MS. DIANE REHMThanks for joining us. I'm Diane Rehm. Last week, a student at Stanford University found bypassing security settings on Apple's Web browsing software. A Web developer discovered an app on his mobile phone collecting and storing information from his address book without his permission. And the FTC reported privacy problems with mobile apps for children.

MS. DIANE REHMJoining me in the studio to examine privacy and transparency in our evolving computer age: Marc Rotenberg of the Electronic Privacy Information Center, Cecilia Kang of The Washington Post and Morgan Reed of the Association for Competitive Technology. I know many of you will want to join in this morning. Call us on 800-433-8850. Send us email to drshow@wamu.org. Feel free to join us on Facebook or Twitter. And good morning to all of you.

MS. CECILIA KANGGood morning.

MR. MORGAN REEDGood morning, Diane.

REHMGood to have you here. First, we have on the phone with us Jonathan Mayer. He's a graduate student in computer science and law at Stanford University. Good morning, Jonathan.

MR. JONATHAN MAYERGood morning.

REHMTell us what you discovered Google and other ad companies were doing to bypass Apple's privacy settings.

MAYERSo there's an exception in Apple's privacy setting for forms the user submits. The idea is if the user fills out a form on a Web page or interacts with something on a Web page, for example, a Facebook application, then that application can submit -- can set cookies in response, so...

REHMTell me here. Define cookie very quickly.

MAYERSo a cookie is a little bit of text that can be saved in a Web browser. It's not dissimilar to slapping a bar code on your Web browser so you can track it.

REHMOK. And then tell me how you made this discovery.

MAYERSo we ran some advertisements of our own, and, in those advertisements, we included some measurement code that allowed us to see which advertising companies had set these cookies in users' browsers. And we noticed Safari users had relatively few cookies from most advertising companies. But there were a few companies were they have a lot of cookies, and that clued us in.

REHMSo why do you think it's so important for consumers to be aware of this?

MAYERWell, I think this, unfortunately, gives credence to the view that when it comes to online privacy, there's something of a cat-and-mouse game or arms race where consumers might do something to protect themselves, and then some companies will work around that protection. And then consumers are going to have to do something more. And I don't think we can reasonably expect ordinary consumers to understand how to participate in that arms race.

REHMMarc Rotenberg, turning to you, how do you -- how concerned do you think consumers ought to be about what's going on here?

MR. MARC ROTENBERGWell, Diane, I think they should be very concerned, and I think Jonathan makes the point well. A lot of the new techniques that are being developed by advertisers and the other big Internet firms have left consumers in a position where they really don't have the ability to protect their privacy online. And those efforts that they do make when they select privacy settings, for example, are oftentimes defeated. That's the reason that, to us, we increasingly think that this is an area that Washington will need to step in.

MR. MARC ROTENBERGWe need to update our privacy laws. We need the Federal Trade Commission to pursue enforcement, and we need to give support to consumers who are trying to protect their privacy online.

REHMSo, Cecilia, tell us about the difference between the kind of tracking that Jonathan is talking about and hacking.

KANGWell, hacking is a little bit different in that -- well, actually, there's sort of a blurry line between privacy and some of these more criminal acts, which is getting into people's data without their -- your authority, and that's an illegal process. And that's what's sort of so alarming for a lot of people, what happened with this Google episode and tracking information through Safari when consumers had said expressly that they do not want to be tracked and that Safari, by default, does not track users.

KANGSo there is sort of this blurring of line in this episode, but there are -- and these are sort of the bigger problems and the bigger concerns and anxieties that consumers face when they're online because they see sort of a bleeding of what they -- the control they have over the data at large, how much information consumer -- that the companies have and what they do with that information, and then how outsiders maybe might be trying to get in.

KANGFrom the consumer's point of view, all they see of all this is sort of out -- this feeling of being out of control, be it companies having the information and doing what they want or maybe even hackers doing what they want with information.

REHMJonathan, tell me what you have done now to protect yourself.

MAYERSo I use a number of features to protect myself. The first line of defense I rely on is an ad blocker. My lab did some research looking at the effectiveness of various consumer self-help tools, and, regrettably, it appears that blocking advertisements is, for the moment, the most effective things consumers can do. That's, of course, really bad for websites.

REHMNow, to you, Morgan Reed, how effective are these so-called ad blockers?

REEDWell, as Jonathan points out, ad blockers are incredibly effective. But, unfortunately, it's kind of like spraying your entire house when all you want to do is get some ants that are in the corner. The Internet thrives on advertising, and it's able to provide a lot of free services and a lot of really cool applications for either low or no cost because of advertising. So the real problem that we're all facing in this is that we have a battle between transparency, which is me telling you, hey, this is what I want to do.

REEDAnd the problem of what's happened in this Google instance, where I've told you what I want to do, which is I don't want to see that or I don't want you to have that information -- and they've done it anyway. So I think it's really important that we don't try to, you know, fumigate the entire house to deal with some ants in the corner. And Jonathan's right. We need to develop better tools.

REHMIs that a good analogy, Marc Rotenberg?

ROTENBERGWell, it's certainly a provocative analogy. I do think that for most Internet users who take the time to limit advertising or to use, in the example of Safari, an Internet browser that was supposed to protect them from this type of third-party access, to subsequently learn that an Internet firm -- the largest Internet firm worked around that so they could place their own ads, must be enormously frustrating. I don't know what the user does in that situation.

REHMCecilia, do individual brands have a say in how data is collected and used?

KANGDo you mean the websites themselves?

REHMYes.

KANGThey do. And, in fact, they're all supposed to, or they're charged with the responsibility of explaining to any users who are on their sites what they're doing with their data. And the problem is, is if you go and -- you know, I'd love to take a survey of people who actually read the disclosures, the privacy policies. They're very long. They're very confusing. You...

REHMAnd very tiny print.

KANGVery tiny print.

REHMYeah.

KANGYou need reading glasses for sure. And it's -- you almost need to be an attorney to understand some of the policies. And so one thing that the government wants to do, the Federal Trade Commission and others in the government want to do is make that easier and to mandate that of companies. But, really, it's upon the user to look closely. If you really care about what that company is doing with your data, to read as closely as you can, the problem is is there such a gap between the ability to understand the information that's out there and what consumers want.

REHMJonathan, I would have thought you would've read the data very carefully. But, nevertheless, your system was clearly invaded.

MAYERThat's right. So there are, I think, two issues I'd like to respond to here. The first one is, in this case, Google was somewhat transparent. It said, if you have this feature turned on, that's essentially the same as opting out of our ad tracking. We learned that wasn't true. But, at a higher level, I guess, I would resist this notion that transparency is the end-all solution to this problem. There's a great study on privacy policies by a team at Carnegie Mellon.

MAYERAnd they looked at how, if the average user would've read all the privacy policies that affected them, it would take days and days out of every year. We can't reasonably expect that. And so, I think, beyond transparency at a policy level, we need to think about how we provide good consumer choice.

REEDWell, I'd...

REHMGo ahead, Morgan.

REEDYou know, it's -- he's talking about Lorrie Cranor and Aleecia McDonald's research on this. And they found two interesting things, one, that people don't read privacy policies, and if they did, it would take them forever. But, two, simplified policies are hard to make effective. And so, I think, it's important since, you know, my community is the mobile apps developers. We're actually trying to figure out better ways to do it. We've been around for 24 months.

REEDI mean, the entire ecosystem that we live in is roughly closing in on five years old. We're still working on ways to provide that transparency. So while Jonathan talks about, well, we need to -- we can't solve the problem with transparency, I think we can get pretty close. And I think it's what we should try to achieve first before we just shut down the whole operation.

REHMWell, Jonathan, you talked about consumer choice. Say what you mean.

MAYERSure. So there's a specific mechanism I have in mind here. It's called Do Not Track. It's a proposal we've worked on at some links at Stanford. It's now been taken up by the World Wide Web Consortium -- that's a Web standards body. And the idea is a consumer shouldn't need to be getting a PhD in computer science to understand how to say no. They should have a simple choice built into their Web browser or smartphone that says, if I don't visit a website, I don't want them to track me.

MAYEROne simple checkbox and they're done, and there's already a number of users using this feature in existing Web browsers. It's not a hypothetical. Nearing 5 to 10 percent of Firefox users have already enabled this feature.

REHMAll right. Jonathan Mayer, graduate student at Stanford. Short break, we'll be right back.

REHMAnd joining us now is Congressman Edward Markey of Massachusetts. He's co-chair of the Bipartisan Congressional Privacy Caucus. Good morning to you, sir.

REP. EDWARD MARKEYGood morning. Thank you.

REHMI know you've asked the FTC to investigate whether Google has violated its recent settlement. Tell me why and what's happened.

MARKEYWell, my concern is that this is a continuing pattern of behavior by Google, and it's just an ongoing unfair and deceptive practice that is part of their business model. And so I've asked the Federal Trade Commission to investigate, to determine whether or not they are in violation of their recent settlement with the Federal Trade Commission, that they would not engage in that type of activity, and then to determine what the penalty should be.

MARKEYUnder the law, they are subject to very serious penalties. And my hope is that the FTC can act very quickly because we need to establish deterrence not only to Google but to every company from engaging in this kind of activity.

REHMMarc Rotenberg, what's happened to Google and its privacy activities?

ROTENBERGWell, the point that Congressman Markey makes, which is a very important one, is that Google is currently subject to a consent order from the Federal Trade Commission because of stuff they did last year with the launch of Google Buzz. And so the letter that Congressman Markey sent, along with Congressman Barton -- I should point out privacy in Washington is generally a bipartisan issue. It generally brings people together.

ROTENBERGAnd I think it's important to note here, though, is both Congressman Mark and Congressman Barton who sent that letter, and specifically the Federal Trade Commission will need to act before March 1 because March 1 is the day that Google has proposed to make dramatic changes in its privacy practices.

REHMI see.

ROTENBERGIt will combine all of the data of its users, which many people have objected to. So I hope that, with Congressman Markey's letter, there will be some effort to look at that more closely.

REHMCecilia.

KANGCongressman Markey makes an interesting point about this being a pattern of behavior by Google. And you see this with not just Google, but with other companies, like Facebook, and concerns by users that, you know, I don't want to hear another apology from a CEO saying, whoops, I sort of violated your privacy. And you see that pattern with Facebook, for example, when they were sharing information on what was known as their Timeline, with the Beacon advertising mechanism that shared what users were buying online.

KANGAnd over and over again, Mark Zuckerberg, and also Google, has -- and its executives have apologized and said to users, look, we're wrong. We're ahead of ourselves on technology. From the consumer's perspective, again, people right now are wondering, you know, I've become so accustomed and so dependent on some of these applications like Google Mail that were free -- and mind you, of course, I think everybody should pay -- be very mindful that a lot of these things are free. But is there potentially a cost to this, and is that cost privacy?

REHMCongressman Markey, what steps is Congress taking to give consumers more control over their personal information?

MARKEYWell, Marc is right when he said that, beginning in March, Google's new privacy policy will read, you have no privacy. They intend on sharing all of your information across all of their platforms. So what I have done with Congressman Joe Barton from Texas, a very conservative Republican from Texas -- I'm a very liberal Democrat from Massachusetts. So we've introduced the bill just focusing on kids 15 and under because all of this is happening to kids 15 and under who now have devices that they have convinced their parents to purchase for them.

MARKEYAnd so they're in this very vulnerable situation as well. And so I don't think parents want the fact that a kid goes to YouTube to turn into You Track. And so, basically, what the legislation is, that I have, is it gives the parents and the kids a right to say, I don't -- that they don't want to be tracked and that the parents have a right to say, I want all of the information gathered about my child erased because you don't want a 12-, 13-, 14-, 15-year-old in a situation where they're haunting, then, the 19- to 20-year-old that they grow into, by which websites they went to, what they did online.

MARKEYAnd what Google and Facebook and all of these companies all say to me is, oh, you don't know how complicated that would be. That would just be very technologically difficult to do. But, unfortunately, for kids 15 and under, much less adults because adults are in -- should have much higher levels of privacy protection as well. But if they're not willing to do it for kids 15 and under, who they're attracting to and marketing to in terms of purchasing of these devices, then it's really going to be a very dangerous, brave new world that everyone in America is living in. So...

REHMAnd back to Jonathan Mayer, the graduate student at Stanford University, who simply says he's going to somehow include Do Not Track on his own computers. How successful, Jonathan, do you think that can be?

MAYERWell, so Do Not Track is inherently both a technology and a policy proposal. So it's a technology proposal insofar as it provides a mechanism of signaling the consumer's preference. But then it becomes a policy problem in figuring out what that preference means and how we make sure companies enforce it. When we worked on Do Not Track here over a year ago, starting to flesh out the proposal, we realized that purely technological solutions could not work. And so this isn't just a Silicon Valley problem. It's also a Washington problem.

REHMHmm. Congressman Markey, how do you respond?

MARKEYWell, I think Jonathan is right. It's not just saying, well, the technology is there. You've heard earlier about how very much more complicated it is than ordinary citizens have the time to dedicate to dealing with all of the various privacy policies, so there has to be, basically, a constitution, and especially for kids 15 and under. And that would be a right to the knowledge in information that's being gathered about them, notice that the information is going to be used for purposes other than that which the families intended for that information to be used by their kids, and, thirdly, the right to say no.

MARKEYSo knowledge, notice and then the right to say no. And we have to find a way of codifying it, and that's what Congressman Barton and I have done, actually working with Marc and many of the other experts that are in Washington, D.C. and across the country. Jonathan has been a great source of information for me and Congressman Barton as well. So we just have to make sure that it's not just Big Brother out there, the government, but Big Mother and Big Father who can protect the families from having all of this information gathered about young people.

MARKEYAnd then having company after company around the world be able to market back into these kids, to be able to track them, is just not right. It should be unacceptable in a modern society.

REHMMorgan Reed, knowledge, notice and no.

REEDWell, I think there are a couple of things here. First of all, we already have some of the enforcement mechanisms available through the Children's Online Privacy Protection Act. And this year, the FTC, which oversees COPPA, issued a new notice which adds a whole bunch of features, including, for my community, in mobile applications. And so a lot of the features that he wants to see in there are actually something that we already have some tools to deal with.

REHMBut why aren't they working?

REEDWell, in fact, a lot of them are, except for the fact that -- and this came out recently in an FTC study -- our community, my community, the mobile apps developers' community are failing to really do a good job on transparency. But I think I want to take it back to the real issue that we've got to get with with the FTC, and that is enforcement. You know, Marc Rotenberg just talked about the Google Buzz settlement.

REEDWell, that's not the only time that we've had this problem with Google. Remember, we had a conversation on Kojo and on other shows talking about the issue of Wi-Spy, where Google drove around the country, spying on people's houses, essentially. And then a few months later, they said, oops. Well, actually, worse than that. First they said, we didn't do it. Then they said, it was rogue engineers.

REEDAnd I think -- Marc, you can correct me if I'm wrong -- the final answer was, oops, we didn't mean to. So I think we have to separate out what we need to have, which is the ability to do advertising that supports these applications, from companies that keep saying, oops, and do it in a way that seems to be completely without worry about FTC enforcement.

REHMMarc Rotenberg, I've got an email here from Pamela, who says, "What kind of a company is Google becoming? What about the credo of not being evil?"

ROTENBERGWell, I mean, in fairness, Google is a very innovative, very successful company that provides an enormous number of Internet services that are...

REHMInnovative and successful are one thing, but...

ROTENBERGThey're -- well, certainly, but I think the problem that has arisen, particularly in Washington, is the view that that, therefore, gives them a pass when they create problems. And our view is you can be an innovative and successful company and also respect the privacy rights of your users. And I think, in the last couple of years in particular, as Morgan has pointed out, it appears they have adopted a view, as long as we're successful, we don't have to worry about that issue. And that's a mistake. That just can't be right.

REHMCecilia.

KANGWell, Google is an interesting company in that it is so large. And a lot of people have come to depend on their services for years, like Google Mail, for example. They have 350 million users. But, again, once you keep in mind that these are free services -- and they've actually been pretty upfront that they do behavioral advertising. They collect information about you, so they know you like certain things.

KANGYou might, like -- you surf for a Justin Bieber video on YouTube, and so I should maybe hawk a Doritos ad to you. That's -- those are the sorts of things that they're pretty upfront about what they do.

KANGThat said, the question is, if the company is giving you enough choice to say, you know, no, thank you. You're going to change everything on March 1. But I, actually, as a Google Mail user, for example, have decided that I don't want for my information on mail to be combined with YouTube and Blogger and Picasa and all their other 60 services, so that you have a portrait of me because maybe my kid was watching Justin Bieber, and I don't want you to think I like Justin Bieber. Or maybe I have professional emails in my Gmail account that I don't want anybody to have access to.

REHMCongressman Markey, is there a gateway here that allows these companies to have access? Is there, in your view, a way to block this?

MARKEYYeah. First of all, let me just say that I am the author of the Child Online Privacy Protection Act of 1998, so I'm very familiar with that law that is already on the books. But, as the author of it, I also know that I put that law on the books in the BF era, in the before-Facebook era. So we might as well be talking about the Peloponnesian War as talking about 1998 and the Internet.

MARKEYIt's just grown so exponentially and insinuated itself into the lives of people all across the country, and children are the ones that -- and kids, teenagers, to them, being online is like having oxygen. I mean, they're waking around all day long just using these devices. And I do believe that an erase button should be made available for parents so that they can ensure that all this information being gathered about their children, about their kids 15 and under, cannot be turned into a product, cannot be turned into a profit-making center for these online companies.

MARKEYThe parents should have a right to say, no, you cannot be tracking my child. You cannot be marketing back to my 13-, my 14-year-old just because they happen to be using your device. And I believe that every parent, every child is entitled to this right. And so far, they spoke, and Google are saying, no, they will no do it. And I just think that it is wrong. It is technologically possible to create that right.

MARKEYI believe that many people are under the misimpression that when they push the delete button that that information is gone because they can't see it anymore, but these companies continue to house...

REHMAll right.

MARKEY...all of this information. For them, it's a very valuable product that creates a personal profile of the child, of the teenager that is then going to be used for the purposes of selling that information to other online companies.

REHMAll right.

MARKEYThere has to be a privacy bill of rights for kids 15 and under in this country.

REHMCongressman Ed Markey of Massachusetts. And you're listening to "The Diane Rehm Show." Congressman Markey, we have an email from Kevin in Kensington, Md., who says, "Why aren't the privacy policies of our country requiring an individual to opt-out when companies want to collect information about them as opposed to the European model of opt-in, which requires the companies get your permission to collect information about you? Will Congress ever consider passing opt-in laws?"

MARKEYEurope has a different history than we have because of World War II, because of the incredible impact which the Nazis had upon every country in Europe. And identity became a central part of who the Nazis oppressed and did not oppress, that within the living memory of every family in Europe is the real sense that their identity should be protected, which is why the Europeans in general have this sense that opt-in is the correct approach.

MARKEYIn the United States where we are, to a very large extent, the innovators in these new technologies, and a culture began to develop coming out of Silicon Valley that said, hey, privacy, you don't have any, get over it, there was a very successful political effort to block opt-in, which, ultimately, when people uphold, would be identical in terms of the interest level that American families have that European families have. But, politically, there was not the same intensity level.

MARKEYBut, I think, as more and more of these revelations made public about what Google, Facebook and, by the way, dozens and dozens of other companies are doing, that I think that there is going to be a public outrage. And I do believe it's going to start with the kids 15 and under.

REHMInteresting. Morgan.

REEDWell, I think there are two things worth noting. I'd like your audience to think back in their memories and think about all the innovative free services coming from European-based companies. Oh, I haven't thought of any. In fact, it's really the United States that's really been leading in that space, in part, because of the ability to ramp up quickly, to get advertising in front of people and to make a go of it using advertising as your revenue.

REEDSo all these free services -- and they aren't free. They're advertising-supported just like broadcast television has been -- those have been incredibly successful. I think, though, what Congressman Markey might be getting on to something where it is accurate is, do you start to achieve a certain size in which you aren't responsive to your customers anymore? So that, I think, is going to be the bigger question.

REHMMorgan Reed, he is with the Association for Competitive Technology. Congressman Markey, thank you so much for joining us this morning.

MARKEYYou're welcome. Thank you.

REHMAnd we'll take a short break here. When we come back, your calls, comments, questions. Stay with us.

REHMAnd we're back. It's time to open the phones, 800-433-8850. First to Grand Rapids, Mich. Good morning, Anthony. You're on the air.

ANTHONYGood morning, Diane. First of all, I've been a long-time listener, and it's a pleasure to speak with you.

REHMThank you so much. Good to have you.

ANTHONYGoogle has become the wolf in sheep's clothing. You know, I was a big supporter of Google for many, many years. And then they came out with the Wi-Fi. Now, we hear that they are tracking Safari in violation of Safari's policies. But I want to talk about the new privacy policy that Google has rolled out. It's an adhesion policy. It's either take it or leave it.

REEDDiane...

ANTHONYThose of us who have come to depend on Google services and have been using them for years, now, we are left with one choice: either adhere to the new privacy policy, which is going to allow them to track your Gmail -- they haven't said anything about if they're going to be tracking your Google Voice if you're using that. There's been nothing said, and I've read this policy about how they're going to track data coming off your Android phones.

ANTHONYThere are several million Android phones out there. They are always signed in to Google. They're going to be tracking people on Google Plus. The first thing I did after reading the policy was to go out there and delete my Google Plus account. But I'm very concerned about what's going to happen with the data that's coming across my Android phone. There's nothing out there that tells me are they tracking it, are they tracking everything that comes on, because you're always trying to...

REHMOK. Marc Rotenberg.

ROTENBERGWell, your caller is making a critical point. Google is going to make the problems that we're talking about today much worse after March 1 because, after that date, Google will be combining all of this data. And the interesting point that your caller also makes, it's not only the risk. It's also the fact that they have retained this information about you, which they now get to put together, and that users won't actually be able to assess what the consequences of future acts will be on their privacy.

ROTENBERGAn Android phone user won't know if what they've done on YouTube or search or Picasa or something else is going to have ramifications for the way their telephone operates. And that just can't be right.

REHMCecilia.

KANGSo the Android phone issue is interesting in that Android -- for the listeners who don't know that much about Android -- is based on Google's operating system called Android. And at the point of sale, when you buy an Android phone, typically the salesperson will ask you to sign on to a Google account to activate your phone, be that Gmail or something else. So, automatically, you're signed into what will be on March 1 a whole new system of sort of stitching together all your data across all of its services.

KANGSo that means that when your Android phone is on, you're being -- your data is being collected across these services. That said, in Google's defense, they would say, listen, you can still search -- use your search engine. You can still use YouTube, all these things, without signing on. You could be an anonymous user. But when it comes to Android phones, it's very difficult or impossible to do that for a lot of users.

REHMHow is that different from purchasing an iPhone?

KANGSure. So in iPhone, you don't have the Google Apps, the Google services that are so prominently displayed. And you don't have to sign on, frankly -- effectively, and you can't -- to use it, you can only download applications on an Android phone by using the Google Android marketplace. And you have to be an account holder. And that is the key to be an account holder, and to be signed on to any of these Google services to do it. And -- so it's difficult.

KANGIt's particularly difficult to make your phone really functional and interesting and really worthwhile, a smartphone, an Android phone, without being signed on to some of these services.

REHMJonathan Mayer, what's your reaction?

MAYERSo, I think, this issue of blurring the lines between different service offerings by Google is very closely related to what we discovered. I think, to the extent there's legitimacy to blurring the lines, I think it's incumbent upon Google to be very clear about how they're going to use a user's information, not just give a blanket statement of we're going to combine it all and use it as we see fit.

MAYERThe issue we discovered was in the context of a system that Google had not been very public about, whereby it was using Google account information, the account you have when you use Google's Gmail, for example, to personalize ads. So they've been blurring the line between what you do on Google's website and what shows up in Google advertising on other websites. And they hadn't really told users that.

REHMMorgan.

REEDWell, I think we keep going around this issue. I mean, Google's whole mission is to collect the world's information and index it and then sell ads based on that information. They are an advertising company at their core that uses technology to collection information to provide you an ad you want to see.

REHMAnd that's how they make their money?

REEDThat's right. So -- and, you know, we need to remember that we're shocked that they're serving alcohol in this establishment. This is an advertising company with a goal of selling advertising. I think the problem that we're really getting to is the ubiquity of the Google services. And with Google now having government contracts, where Gmail is part of a government service -- the .gov email account is provided by Google -- we have to start asking real questions about what information are they collecting and how are they using it when it's a government agency.

REHMJonathan Mayer, what's your reaction?

MAYERSo, I think, that's quite right, that we need to start asking more difficult questions of Google in understanding what exactly it is that they're collecting and how they're using it. I think it also might make sense, given that Google is now a practical necessity for some phones, for some Web users, that it might start making sense to stop expecting Google on its own accord to put together the privacy choice that the consumers want, the kind of control over information-sharing among the services or with Google when you're not on a Google website, and start to look back to policy solutions there.

MAYERBecause, as a matter of business, it's quite right. Google's an advertising company, and their business has been to collect as much data as they can and then delivers that data to target ads.

REHMAll right, to Cambridge, Mass. Good morning, Steve.

STEVEGood morning, Diane. I took particular issue with -- excuse me -- Congressman Markey when he said Google had insinuated itself, or these tech companies have insinuated themselves, into consumer's lives. It's quite the opposite. Consumers have demanded these products, have spent money on these products, and politicians like Congressman Markey have been very, very active in getting these products in the school. That's my first point.

STEVEMy second point is consumers feel that they're entitled to this tremendous of amount of free information of which provides them with power and convenience. And then, all of a sudden, when it comes to information on them, all of a sudden they feel like, oh, well, that's private property. No one can have the information on me. That's my private property. But they spend their lives on these devices.

STEVEAnd they buy them for their children and go out and thinking the world is their oyster and they have the right to download movies and free music and information on every subject in the world. So those are my points.

REHMCecilia.

KANGThis is a really important point. Listen, consumers, you do have choice. That is for sure. And the question, though, is, are you being given enough information to make the right choices or the choices -- the most informed choices? That's sort of the concern today, those sort of lengthy, difficult disclosure policies, for example. But also, with the Google service and the changes in March, they're actually saying, if you want to remain a Google Mail user, for example, a Gmail user, you don't have the choice to opt-out of this particular policy.

KANGSo that is not a choice. But I think the caller does make an important point in that it is upon the consumer to educate -- if they're really concerned, there -- it's upon them to educate themselves as much as they can.

REHMAnd here is an email from a medical professional, Carol, who says, "Is Google capturing data from our Android devices? Can that be considered a breach of contract?" She says, "What rights do we have? My goal," she says, "is to drop the Android phone, go back to a basic cell. My provider is Verizon. As a medical professional, I cannot absorb the legal consequences of Google capturing data for its use." Marc Rotenberg.

ROTENBERGThis is the critical point.

REHMYeah.

ROTENBERGConsumer choice only works when businesses honor the terms of the bargain, when they respect the privacy settings of the user. And if a company enters into an agreement with the consumer and subsequently says, oh, now, we're going to change the rules, now, we want to use your data in new ways, that's completely on the company. And that's why you do need enforcement action. So without the enforcement of these terms, these policies become meaningless.

REHMMorgan.

REEDYeah, I think it's really important that we look at this action and Google's size because -- here's the problem: I need to be able to have small businesses to be able to compete and do new things. I need to actually be able to do advertising, possibly collect information, do deals, but, when Google goes ahead and breaks the law again and again and again, we know what's going to happen.

REEDCongressman Markey and Congressman Barton are going to put in legislation that will affect the entire industry and take us all down with the bad behavior by Google. So what we've got to have is the FTC or the administration has to step up and say to Google, no, you can't do this.

REHMCecilia, tell me about this social networking app called Path.

KANGOh, so Path is a social networking app that's sort of like an online diary, a journal. So you use this to just sort of log your thoughts of the day. It's -- and you have friends who can look into it and share information as well. And what happened with Path, a couple of weeks ago, is it was discovered that users of Path, their information from their iPhones, their contact lists, actually, the addresses and phone numbers of those in their iPhone contact list were scooped up by the Path application.

KANGAnd that -- and not only just Path. I think Twitter was involved in this as well. And the concern was that, for Path users -- and there's about 1 million of them -- that they never expected that the information on their contact lists from their phone, the device itself, would be somehow assimilated into their Path experience, if you will. So that was another concern of -- sort of another betrayal of, you know, expectations.

REHMMarc Rotenberg.

ROTENBERGWell, what Cecilia is describing is the access to the address book that people have on their iPhones. And this is a very good example of sensitive personal information. So that when a third-party developer says, boy, it'd be really cool if I had this customer's address book 'cause I could add some other functionality and not actually say to the person, oh, by the way, I'm downloading your entire address book and all the notes that you might have associated with people...

REHMWhoa.

ROTENBERG...it's an enormous privacy issue.

REHMAll right. To Birmingham, Ala. Good morning, Brady.

BRADYHow are you doing this morning?

REHMGood. Thanks.

BRADYI, actually, am also in the medical field, so I was listening to what the emailer had written. And I also happen to be elite enough in the tech world to understand what's going on. I know that my information about myself is being taken up. When I purchased my Android phone, I looked to see what apps were on there. They -- eventually, a forced update was sent out. Eight company applications were put on my phone, and I was not allowed to delete them, still not able to.

BRADYAnd they have access to my contact list and other current people's data, patients, other, you know, doctors and stuff, and that -- I sent a letter, and they said, too bad. If you don't want to use it, keep your phone off. And so I actually wrote a letter to the FTC, not anybody else 'cause it was a cellphone thing. And basically the company, Verizon, who I'm with, sent me a letter saying, well, too bad. We don't care. We're not going to fix it. If you don't want to use it, keep your phone off or buy a new one.

REHMAll right. And you're listening to "The Diane Rehm Show." Morgan.

REEDWell, two things. I want to step back to the Path issue really quickly. Here's the problem. My community, the geeks out there, we have a bad habit of asking not, should we do something, but can we do something first? And in the case of Path, they were out saying, we want to make this awesome, cool social networking app that ties you together with your friends in a new way. And they thought, like geeks, well, of course, you know that that means looking at your contacts to figure out who your friends are.

REEDSo they made a really bad assumption. Now, the good news is is that this is the kind of thing where the FTC can come down hard on them if they weren't being straightforward with people about it. And I think that's something that we as industry have to solve. On the medical apps question and what's installed in your phone, I think the caller is right. And there's a huge high-tech medical conference coming up later this week in Vegas, and these are going to be some of the issues that the FDA and the FTC are going to be addressing, which is how do we do it.

REHMMarc.

ROTENBERGWell, it's very interesting that you're getting calls from people in the medical community who understand the importance of confidentiality. I mean, a lot of people may not even think about it. But if you do, you're in all sorts of relations, professional and personal, where privacy matters. And they think about what happens if, you know, services other than their telephone service has access to their personal data, their contacts, their comments. And they're rightly concerned.

REHMAll right. And to Traverse City, Mich. with another perspective. Good morning, Matt. Matt, are you there? I guess he's not. Let's go to Paul in Orlando, Fla.

PAULHi, Diane.

REHMHi there.

PAULThanks for having me on today.

REHMSure.

PAULI think this is a very important conversation, obviously, to have. I wanted to go back to something that -- I believe it was the graduate student who said, which is that these are companies, and their end goal is to make money, that they shouldn't be allowed to police themselves. You know, this is what the legislators and the laws are for. To think that these are just benevolent nerds out there, you know, just looking to make products that are sort of cool is just not the way it is. These are people trying to make money, and they shouldn't have free rein over our data with no legislature.

REHMAll right. So what do you see happening, Marc, in the months to come?

ROTENBERGWell, I mean, I think -- look, these companies are innovative, successful, and I think that should be encouraged. But there has to be regulatory oversight 'cause that's the problem. And the truth is, if there isn't regulatory oversight, a lot of the success will come to an end. The FTC needs to act. That's what needs to happen right now. The Federal Trade Commission has to say to Google, no, you do not get to make those changes on March 1. Too many people have too many concerns about where the company is today.

REHMDo you see that happening, Cecilia?

KANGWell, one thing that I think that people do need to keep in mind is that their behavior is going to dictate what happens to them online. In other words, if you're giving a lot of information about yourself, then you should expect that you're going to have a lot of your data collected, and it's going to be used in some way. And Facebook, for example, in its initial public offering filing, had some very interesting information about what users were doing on Facebook. They're...

REHMBut if I fill out a mortgage application...

KANGSure.

REHM...in writing, I don't expect that bank...

KANGYes.

REHM...to use my information all over the place.

KANGThat's right. And I think that one should think of different tiers of privacy. There is, of course, mortgage, political information, medical information...

REHMExactly.

KANG...financial information, for sure, that may be should be the most entrusted.

REHMCecilia Kang of The Washington Post, Marc Rotenberg of the Electronic Privacy Information Center, Morgan Reed of the Association for Competitive Technology, and thanks to Jonathan Mayer, a graduate student in computer science and law at Stanford University, and Congressman Ed Markey of Massachusetts. Thanks for listening. I'm Diane Rehm.