Search papers, labs, and topics across Lattice.
This paper analyzes the legal implications of default opt-out settings for privacy-protective software under US privacy laws, particularly concerning Universal Opt-Out Mechanisms (UOOMs). It argues that prohibiting default-on UOOMs in pre-installed software, based on the need for "affirmative choice," can contradict consumer privacy expectations and potentially violate FTC regulations against deceptive practices. The paper proposes that for software creating reasonable privacy expectations, its mere use should constitute valid consent for enabling UOOMs, aligning legal interpretations with consumer expectations and fostering privacy-focused competition.
For privacy-focused pre-installed software, assuming user consent for default-on opt-out mechanisms isn't just good UX, it might be legally required.
Over the past few years an increasing number of states in the US have adopted new privacy laws. The majority of these laws require compliance with universal opt-out mechanisms (UOOMs), which allow consumers to send legally binding opt-out signals. However, a number of laws generally do not allow UOOMs to be enabled by default. While some laws exempt privacy-protective software from this prohibition, the exemption does not apply to pre-installed software, e.g., a privacy-protective web browser bundled with an operating system. The reason for not allowing default opt-out settings for pre-installed software is to ensure that settings reflect consumers'"affirmative, freely given, and unambiguous choice,"as, for example, the Colorado Privacy Act (CPA) is putting it. However, prohibiting vendors of privacy-protective software from turning on UOOMs by default can force them into committing unfair or deceptive acts or practices under the FTC Act and equivalent state laws. Thus, whether UOOMs can be turned on by default on pre-installed software should depend on consumers'privacy expectations. For pre-installed software that is creating a reasonable expectation for consumers that their privacy will be protected, the simple use of such software should be considered a valid choice for enabling UOOMs. In such software a turned-on UOOM is not a"default setting"but rather the software's inherent behavior that a consumer expects and chooses through its use. This interpretation of consumer choice is preferable under the CPA and similar laws as it grounds the notice and choice principle in the privacy expectations of consumers and enables companies to compete on better privacy for consumers.
