Concepts of Privacy at the Intersection of Technology and Law

Informational privacy consists of the ability to control how others use our personal information. Over the past several decades, advances in information processing technology and the Web have deprived us of the control we once had, and the development of adequate informational privacy protections has become a critical issue ever since. Moreover, in the last decades there has been an explosion of new business models that rely on specific and frequently updated, consumer data including online advertisement and location based services. Companies are able to gather significant amount of consumers' online data which may not include name, address, social security numbers or what we may identify traditionally as PII; thus, the collected data may appear to be in an “anonymous" form. However, companies use unique identifiers to aggregate consumers' web activities through the use of persistent data such as cookies or even more sophisticated techniques as browser fingerprinting which enable companies to track a consumer over time and to build a rich digital profile with interests and activities. Companies use all the information for strategic business planning and provide consumers with better products and services but evidently it puts consumers’ privacy at a higher risk. Privacy protection has been undertaken by data protection laws enforced by governments, self-regulation for fair information practices promoted by businesses and privacy enhancing technologies. We pose two questions: (1) what concepts of privacy and privacy protection have been developed in response to changing technology? (2) Are these responses adequate? To answer these questions we analyze the concepts of online privacy from a legal and a technological perspective. The first part of the study provides a detailed survey and analysis of current US state privacy and security laws, which illustrate the limits of current practical legal concepts of privacy. Our analysis reveals that when evaluated against the background of relevant technological developments, the answer to (2) is that the response has clearly been inadequate. In the second part of the study we analyze privacy enhancing Do Not Track mechanisms. There is a rising concern over behavioral advertising and its privacy implications. Consumers' ability to control unwanted tracking is the direction of the current resolution to the problem of online tracking. However, the analysis on the second part reveals that there are no adequate Do Not Track mechanisms that provide users complete control over online tracking.