Remarks on the Relevance of Privacy Expectations for Default Opt-out Settings

Based on the provided paper, here is a detailed technical summary covering the problem, methodology, key contributions, results, and significance.

1. Problem Statement

The paper addresses a critical legal and technical conflict in US privacy regulation regarding Universal Opt-Out Mechanisms (UOOMs), such as the Global Privacy Control (GPC).

• The Conflict: New state privacy laws (e.g., the Colorado Privacy Act or CPA) generally prohibit software vendors from enabling UOOMs by default on pre-installed software (e.g., browsers bundled with an OS). The rationale is that a default setting does not constitute an "affirmative, freely given, and unambiguous choice" by the consumer.
• The Exemption Gap: While these laws often exempt user-installed privacy-protective software from this prohibition, they do not extend this exemption to pre-installed software, even if that software is marketed specifically for its privacy features (e.g., Apple's Safari).
• The Consequence: This creates a regulatory paradox. Vendors of pre-installed, privacy-focused software are forced to disable UOOMs by default to comply with state laws (CPA). However, doing so may violate federal laws (FTC Act) and state Unfair or Deceptive Acts or Practices (UDAP) laws because it contradicts the "reasonable privacy expectations" consumers hold based on the vendor's marketing (e.g., "Privacy. That's Apple.").
• Historical Context: The paper notes that this issue mirrors the failure of the "Do Not Track" (DNT) initiative, where the industry refused to honor default DNT signals, leading to a reliance on self-regulation that failed to protect consumers.

2. Methodology

The paper employs a legal and policy analysis framework rather than an empirical or experimental technical study.

• Statutory Interpretation: The author analyzes specific provisions of the Colorado Privacy Act (CPA), the California Consumer Privacy Act (CCPA), and the FTC Act (Section 5).
• Precedent Analysis: The paper reviews the history of the Do Not Track (DNT) debate, specifically Microsoft's decision to enable DNT by default in Internet Explorer 10 and the subsequent industry backlash, to illustrate the limitations of "default" interpretations.
• Legal Harmonization: The author applies the Supremacy Clause of the US Constitution to argue that federal laws (FTC Act) regarding deceptive practices should preempt conflicting state interpretations.
• Conceptual Reframing: The methodology involves redefining the concept of "consumer choice." Instead of viewing choice solely as the act of toggling a setting, the author argues for an interpretation where product selection (choosing a privacy-centric brand) constitutes an implicit, affirmative choice.

3. Key Contributions

The paper makes several theoretical and interpretive contributions to the field of online privacy:

• Reframing "Choice" via Privacy Expectations: The central contribution is the argument that "choice" should be determined by consumer privacy expectations rather than the installation method (pre-installed vs. user-installed). If a vendor markets a product as privacy-protective, the consumer's decision to use that product is an affirmative choice to have privacy protections enabled by default.
• Resolution of Legal Conflicts: The paper proposes a legal interpretation that resolves the conflict between state laws (CPA) and federal laws (FTC Act). It argues that enabling UOOMs by default on privacy-marketed software is not a "default setting" in the negative sense, but rather the inherent behavior of the software that the consumer chose.
• Distinction Between Vendor Types: The author distinguishes between two types of vendors:
  1. Privacy-Protective Vendors: For these, enabling UOOMs by default is a fulfillment of consumer expectations and a valid exercise of choice.
  2. Data-Collection Vendors: For vendors whose business models rely on data monetization and who make no privacy promises, a default-on UOOM would indeed be deceptive or an overreach, justifying the prohibition.
• Critique of the "Install Form" Metric: The paper argues that the current regulatory focus on whether software is "pre-installed" is an inadequate proxy for consumer intent and should be replaced by an analysis of marketing disclosures and reasonable expectations.

4. Results and Arguments

• Legal Consistency: The author concludes that prohibiting default UOOMs on pre-installed, privacy-marketed software forces companies into a position where they must either violate the FTC Act (by being deceptive) or violate state laws (by not enabling the opt-out).
• Interpretation of CPA Rule 5.04: The paper argues that Rule 5.04 of the CPA Rules, which bans default UOOMs for pre-installed browsers, should be interpreted to allow exceptions where the browser's marketing explicitly creates a reasonable expectation of privacy protection.
• Alignment with CCPA: The proposed interpretation aligns the CPA with the California Consumer Privacy Act (CCPA), which explicitly recognizes that utilizing "privacy-by-design" products constitutes an affirmative exercise of consumer choice.
• Market Impact: Allowing default UOOMs for privacy-focused pre-installed software would reduce "privacy transaction costs" for consumers and enable genuine market competition based on privacy features, rather than forcing all vendors to adopt a "privacy-neutral" (data-harvesting) default.

5. Significance

• Policy Evolution: The paper provides a roadmap for regulators to update the interpretation of "notice and choice" principles. It suggests moving away from rigid, mechanical definitions of choice (toggling a switch) toward a more holistic view based on consumer expectations and product design.
• Consumer Protection: By aligning state laws with the FTC's standards for deceptive practices, the paper argues for stronger, more consistent protection for consumers who rely on pre-installed software for privacy.
• Economic Incentives: The findings suggest that current regulations inadvertently punish "privacy-by-design" innovation. Correcting this interpretation would allow companies to compete on privacy, potentially driving a market shift where privacy becomes a standard, default feature rather than an optional add-on.
• Future-Proofing: As the US moves toward a patchwork of state privacy laws, this framework offers a unifying principle (reasonable expectations) that can harmonize conflicting regulations and prevent legal fragmentation.

In conclusion, the paper asserts that for pre-installed software marketed as privacy-protective, a turned-on UOOM is not a "default setting" imposed by the vendor, but the materialization of the consumer's choice to use a privacy-centric tool. Therefore, such defaults should be legally permissible and necessary to prevent unfair or deceptive practices.