personal data.

45 http://on.wsj.com/KuzuTO46 http://bit.ly/Ja9nCf

16 Consumer Focus

We have seen the creation of a number of start-ups47 which allow people to take control — and perhaps profit from — the digital trails that they leave on the internet. These are potentially disruptive innovations that could upend the way organisations collect and use our personal data, putting more power into the hands of consumers. However, these are still very much in their infancy and we are not seeing widespread adoption by consumers of these services.

With increased consumer awareness of the value of their personal information — with Facebook recently valued at $104 billion48 — that may soon change. This idea also has the backing of the Government, with their experiment into this area, midata49, focusing on exactly these issues. The Government announced its plans in April 2011 as part of the Better Choices: Better Deals strategy50. midata will focus on encouraging companies to release data they hold about individuals back to them, so that they can use this data for their own purposes. This is the first major Government initiative, globally, towards a changed personal data consensus. Personal data is a personal asset, and individuals should have the right and ability to manage and use this asset to pursue their own goals.

47 Eg http://bit.ly/JtbTcT; http://bit.ly/JkIi0y; http://bit.ly/JkIrRB

48 http://bit.ly/LHVcuJ49 http://bit.ly/u7QR65 50 Ibid

Excessive data gatheringUnder UK law51, personal data should only be obtained by a company for specific purposes and should not be used for other purposes. Furthermore, the data collected should not be excessive in relation to the purpose or purposes for which they are processed. However, in the current environment some companies are tending to collect as much data as they can and to use it for as many purposes as possible, including sharing it and selling it on to an array of affiliates, furthering what is now known as the ‘big data’ agenda52.

Companies such as McKinsey53 are predicting that big data is to become a key basis of competition for companies. However, there are little or no practical ways for individuals to monitor or control what surplus data is being collected on them by companies. This situation is very one sided – the companies are holding all the power, deriving revenues from people’s data while customers are unaware of the value of this data and what is being collected on them.

Even when consumers try to stop this data being collected, they will find that it’s not possible. The recent development of ‘Do Not Track’ is some progress. This tool tells advertisers (but only those that have agreed to listen) that users do not want to have third-party companies track their online activities. However, all that it is possible to opt out of through Do Not Track is receiving targeted adverts, not data collection. There is no way, through the companies’ own self-regulatory apparatus, to stop being tracked online.

51 Data Protection Act 199852 http://bit.ly/Jkznj053 http://bit.ly/Lxug0R

17All that’s digital isn’t gold

However, preliminary results from a survey conducted in 201154 in the US found that users expected a lot more from the current set of Do Not Track tools than those tools deliver. 61 per cent of respondents expected that if they clicked a Do Not Track button, no data would be collected about them.

From a consumer perspective, effective consumer control requires some restrictions on the collection of information, not just prohibitions on specific uses of information from Do Not Track. But problems emerge because as consumers flock to many free services online, these services need to get advertising revenue in order to keep providing a free service. This means that companies want to keep collecting as much data as they can. There needs to be more discussion on what ‘free’ means in this context for consumers. It may well be that consumers are happy to have their data collected if they can continue to use a service for free but the underhand nature of the system is not currently allowing consumers to actively make this choice.

Digital identity

Consumers are placing large amounts of information online: credit card details, bank details and addresses when they buy goods or services; their personal likes and dislikes on social networking sites such as Facebook and Twitter; and even their work history on LinkedIn. Managing and protecting identity online is, therefore, becoming more complex.

54 http://bit.ly/K7u2t6

Identify theftIt is estimated that online fraud is costing UK internet users around £3.5 billion a year and that 11 per cent of the UK’s online community has been a victim of fraud in the past year55. Figures from Financial Fraud Action UK56 (the organisation which co-ordinates the financial services industry’s activity on fraud prevention) estimates that online banking fraud losses totalled £16.9 million during January to June 2011. Identity theft is becoming easier as individuals place large amounts of data online. This is not just about volume but also increasing levels of detail so it’s easy to piece together a pretty full picture of who we are from what we put out there. Date of birth, address, full name and place of birth57 will often provide an identity thief with enough information to use a consumer’s identity.

According to the Norton Cyber Crime Report for 201158, 431 million adults worldwide were victims of cyber crime in 2010. The total cost of those crimes amounts to $114 billion. The report also found 10 per cent of respondents had experienced cybercrime on a mobile device.

The changes in the way that we are all using the internet, including new mobile payment systems, require a stronger focus on these issues and a better understanding from consumers about what they can do to help avoid falling victim to this. Cybercrime laws59 do exist, but enforcing them is extremely difficult60.

55 http://bit.ly/KPKZYd56 http://bit.ly/KH2GZE57 http://bit.ly/JN3jFF58 http://bit.ly/LaOLKP59 http://bit.ly/KvhGu460 http://tek.io/LhC9Vf

18 Consumer Focus

It is important that people are aware that there are many easy ways to minimise the risk of this problem, such as using an updated web browser, keeping and monitoring records of financial transactions, installing security software and staying alert to the latest scams. Other technological developments could also be a great help. Examples such as receiving a text from your bank to alert you when your card has been used abroad could be applied to many other areas.

Pretend anonymisation Some activities, like making a cash payment, are intrinsically anonymous. Other activities use data that may be anonymised, with the name, address or other identifying information removed; or data may be pseudonmyised, with a name replaced by a code number, for example. Many activities, such as behavioural targeting of online advertising, are justified on the grounds that no personally identifiable information is traded. However, it is often possible to work backwards from a pseudonym (such as a computer’s IP address) to the name of an individual which can cast doubt on the arguement that our data is anonymous.

Data loss by corporationsCentralised customer databases are a natural target for thieves and fraudsters. There have been a number of high profile cases of companies’ databases being compromised and records stolen, or data simply mislaid through careless handling. For example, in April 2011 thieves accessed records, including credit card details, of 77 million users of Sony Playstation61; the NHS has lost millions of patient records62 through careless handling, leading to the Information Commissioner calling for tougher penalties for NHS Trusts and hospitals which lose data.

61 http://reut.rs/L0KVHr62 http://bit.ly/LumWmF

We should therefore not be surprised that nine out of 10 consumers agreed with the statement ‘I should be able to control what information organisations collect about me and what they use this information for’ with the majority agreeing strongly63.

Poor control of data historiesAs use of social media becomes the norm, people are sharing ideas, actions and photos with each other online, perhaps not realising the difficulty of removing them later in life. A study in June 201164 of 1,000 individuals found over half the respondents less than 25 years old said they regret posting something online. Over 25 per cent of those who regretted their post said it ruined their marriage or relationship or caused problems at home or work. Even high-profile individuals have fallen into this trap – including a Church of England bishop65.

There is also uncertainty surrounding whether or not a user is actually able to completely remove old accounts and the information associated with them66. Some sites make this near to impossible as they continue to ‘own the data’ even though it is not necessarily visible to other account holders. However, due to pressure from users, some sites have already made this easier67.

63 Ctrl-Shift. Tracking the control shift, 201164 http://bit.ly/JyL1lk65 http://bbc.in/L0LPUB66 http://bit.ly/JyLbJx67 http://nyti.ms/K7vFab

19All that’s digital isn’t gold

In response to these issues, a new law was proposed in January 201268 which would promise internet users the ‘right to be forgotten’. It proposes that people will be able to ask for data about them to be deleted and firms will have to comply unless there are ‘legitimate’ grounds to retain it.

The move is part of a wide-ranging overhaul of the EU Commission’s 1995 Data Protection Directive.

Abuses of online reputation management Almost anything can be reviewed, scored, compared, evaluated and commented on with the web today, such as clothes, phones, health services, teachers, and other websites. This can provide new opportunities for transparency, accountability and engagement between people, and between people and providers. Peer feedback is becoming the primary and most trusted source of information that consumers use to inform purchasing decisions69.

However, there are also some potential drawbacks, such as the lack of accuracy, honesty and legitimacy in reviews as well as the lack of redress for consumers and producers alike if things go wrong. An individual or service may earn a bad reputation and work hard to address the faults identified but there may be no mechanisms for the individual or service to say ‘we have changed’, and no mechanisms for out-of-date or inaccurate information to be withdrawn.

68 http://bbc.in/LhDMSH69 http://bit.ly/Lxw8Xl

To deal with this problem of not always being able to remove information online, reputation management in this area is now starting to become big business70. Clients include individuals or businesses who have been wrongly associated with criminal activity; and individuals or companies wanting to portray a positive public image. Online reputation management companies tweak search engine data, but admit it’s next to impossible to completely remove negative information.

Many companies have also been accused of misuse of reputation and feedback systems. For example, Belkin71 has been caught paying for positive reviews on Amazon and Wal-Mart was discovered to have paid two US bloggers to post positive comments about Wal-Mart stores as they travelled across the US72. When the press discovered this, Wal-Mart and its PR firm took the brunt of a massive backlash and were publicly humiliated. But of course many consumers probably fell for this subterfuge.

We have also seen some high-profile problems for Tripadvisor who recently fell foul of the Advertising Standards Authority rules73 with its claims to provide unbiased reviews of holidays, resorts, hotels and restaurants. Tripadvisor has also been told not to claim or imply that all the reviews that appeared on the website were from real travellers, or were honest, real or trusted because they could not ensure that this was the case. Certain companies on the website have been accused of subverting the system and providing incentives to customers for positive reviews74.

70 http://nyti.ms/JtcXO771 http://bit.ly/JC42Jh72 http://on.msnbc.com/JkARKi73 http://bit.ly/JC4hnG74 http://bit.ly/LeUZM0

20 Consumer Focus

This makes it hard for consumers to get access to accurate, trustworthy information on which to base their decisions. Sites such as Reevoo try to deal with the problem and have recently published their trusted reviews manifesto75 to try to ensure only genuine reviews are posted.

The need for ‘digital wills’When individuals die it isn’t clear who has the right to access their digital information. There may be a requirement for digital wills. Professionals in the legal, funeral, and estate planning services are starting to get to grips with the problem of what to do with information after death. Companies such as Legacy Locker and Entrustet have sprung up to handle the legal and financial issues of data after death and there have been a series of digital death days76 intended to educate the industry about the problem.

This is going to become a big issue in the future and needs more discussion and attention to help solve the many problems that emerge from this.

Information access, power and trustworthiness

Technology has brought about significant changes in the amount of information that is available online, as well as the way people search and access what they want to know and when. But is all the information online to be trusted? With constant developments in technology reinventing the ‘rules of the game’, there are new organisations which have the potential to wield an unaccountable power and influence over individuals without them knowing.

75 http://bit.ly/K7coHx76 http://bit.ly/LnMfk3

New web monopoliesAn essential part of a fully functioning digital economy is the ability of users to search the internet for what they want. Search engines such as Google, Yahoo! and Bing are the connection between millions of internet users and the huge variety of products and services available online. Unless someone knows exactly what site they are looking for, then they will generally turn to a search engine for help. Internet search might then be characterised as an essential online service, much like electricity, telephony and banking.

A very small number of companies dominate the search and search advertising market77. One search provider in particular, Google, enjoys a virtual monopoly in many countries. In February 2012, Google had 91 per cent of the mobile and tablet search engine market and 83 per cent of the desktop search engine market in the UK, with four other companies making up the rest78. This means that there is a potential for adverse market outcomes that would not be possible in a market with a large number of more effective competitors.

That Google has this large a percentage of the market is not necessarily a bad thing – people like the services that Google has to offer which is why it has done so well. But there is a possibility that the internet will follow the path that various other information industries have gone down over the past century or so. In telegraphy, telephony, radio and television, a familiar pattern has unfolded: after an initial period of innovation and vigorous competition, a small number of players often end up enjoying almost complete control of the mainstream market.

77 http://bit.ly/LxwYDv 78 http://bit.ly/LcZR4L

21All that’s digital isn’t gold

This may lead to problems for consumers because the power that they are able to exercise over the search market means that it becomes difficult for others to compete, meaning we will be limited to what they decide to present to us. It also means that search providers have the power to develop practices to suit their own commercial interests more than those of their users. These companies are publicly listed, meaning their ownership and corporate strategy can change virtually overnight. This means there are no guarantees that future owners will act in the public benefit rather than their own.

The gaming of searchOnce upon a time there was a clear distinction between paid-for search results and editorially independent results. Now, however, the search engine optimisation (SEO) industry means that, increasingly, the first page of search results direct users to commercial interests which are not necessarily the most relevant for the information they are searching for. For example, JC Penney were exposed at the start of 201179 for having gamed the Google system by paying sites to link to JC Penney to ensure their website came top for many home product searches. Google took action against the company and they sank far down the search result list80. With only 15 per cent of consumers indicating that in their most recent web search they went past the first page of search results81, we can understand the importance to businesses in getting their company to appear at the top of the list.

79 http://nyti.ms/KPMXYw80 Ibid81 http://bit.ly/JkNyRR

It also means it is becoming increasingly hard for consumers to get neutral search results and there is little understanding by consumers of the ways that companies attempt to game these searches. Among people who said they had a very good understanding of how search engines work:

● 34 per cent did not know that search rankings will change depending on which search engine is used

● 42 per cent believed that relevance was more important than paid advertising in determining what appears at the top of search results

● 27 per cent were unaware that search engines display paid advertising at the top of search results82

The technical nature of any web search operation means that certain arbitrary rules need to be built into a search algorithm, and website operators must play by those rules if they wish to be ranked prominently. Web pages that do not make it to the first page can find it difficult to compete. But if Google did not have a virtual monopoly on the search engine market and users did not rely so heavily on any one algorithm to find content on the web, then the idiosyncrasies of one algorithm would be corrected by another, and web pages which struggle for rankings with one provider might generate traffic via another. It has been argued that if there were greater diversity in web search, then there would be greater diversity in online commerce83, which would be a good thing for consumers and the functioning of the market.

82 The Australia Institute, What you don’t know can hurt you: How market concentration threatens internet diversity, 2011

83 Ibid

22 Consumer Focus

Searching versus biasingIn December 2009 Google started tweaking the search results it shows individuals according to the data it holds on them – for example, what they have searched for before. This means that, over time, no two individuals putting in the same search query will see the same results. What search results show is not ‘what’s available out there’ but ‘who Google thinks you are’. What’s more, people are unaware of this bias because it’s invisible, meaning search is becoming a mirror to the world, rather than a window.

This could, potentially, highly constrain people’s practical ability to access the information they want and need. Also, if people only see information that reinforces their existing beliefs or prejudices, they are not exposing themselves to a wider body of knowledge, alternative opinions or facts. This is what Eli Pariser has dubbed as the ‘filter bubble’. With Google personalized for everyone, the query ‘stem cells’ might produce diametrically opposed results for scientists who support stem cell research and activists who oppose it. ‘Proof of climate change’ might turn up different results for an environmentalist and an oil company executive. In polls, a huge majority of us assume search engines are unbiased. But that may be just because they’re increasingly biased to share our own views. More and more, your computer monitor is a kind of one-way mirror, reflecting your own interests while algorithmic observers watch what you click84.

84 Eli Pariser, The filter bubble: What the internet is hiding from you, 2011

The algorithms Google uses to serve up search results are a closely guarded secret. This secrecy is designed to stop the gaming of search. However, in doing so, it arguably concentrates more power in the hands of the algorithm developers than any former media magnates’ ability to control the news: the algorithm decides what you see, but you cannot see what’s inside the algorithm.

Over-reliance on peer-to-peer information One of the strengths of the internet is that it can be highly democratic. Consumers can have their say and input their views. This can be extremely valuable – a lone customer’s complaint can gain attention and force a large corporation to change its policies, for example. However, one potential downside is it can become difficult to distinguish between good-quality and poor-quality information. This is very important because, as mentioned earlier, peer-to-peer feedback is becoming the primary and most trusted source of information that consumers use to inform purchasing decisions85.

There are some situations where the ‘wisdom of the crowd’ works well and can be better than an expert opinion86. These instances are typically when the average of many people’s opinions is more likely to be right than an opinion derived through in-depth analysis from one expert.

85 http://bit.ly/Lxw8Xl 86 James Surowiecki, The wisdom of crowds: Why the many

are smarter than the few and how collective wisdom shapes business, economies, societies and nations, 2004

23All that’s digital isn’t gold

For example, major media outlets can’t cover every single crisis in the world. In 2008, Ushahidi87 stepped in to fill the coverage gap. Originally designed to map post-election violence reports in Kenya, the Ushahidi platform is now expanding to map worldwide citizen input via email, web, and mobile phone applications. It covers all sorts of issues from disaster relief in Haiti after the earthquake in 201088 to 3G network quality and Wi-Fi hotspots in India89.

However, there are times when the wisdom of the crowd may not make good decisions. This happens when most of the people in a group are biased in the same direction so they exclude diverse opinions. Stock market bubbles are a classic example of a group making bad decisions. Instead of assessing how much a company is really worth, investors start following the herd and worrying about how much other people will think the company is worth. As James Surowiecki points out, the paradox of the wisdom of crowds is that the best group decisions come from lots of independent individual decisions90.

There are times when expert opinion will be better than the ‘wisdom of the crowd’. Relying on experts makes sense when niche specific knowledge is needed such as performing surgery or auditing accounts91. But online, there is often not an easy way of drawing the line between these two types of knowledge – when people should use crowdsourced knowledge and when they should rely on experts and which category the information they are accessing falls into.

87 http://bit.ly/Ki4fOa88 http://wapo.st/KfXEC089 http://bit.ly/KcrU7v90 http://bit.ly/KiQVeb 91 http://bit.ly/JNavSm

The reason this is important is for the quality of information that people access. For some situations it is important that traditional quality control methods such as peer reviews in academic journals can safeguard against the distribution of poor-quality information. It is very easy for misinformation and rumours to proliferate and be seen as truth. Many search engines and websites produce results based on popularity rather than reliability. Since contributors can often be anonymous, it’s easily possible for propaganda or just misinformation (whether wilful or a product of ignorance) to be passed off as news or factual information.

This is particularly problematic in the medical arena, for example. Although there are many benefits to consumers having access to all kinds of medical information to help them learn more about their condition and exchange views and support with others in the same situation, it can also mean that patients can encounter conflicting advice and options, some of which are ill-informed and could be dangerous92.

However, a remedy to this could be something like the Google Scholar service which helps people to seek out expertise (ie type in the name of a medical condition to find the top-cited articles, then contact the senior author).

92 Pamela Hartzband, MD, and Jerome Groopman, MD Untangling the web — Patients, doctors, and the internet, N Engl J Med 2010; 362:1063–1066: http://abcn.ws/KPQS7C

24 Consumer Focus

Regulations, rights and e-commerce

Online shopping can benefit consumers with increased competition and lower prices; more product choice and services; and the ability to shop at any time from vendors located anywhere in the EU or around the world. However the immediacy of transactions and the remoteness and anonymity of buyer and seller can pose challenges to consumer protection and regulation.

Understanding and enforcing rights and responsibilities in the digital world is becoming more complex. Consumers may unintentionally infringe laws, contracts and make spending commitments. Technology is advancing so fast that regulators may not be able to understand what rules are required to effectively regulate, how to enforce those rules, what the implications for consumers are or even just that normal regulatory cycles are being outpaced by technological change.

Technology advances may also help organisations find loopholes in regulation and exploit these to the detriment of consumers. This can be a hindrance in allowing the internet to reach its full potential for innovation and new business models. Consumers must have trust in the law to protect them if they need it.

Pricing pot luckAirlines have been doing it for years93. But it is now rumoured that the practice of dynamic pricing is spreading to increasing numbers of online retailers94. They are able to change prices by the minute, according to information they have about individual customers and their behaviours. In 2000, Amazon charged different customers different prices95 for the same DVD, based on the customers’ address and purchasing history; in effect looking at consumers’ ‘willingness to pay’. Initially a PR disaster for Amazon, dynamic pricing is now said to be becoming more commonplace96.

Although such practices can bring some benefits to consumers when they are used in a clear and accurate manner to provide special offers, there are also many potential downsides that could arise. These cover issues such as reducing consumers’ ability to search for and compare deals which could potentially result in a more expensive or less suitable purchase. This could increase time spent searching which can actually be dispempowering for consumers.

For people who don’t have the time to shop around, these additional complexities are creating an unwelcome trade-off: they either have to invest more time researching best deals or accept that often they may end up paying over the odds. It is unclear how much companies are using this practice – it is very hard to discover what is going on behind the scenes of an online retailer. But this is an issue that has the potential to grow and grow with the development of more sophisticated technology.

93 Part II, point 7, http://bit.ly/JNaMVn94 http://tnw.co/K7gfo395 http://bit.ly/KaNiq096 http://tnw.co/K7gfo3

25All that’s digital isn’t gold

Poor or non-existent customer serviceProviding good customer service is expensive, which is why some companies make it as hard as possible for customers to actually contact them. We are seeing a shift from companies providing phone numbers to an increasing number of companies creating a social media presence such as through Twitter, Facebook and YouTube.

A poll showed that in April 2012, 36 per cent of people had used a social media platform to contact a big company97. But research has found98 that online retailers failed to respond to the vast majority of questions, comments and criticisms we posed to them on social networks. Only 25 per cent of those with a Twitter account responded to a question directed at them (through an @reply). The retailers were also poor at responding to negative comments, with only 20 per cent responding to a negative comment directed at them on Twitter and only 11 per cent on Facebook.

Customers are left to sort out the problem themselves (whereby the company transfers the cost of customer service to the customer); or not have the problem solved. A YouGov survey99 in 2010 found more than a third (35 per cent) of UK web shoppers would spend more money online if better customer care or advice was offered. In addition, 82 per cent of customers had stopped doing business with an organisation due to poor customer service100.

97 http://bbc.in/Mjsfzj98 http://bit.ly/MghFvv (PDF 3MB)99 http://tek.io/LhPexL100 http://tcrn.ch/JaiYJl

However, there are big opportunities for consumers if companies do not provide appropriate customer service. Examples such as the website Vodafail101 show how the internet has brought us to an age of radical transparency, meaning companies are no longer allowed to ignore or cover up poor performance. Dissatisfied and/or concerned consumers and campaigning organisations now have the tools to generate and distribute content in ways that ensure the world knows about a brand’s shortcomings. Bad news about a company can now spread much, much faster than the company’s public relations department can hit overdrive.

This has also lead to a growth in consumers turning to each other for product and service advice instead of relying on companies, such as the MoneySavingExpert.com forum102. There are also big opportunities here for companies to facilitate better customer service through online tools, for example Get Satisfaction. This is a tool to help connect customers and companies and enable conversations between them on topics such as reporting a problem, asking a question and sharing an idea.

101 http://bit.ly/KPW6QT 102 http://bit.ly/JyWlxR

26 Consumer Focus

Interoperability and data portabilityInteroperability is defined as ‘the ability of two or more systems or components to exchange information and to use the information that has been exchanged’103. We are seeing consumers being increasingly ‘locked-in’ to online services making it difficult or impossible to transfer personal data such as contacts and photos from one services to another104. This can happen ‘by accident’ (because of the technical standards adopted by different suppliers) or deliberately. For example, Apple has adopted a ‘walled garden’ approach to decide what applications, content and devices can be used on its platforms. The same effect can be achieved if a service relies on data provided by the customer and the customer finds they cannot transfer this data from one service provider to another.

The potential restrictions of poor interoperability and lack of data portability are enhanced by the widespread adoption of cloud computing. The European Commission is proposing to introduce a new right to data portability. This will enable people to request that their data be held by a data controller in a format that allows them to transfer that data to another provider. This will be good progress for consumers – the right to data portability will enable people to recover and/or to shift their own data from one platform or cloud to another. However, for this right to be effective, interoperability between services and promotion of open standards is required and more thought needs to be given to where the limits to personal data are. At present, it could be difficult to define what data is included and what’s excluded.

103 IEEE standard glossary of software engineering terminology. 610.12,1990 http://bit.ly/KHqYTg (PDF 6MB)

104 Consumer Focus response to Ministry of Justice call for evidence on EU Data Protection proposals, March 2012

Exploiting crowdsourcingMany companies canvass their customers for opinions and suggestions relating to current and future products and services for example Starbucks105, Sony106, Dell107 and GlaxoSmithKline108. The sheer number of consumers that can be consulted is vastly increased compared to traditional market research methods. Indeed suggestions or developments can come not only from existing customers but from potential customers that previously the firm had no way of contacting. This feedback can be very valuable; Tapscott and Williams have argued that ‘co-creating with customers is like tapping the most uniquely qualified pool of intellectual capital ever assembled, a reservoir of talent that is keenly and uniquely enthusiastic about creating a great product or service as you are.’109

However, this does involve risks for the company. With this level of transparency and involvement from a large number of different groups and individuals, companies have less control over information and the perception of their firm and its products. But on the positive side for companies, some of these ideas may be commercially valuable, even patentable.

105 http://sbux.co/I4jeYP 106 http://bit.ly/K7NIwT107 http://bit.ly/JNiH59108 http://bit.ly/KaWXgh109 Tapscott, D and Williams, AD, Wikinomics, London:

Atlantic, 2008, p147

27All that’s digital isn’t gold

At a certain point, this sort of crowdsourcing can become a highly profitable way of appropriating the value of other people’s ideas for free. For example, two years after Starbucks implemented their new digital media engagement plan, the policy appears to have paid off with sales up by 4 per cent and net quarterly profits in the three months to December 2009 up to $241 million (representing a 375 per cent increase over the same period a year earlier). While the company did also implement extensive cost-cutting measures, which will have helped the profits, its digital marketers will no doubt be very pleased with the increased sales110.

Terms and conditionsCurrently, the terms under which individuals’ data is captured and shared is set by terms and conditions which consumers have to ‘agree’ to (by ticking a box in an online process) if they want to access the product or service in question. These days, we often ignore notices that appear on our computers and phones every time we install, update, or sign up for something, whether it’s an End User License Agreement, a list of Terms of Service, or just a standard Agreement. Recent Consumer Focus research111 found that less than a third of consumers claim to always read the terms and conditions before clicking the ‘I agree’ box. In the 18 – 24 age group, only 15 per cent of respondents agreed with this statement. This is not surprising because terms and conditions often overlong and written in legalese that people can’t understand.

110 Godson, M, Relationship marketing, OUP Oxford, 2009111 ICM Research omnibus survey carried out on behalf of

Consumer Focus between 10 and 14 February 2012 on a sample of 2,002 people (not yet published)

These terms are also mostly heavily weighted against the interests of consumers, with their only choice being to stop using the service. For example, 7digital.com states:

‘1.3 Right to Amend Terms. 7 reserves the right, in its sole discretion, to change, modify, add, or delete portions of these terms and conditions at any time without further notice. If we do this, we will post the changes to these terms and conditions on this page and will indicate the effective date at the top. If you do not agree to (or cannot comply with) the terms and conditions as amended, your only remedy is to stop using the Services. You are responsible for regularly reviewing these terms and conditions so that you will be apprised of any changes. Your continued use of the Services after any such changes constitutes your acceptance of the new terms and conditions’112

We are also seeing many examples in cloud computing and social network contracts that give the provider the right to use anything a consumer does or stores on its remote servers. By ‘accepting’ the incomprehensible and unintelligible terms on these sites, consumers unknowingly give up rights to ownership of personal information and content, including its resale to third parties113.

112 http://bit.ly/JtleS3113 TACD, Resolution on defending consumer rights and fair

business practices in the digital environment, 2010

28 Consumer Focus

Incomprehensible small print

Unintentional and contractual legal breaches can arise simply because people find reading and understanding terms and conditions, which can sometimes be excessively complex, difficult. In recent Consumer Focus research114, of those people who said they always read terms and conditions before agreeing, only 20 per cent could fully understand their implications. Further to this, Consumer Focus research on digital downloads shows that although the majority of retailers (92 per cent) allowed mystery shoppers to view terms and conditions and where applicable licensing agreements on websites, only 30 per cent of mystery shoppers were able to print the licensing agreements. Only 26 per cent could save them to their computer meaning consumers would be expected to wade through these terms and conditions instantly115.

Research shows116 that if you actually bothered to read all the privacy policies you encounter on a daily basis, it would take you 250 working hours per year, or about 30 workdays. We can see the importance of simplifying these for consumers and making them available to print and download if they are to have any hope of understanding them.

The low quality of information may mislead consumers into buying inappropriate products that may not be compatible with their software or equipment, or even cause damage to the latter, and therefore may expose them to unnecessary financial risks.

114 ICM Research omnibus survey carried out on behalf of Consumer Focus between 10 and 14 February 2012 on a sample of 2,002 people (not yet published)

115 Consumer Focus, Ups and downloads, 2010, http://bit.ly/L1eskj

116 http://bit.ly/Kj3wxU (PDF 489KB)

29All that’s digital isn’t gold

Aviary.com

Aviary’s terms of service for its free product are spelled out in two columns: one covering the ‘full legal agreement’ and, next to it, a summary in ‘layman’s terms’. In the full legal agreement, a section, ‘grant of license’, reads like this:

Subject to your (“Licensee”) full compliance with all of Terms of this agreement (“Agreement”), Aviary, Inc. (“Aviary”) grants Licensee a non-exclusive, revocable, nonsublicensable, nontransferable license to download and use the API solely to embed a launchable Aviary application within Licensee’s mobile or website application (“App”) and to access data from Aviary in connection with such application. Licensee may not install or use the API for any other purpose without Aviary’s prior written consent.

Licensee shall not use the API in connection with or to promote any products, services, or materials that constitute, promote or are used primarily for the purpose of dealing in: spyware, adware, or other malicious programs or code, counterfeit goods, items subject to U.S. embargo, unsolicited mass distribution of email (“spam”), multi-level marketing proposals, hate materials, hacking/surveillance/interception/descrambling equipment, libelous, defamatory, obscene, pornographic, abusive or otherwise offensive content, prostitution, body parts and bodily fluids, stolen products and items used for theft, fireworks, explosives, and hazardous materials, government IDs, police items, gambling, professional services regulated by state licensing regimes, non-transferable items such as airline tickets or event tickets, weapons and accessories.

In the layman’s terms, that section is paraphrased like this:

Use Aviary the way it’s intended (as a photo-enhancement service), or get our permission first.

If your service does anything illegal or potentially offensive, we don’t want Aviary to be in your app. Nothing personal – it just reflects badly on our brand or creates awkward legal situations for us we’d rather avoid.

This is a good example of a company making their terms and conditions easy for users to understand. We would like to see more of this from other companies.

30 Consumer Focus

Over-complex service agreements

Use of Service agreements are often very hard to understand. Individuals only discover what they have ‘agreed’ to after buying the product, and must accept to use it (eg the iPhone agreement117 which prevents developers from using non-approved code). There have also been examples where it is unclear that consumers fully own the product they’ve brought. Sony has taken legal action over Playstation owners118 who have tried to modify their playstations, raising the issue of what rights consumers have over products they have paid money for.

This problem also emerges when consumers buy copyrighted digital content. An End User Licence Agreement (EULA) introduces a third party to a contract that is concluded between the consumer and the supplier of a digital product. It raises questions over which party will bear the costs of liability for products not fit for purpose: the right holder or the seller?

This highly complex and uncertain legal framework creates unbalanced rights and responsibilities between the consumer, supplier and right holder. It leaves consumers vulnerable to potential loss in cases where digital products are not fit for purpose, defective, non-conforming to the advertised product description, or might cause damage or loss to users’ software.

117 http://bit.ly/KuS3ra118 http://zd.net/Kj3UMO

Small print contract commitments

There are instances when organisations link ‘free’ offers aimed at consumers to a commitment to purchase in the future. Consumers may opt-out online to such an agreement, but sometimes there are no obvious reminders and unintended purchases are undoubtedly made.

This type of practice is known as negative option marketing. It has been happening for years, such as with ‘book-of-the-month’ clubs119. However, this has become more prevalent with growth of the internet and online shopping. Companies are taking advantage of consumers in this way by hiding this information or writing it in very confusing language. Today’s tick box approach to ‘informed consent’ is actually disempowering, giving consumers very little choice and reducing their protection, if only because most of us do not read or understand the small print.

EU legislation (the Unfair Contract Terms Directive) protects consumers against terms and conditions that are considered unfair, and that favour business in contracts that have not been individually negotiated. However these laws are not effectively enforced by regulators and consumers rarely complain because they do not read the contracts and are not aware of the legislation.

119 The offer was five or 10 books for free or at a heavily discounted price. By accepting the offer, the consumer agreed to join the club and receive regular shipments of other books or records at the full price, unless the consumer took the ‘negative option’, telling the company it did not want to receive that month’s offering

31All that’s digital isn’t gold

Out-of-date consumer lawWhile consumer demand for digital goods and services is growing, the law has not kept up with technological advances. For example, the protection of consumers who purchase digital products online remains one of great legal uncertainty. If a digital product is delivered in a physical format (CD and DVD) it falls into the category of ‘goods’. The core principles of consumer law for goods then apply120, for example the right to redress for non-conformity to the advertised product description.

However if the product is delivered by electronic means (downloading) it falls outside the statutory consumer protection requirements for goods. In practise this means that consumers buying the same computer software, music or movie will acquire different rights depending on the type of delivery – physical or electronic. This situation not only harms consumers, but may also hamper innovation and growth of the digital online market.

Consumer Focus work has identified the many ways in which online shopping fails to give consumers the protection they enjoy elsewhere121. We found that while technology is in place to facilitate development of the digital market, business practices and the legal framework are lagging behind and do not provide incentives to increase consumers’ confidence in this new market.

120 Sale of Goods Act 1979 http://bit.ly/LnXIji 121 http://bit.ly/L1eskj

Examples of consumer law not keeping pace with new digital developments can also be seen with new payment systems. We are seeing a huge growth in mobile and contactless payment systems. Since 2009 there has been a 90 per cent increase122 in the number of contactless cards distributed across the UK. During 2010, over 1.7 million contactless transactions were processed. PayPal is projecting that it will process $7 billion in mobile payments in 2012, almost double the $4 billion mark recorded in 2011123. However, it is unclear whether the existing consumer protection regulations such as the Consumer Credit Act apply to contactless and mobile payments.

The Department for Business, Innovation and Skills (BIS) announced in September 2011 a new Consumer Bill of Rights which aims to streamline confusing and overlapping legislation and regulation, and to provide stronger consumer protection. It will update the law for goods and services and, for the first time, cover digital content. The Bill provides an excellent opportunity to tackle some of the issues raised in this paper which cause consumer detriment. Consumer organisations will push for the clarification and improvement of consumer rights in the digital market place.

122 http://bit.ly/LaOjfw123 http://bit.ly/K7RzKy

32 Consumer Focus

CopyrightCopyright law has gained acute relevance to consumers in the digital age. Copyright requires the permission of the copyright owner for any copying of a protected work, unless the copying falls under one of the copyright exceptions defined in law.

In the UK consumers only benefit from a so called time-shifting exception, which allows them to record TV and radio broadcast to watch or listen to at a later date. Any other private copying is copyright infringement. In reality consumers now infringe copyright on a daily basis when they copy the MP3s and e-books they have purchased for their own use. For example by ‘format-shifting’ digital files into different formats so that they can enjoy the content on different digital devices, or when they back-up their growing digital music, film and e-book collections.

The UK Government is currently seeking to update copyright law with a limited private use exception following the Hargreaves review of intellectual property and growth.

Such a provision in law would allow consumers to know what they can and cannot do with the digital music, films and e-books they have paid for. It would stem unreasonable attempts by copyright owners to control how consumers use digital music, films and e-books post purchase.

In the absence of interoperability standards, private copying is necessary to allow consumers to consume what they have paid for on different devices. Format-shifting is not only copying a CD onto a computer, but also conversions between different file formats, for example a PDF e-book into Amazon Kindle format.

If consumers were unable to format-shift the switching cost associated with changing music or e-book platforms or devices would be so prohibitively high that it would have a negative impact on competition. For example, consumers who have purchased a large number of iTunes or Kindle e-books would have to re-purchase all their content if they wanted to stop using iTunes or Kindle in the absence of a private copying exception.

33All that’s digital isn’t gold

Conclusion

Widespread access to the internet, and the tools and applications that have been built on it, has been undoubtedly positive. It has brought us increased access to information, transparency, convenience and new means of communication to millions of people. It also provides a platform for innovation, making new opportunities and services such as music downloads feasible. It furthers economic growth, helping make economic activity more efficient, faster and cheaper.

From the consumer perspective, these new ways and channels for interacting and transacting have brought convenience, choice, better value (in some instances), opportunities to collaborate and greater engagement with providers and producers, among other things.

As this project shows, however, it also brings with it real and potential downsides that need addressing.

In some respects, parallels can be drawn with the early years of the industrial age – both represent a paradigm shift. That too brought immense benefits to consumers in the form of a much wider variety of increasingly good quality products at comparatively low prices. But it also brought its downsides – exploitation of the labour force including children; pollution; and sharp practices.

Some of these, such as pollution, were effectively new problems. It took decades for society to understand and begin to address them. Others, such as sharp practice in the market place, were not new but greatly exacerbated by new contexts and situations.

For example, it’s easy to forget that many of the shopping rights and protections that we take for granted today (labelling of ingredients, weights and measures we can trust, product promises that are true) took decades to create and embed. These were the result of deliberate, sustained effort in the face of widespread adulteration of products, tampering with weights and measures, misleading and false claims (products that did not do what they claimed on the tin) and so on.

Our review of modern digital downsides illustrates a similarly wide range of issues. Some issues, such as the role and exploitation of personal data in modern commerce, are still new.

We are only starting to understand and appreciate their implications; they involve conflicting interests, values and agendas as well as many two sided issues which present benefits but also costs from the risks involved. The binary line between whether something is good or bad is perhaps not as obvious as it has been in pre-digital economy. These issues can only be resolved by society wide debate.

We need those charged with protecting and furthering consumers’ interests to be the effective instigators, leaders and orchestrators of such debate. Others, such as sharp practice in e-commerce including fraud and mis-selling, are simply old tricks reinvented for new times, and perhaps magnified by digital technologies. In retrospect, we may look back and see them as temporary ‘teething troubles’ and excesses. But right now, they still need to be understood and addressed before they become a source of real detriment.

34 Consumer Focus

We are also acutely aware that detriments in isolation may work differently to detriments in combination. Combining new ‘digitally-dependent’ lifestyles and new means of access to information, which seem far more robust and honest than they are, with new means of abusing personal data, can create significant opportunities for exploitation. More work needs to be done to see how the detriment ‘components’ so far identified may come together to create new social and consumer problems.

We hope that this report will help prompt the start of many discussions on how these issues can be tackled and how consumers’ interests can be protected in our new digital age.

Reviewing these downsides, it becomes clear there is not one, single, way of addressing or mitigating their effects. The rapid pace of change that we are seeing moves faster than traditional regulatory approaches are typically able to, meaning they might not always be suitable for the problems that are emerging. This fast pace and unpredictable nature of change also makes it difficult to anticipate problems and plan responses. In addition, the double edged nature of some of the issues – products and services that have both benefits and detriments for consumers – means that a classic regulatory response of preventing a certain practice may look like a bit of a blunt instrument. With all this in mind, we need to develop other ways of mitigating these problems. This report highlights five different approaches, mostly needed in some form of combination. Alongside this, an awareness that each of the issues and categories do not stand alone – they link and overlap with each other as well as crossing traditional regulatory boundaries – needs to be kept in mind.

Consumer empowerment and education

Traditional approaches to consumer empowerment have fallen within two broad categories: the ‘informed consumer’ and the ‘protected consumer’. The informed consumer, it was hoped, would be better equipped to assess the choices available to them. This would enable them to act on information in ways that best reflected their distinct needs, imposing competitive disciplines on markets as a result. In addition, informed consumers are aware of their rights and can assert these when things go wrong. The ‘protected consumer’ approach resulted from regulators and legislators looking to either pre-empt detriment in competitive markets, or prohibit the downsides of monopoly provision. Advocacy bodies have looked to highlight detriment where it does arise, often leading to calls for regulation or legislation to counter persistent problems. This has resulted in regulators and legislators defining the rights of consumers and setting the minimum standards that a consumer can expect (and that the ‘informed’ consumer can act on).

As we advance into the 21st century new, more powerful forms of empowerment are becoming possible, some of which have already had a far-reaching impact in a short space of time. As discussed in this report, we are moving into the ‘age of the customer’, where a company’s success depends on its ‘engaging with empowered consumers’124. The statement last summer from Unilever CEO, Paul Polman, that consumers are able to ‘bring us down in nanoseconds’125, gives some indication of the potential power shift.

124 http://bit.ly/lwFXeQ 125 http://on.ft.com/svBw08

35All that’s digital isn’t gold

However, it is important to note that this doesn’t apply in all situations. With a company such as Unilever, if it is doing something ‘bad’ in the production of one of its products or in its marketing, for example, it is hard for this practice to stay hidden for long in an age of radical transparency. Consumers have important new control mechanisms on their side and at their fingertips. But where a downside or bad practice is less apparent or tangible, such as with some of the things highlighted in this report, consumers are less able to have this kind of impact because issues may be more complex, hidden and global.

Effective empowerment of consumers needs to be part of addressing the digital downsides mentioned in this report before they become more widespread, helping to challenge the established order. This new approach can help rebalance the system and help consumers participate fully in the new digital environment.

Education also plays a role in improving consumer empowerment. For example, giving consumers a better understanding of what cookies are and how these affect their internet use could help them, along with other policy interventions, to make better decisions about issues such as privacy. But consumer education needs to happen in many different ways and come from different sources. We inhabit a world that is information rich, but where we as consumers are time poor.

A study in 2008 found that American households are bombarded by 34 gigabytes of information per person per day126. The European Commission127 last year reported that we spend on average only 3.2 hours a week on all consumer tasks – less than half an hour per day.

Against this backdrop, greater consumer education and empowerment will not be achieved through measures that just provide people with too much information and no easy way to deal with it. Rather, education and empowerment has to be achieved through enabling consumers to use those 3.2 hours most effectively, and in ways that cut through, rather than add to, the background noise. As the European Commission rightly noted, in order to ensure consumer empowerment ‘in the face of the growing information overload and increasing lack of time for shopping, new shortcuts and comparison tools need to be found128.

We are seeing some companies emerging that aim to help people do this, such as The Customer’s Voice129. This will reverse the conventional digital marketing and e-commerce model whereby a potentially out-of-date or inaccurate record of an individual’s data is held on many different suppliers’ customer management systems and is then used by these suppliers to try to target offers (often unwanted and inappropriate) to that individual.

126 Research by the University of California in San Diego in 2008, cited in The New York Times, 9 December 2009, http://nyti.ms/JOBvyO

127 Consumer Empowerment in the EU, European Commission, April 2011

128 Ibid129 http://bit.ly/MgKGXQ

36 Consumer Focus

Instead, the site will allow anyone to securely create, maintain and pro-actively use their own set of ‘personal buying information’ – and also grant selective access to this to trusted suppliers to ensure more personalised, better matched and better value deals and offers. This type of service also allows the consumer to express their intention to the market and the market can respond on their terms (or at least those the service sets on their behalf), rather than the consumer being forced to dance between and respond to the attempts of different providers to sell to them. There are other similar services, such as Mydex130 and Personal131, that will work on a similar basis and promise to put the consumer in control of their data and how it is used.

Other technological developments such as Ghostery132 detect invisible trackers that are included on web pages to help companies get an idea of users’ online behaviour. Ghostery tracks these trackers and provides a roll-call of the ad networks, behavioural data providers, web publishers, and other companies that track users’ activity. This can help people take control of their privacy on the web and give them a window into the invisible parts of the web. It helps to educate consumers about how they might take more control over how their data is collected and how to navigate their way through these complexities.

130 http://bit.ly/JkMxws131 http://bit.ly/JtbTcT132 http://bit.ly/JOsXYV

Research and understanding

There are a number of areas where experts genuinely differ and where even the experts don’t fully understand what is happening or what the implications and possibilities are. We are seeing a great deal of hype and confusion around behavioural advertising – it is being promoted as the next big thing in business but from a consumer protection perspective, it is very hard to see where this is happening and whether consumers are suffering detriment from it. In these cases, more research is needed by a range of stakeholders.

Creating ‘real’ choice

Even if consumers are aware of a potential detriment, there is often little or nothing they can do about it. For example, they might not like what’s said in a company’s privacy policy or terms and conditions, but they have no effective means of negotiating with the organisation concerned. These kinds of policies and information are likely, intentionally or otherwise, to mislead and confuse consumers and, in doing so, erode trust in business and disempower consumers. There is a lot of ‘noise’ in this area at the moment, for example with Google trumpeting its new privacy policy on its site. At one level this is good news: companies like Google are recognising they need to be more transparent with consumers. However, there is a risk that companies are only engaging with part of the agenda. They are communicating with consumers but weighting agreements against consumers’ interests.

37All that’s digital isn’t gold

Indeed, Google has been asked to answer questions relating to the implementation of its new privacy policy by a watchdog investigating its compliance with EU data protection laws on behalf of all EU data protection authorities133.

Consumers only have one choice with these kinds of agreements: to take it or leave it. As long as this gap between choice ‘in theory’ and choice ‘in practice’ remains, consumers will continue to suffer the detriment. There needs to be a rebalancing of the power in these transactions so we are seeing a ‘race to the top’ (where genuine ‘first movers’ prosper and gain consumer recognition and, with it, market edge), rather than a ‘race to the average’.

Technology

There are some areas where technology could be better deployed to protect and advance consumer interests – eg in privacy-enabling services. For example, Firefox has recently developed a new add-on called Collusion. For those concerned about advertisers tracking them across the web, the add-on can help people see which companies are following them online by creating a graph of all the tracking cookies being deposited on their browsers as they move around the web. Technology solutions such as Collusion and Ghostery are also important in helping to educate consumers about the risks they are exposed to on the web that they may not be aware of. Trusted intermediaries such as The Customer’s Voice, as highlighted above, help to provide assurance to consumers.

133 http://bit.ly/KIiwHg

38 Consumer Focus

Regulation and enforcement

Some of the issues raised in this report, such as data gathering and a lack of a standard price are highly complex, involving many different potential consumer benefits and risks. Any regulatory intervention in these complexities could generate multiple unintended consequences. But many of the existing legislative frameworks are out of date and need to be reviewed. We are seeing developments already taking place in this area, such as the BIS proposed Consumer Bill of Rights134, which aims to streamline confusing and overlapping legislation and regulation, and provide stronger consumer protection. Another example is the EU Commission proposal to reform the EU legal framework on the protection of personal data which aims to strengthen individual rights and tackle the challenges of globalisation and new technologies.

However, it is important that any legislation is backed up by appropriate enforcement or these regulations won’t work in the interests of consumers. For example, EU legislation on Unfair Contract Terms protects consumers against terms and conditions that are considered unfair, and that favour business in contracts that have not been individually negotiated. However these laws are not effectively enforced by regulators and consumers rarely complain because they do not read the contracts and are not aware of the legislation. Again, there could be a technological solution here with the creation of intermediary services that can set the terms on which a provider does business with the customer, helping to shift the balance of power more in favour of consumers.

134 http://bit.ly/pYcxkf

Wherever regulation struggles to keep up with the pace of change, another option is to encourage more self-regulation of companies. Companies should be writing short and easy to understand terms and conditions that their customers find helpful. Some companies do this already, such as Aviary. More companies need to recognise the importance of an effectively functioning digital world and improve the way they treat customers right now without waiting for regulation to force them to do it.

When regulators are tackling an issue that crosses over the traditional regulatory boundaries, they will need to develop new ways of working if they are to deal with these issues effectively; expanding their traditional toolkit to see how protection aims might be delivered through new means. This could be through the establishment of inter-regulatory teams working on overlapping issues which emerge. The use of new technologies, such as crowdsourcing, to better connect and collaborate with consumers to understand what’s going on and identifying issues as they emerge, could become a new way of protecting consumers’ interests.

t: 020 7799 7900f: 020 7799 7901e: contact@consumerfocus.org.ukwww.consumerfocus.org.uk

Media team: 020 7799 8004/8006

Consumer Focus Fleetbank House Salisbury Square London EC4Y 8JX

Published: June 2012

If you have any questions or would like further information about our research, please contact Lucy Hopkins, by telephone on 020 7799 7978 or via email lucy.hopkins@consumerfocus.org.uk.

For regular updates from Consumer Focus, sign up to our monthly e-newsletter by emailing enews@consumerfocus.org.uk or follow us on Twitter http://twitter.com/consumerfocus.

If you require this publication in Braille, large print or on audio CD please contact us.

Deaf, hard of hearing or speech-impaired consumers can contact Consumer Focus via Text Relay:

From a textphone, call 18001 020 7799 7900

From a telephone, call 18002 020 7799 7900