White House Responds to Cookie Rumors

Federal CIO Vivek Kundra denies the government is creating special exemptions for third parties regarding existing privacy rules banning persistent tracking cookies.

The White House responded Aug. 11 to critics of a proposed policy change that would allow federal Websites to use tracking cookies. Since 2000, the government's policy on tracking cookies has been to simply ban the use of them, but a July 27 notice in the Federal Register sought comment on reversing the policy.
Since the notice, the Office of Management and Budget has received plenty of feedback on the proposed policy, including a filing from the American Civil Liberties Union claiming the change would allow the mass collection of personal information of every user of a federal government Website. In addition, rumors surfaced and quickly made the blogging rounds that the policy would allow tracking cookies by third parties.
"This privacy issue has recently received some attention in the media. We want to make it clear that the current policy on Federal agencies' use of cookies has not changed," Federal CIO Vivek Kundra and Michael Fitzpatrick, associate director of the OMB's Office of Information and Regulatory Affairs, wrote on the White House blog Aug. 11. "Moreover, the policy won't change until we've read the public comments that have been submitted to ensure that we're considering all sides of the issue and are addressing privacy concerns appropriately."
The two also spoke on the rumors about third-party cookies:

"We would also like to take this opportunity to address a potential misperception. Some articles have hinted that the government is creating special exemptions for third-parties from existing privacy rules, with the result that there wouldn't be adequate protection of people's personal information. This is not true. The current policy in place on persistent cookies continues to apply to all Federal agencies and to those agencies' use of third-party applications, whenever personal information is collected on the agency's behalf."

In the July 27 Federal Register notice, the OMB said the administration is considering a three-tiered approach to the use of tracking cookies. Under the proposed new policy, cookies would not be used on federal Websites-or by contractors when operating Websites on behalf of agencies-unless the site posts clear and conspicuous notice of the use of cookies and the following conditions are met: a compelling need to gather the data on the site; appropriate and publicly disclosed privacy safeguards for handling of information derived from cookies; and personal approval by the head of the agency.

"This is a sea change in government privacy policy," Michael Macleod-Ball, acting director of the ACLU Washington Legislative Office, said in a statement. "Until the OMB answers the multitude of questions surrounding this policy shift, we will continue to raise our strenuous objections."

The proposed three-tier government approach to using cookies would involve:

"- 1st Single-session technologies-which track users over a single session and do not maintain tracking data over multiple sessions or visits;- 2nd Multi-session technologies for use in Web analytics-which track users over multiple sessions purely to gather data to analyze Web traffic statistics; and- 3rd Multi-session technologies for use as persistent identifiers-which track users over multiple visits with the intent of remembering data, settings, or preferences unique to that visitor for purposes beyond what is needed for Web analytics."

"Americans rely on the information from the federal government to research politics, medical issues and legal requirements. The OMB is now asking to retain the personal and identifiable information we leave behind," said Christopher Calabrese, counsel for the ACLU Technology and Liberty Project. "No American should have to sacrifice privacy or risk surveillance in order to access free government information. No policy change should be adopted without wide-ranging debate, including information on the restrictions and uses of cookies as well as impact on privacy."

The OMB sought public comments on, among other things, "acceptable use and restrictions of each tier" and the "applicability and scope of such a framework on federal agency use of third-party applications or Websites."

"This past June, we blogged about ways to enhance citizen participation in government through basic policy changes, including revisions to the current policy on Web-tracking technologies. We heard a lot of informal comments on that blog, so we decided to pursue the more formal comment route through the Federal Register," Kundra wrote July 24 on the White House's Office of Science & Technology Policy Website.
Kundra further noted, "Cookies have become a staple of most commercial Websites, with widespread public acceptance of their use. For example, every time you use a 'shopping cart' at an online store, or have a Website remember customized settings and preferences, cookies are being used."