ACLU Blasts Proposed Federal Cookie Policy

The American Civil Liberties Union is opposing an Obama administration proposal to reverse a nine-year ban on the use of tracking cookies on federal Websites. In an Aug. 10 filing with the Office of Management and Budget, the ACLU said the policy would allow the mass collection of personal information about every user of a federal government Website.

In a July 27 Federal Register notice, the OMB said the administration is considering a three-tiered approach to the use of tracking cookies. Under the proposed new policy, cookies would not be used at federal Websites—or by contractors when operating Websites on behalf of agencies—unless the site posts clear and conspicuous notice that cookies are being used and the following conditions pertain: a compelling need to gather the data on the site; appropriate and publicly disclosed privacy safeguards for handling of information derived from cookies; and personal approval by the head of the agency.

Since 2000, the government's policy on tracking cookies has been simply to ban the use of them.

"This is a sea change in government privacy policy," Michael Macleod-Ball, acting director of the ACLU Washington Legislative Office, said in a statement. "Until the OMB answers the multitude of questions surrounding this policy shift, we will continue to raise our strenuous objections."

According to the July 27 OMB notice, the proposed three-tier government approach to using cookies would involve:

- 1st Single-session technologies—which track users over a single session and do not maintain tracking data over multiple sessions or visits;

- 2nd Multi-session technologies for use in Web analytics—which track users over multiple sessions purely to gather data to analyze Web traffic statistics; and

- 3rd Multi-session technologies for use as persistent identifiers—which track users over multiple visits with the intent of remembering data, settings, or preferences unique to that visitor for purposes beyond what is needed for Web analytics.

"Americans rely on the information from the federal government to research politics, medical issues and legal requirements. The OMB is now asking to retain the personal and identifiable information we leave behind," said Christopher Calabrese, counsel for the ACLU Technology and Liberty Project. "No American should have to sacrifice privacy or risk surveillance in order to access free government information. No policy change should be adopted without wide-ranging debate including information on the restrictions and uses of cookies as well as impact on privacy."

The OMB is seeking public comments on, among other things, "acceptable use and restrictions of each tier" and the "applicability and scope of such a framework on federal agency use of third-party applications or Websites."

"This past June, we blogged about ways to enhance citizen participation in government through basic policy changes, including revisions to the current policy on Web-tracking technologies. We heard a lot of informal comments on that blog, so we decided to pursue the more formal comment route through the Federal Register," Federal CIO Vivek Kundra wrote July 24 on the White House's Office of Science & Technology Policy Website.

Kundra further noted, "Cookies have become a staple of most commercial Websites, with widespread public acceptance of their use. For example, every time you use a 'shopping cart' at an online store, or have a Website remember customized settings and preferences, cookies are being used."