Before the

U.S. DEPARTMENT OF COMMERCE

Washington, D.C. 20230

COMMENTS

OF

TIME WARNER INC.

ON

Arthur B. Sackler, Vice President Ronald L. Plesser

Law and Public Policy Emilio W. Cividanes

Time Warner Inc. Piper & Marbury L.L.P.

800 Connecticut Ave., N.W. 1200 Nineteenth St., N.W.

Suite 800 Washington, D.C. 20036

Washington, D.C. 20006 (202) 861-3900

(202) 457-9226

Of Counsel

Date: July 6, 1998

I. INTRODUCTION AND SUMMARY

Time Warner Inc. ("Time Warner") is pleased to respond to the Notice issued by the U.S. Department of Commerce ("DOC") requesting comments on various aspects of Internet privacy. These comments provide a sampling of the practices and purposes underlying the collection and use of personally identifying information ("PII") online by Time Warner websites. They also highlight self-regulatory efforts made by our sites and the company as a whole to address privacy issues of concern to consumers and policymakers, and out of our own sense of responsibility to users and their children.

Time Warner Inc. is the leading media and entertainment company, with four fundamental businesses: entertainment, cable networks, publishing and cable, including interests in filmed entertainment, television production, broadcasting, recorded music, music publishing, cable television programming, sports franchises, magazines, book publishing and cable television systems. Time Warner is also one of the world’s largest providers of content in some of the most popular sites online, with about 125 million page views in the aggregate every week. And we, along with the rest of the cyber world, are growing at a rapid rate. For example, the Time Warner Order Center has recently experienced more than a 100% growth in its online sales.

We believe that an informed consumer is best positioned to protect his or her own privacy interests online. Time Warner has made extensive efforts to ensure that users of its websites are offered the opportunity to become very well-informed indeed about our information policies and practices. However, we recognize that consumer education and outreach can only be a part of a comprehensive program to protect the privacy of consumers and, particularly, children online. That is why we support the strong efforts in the business community to develop a system of effective self-regulation. Time Warner is a member of both the Direct Marketing Association ("DMA") and the Online Privacy Alliance ("OPA"), and endorses the programs that both have in development.

Effective self-regulation implies by definition a voluntary commitment to appropriate privacy protection principles. It also implies flexibility in adapting such principles to the particular business and/or technology involved. This fairly nimble approach offers the best possibility to protect privacy without unduly inhibiting innovation or electronic commerce. By contrast, we believe that government regulation in these areas of collection, disclosure or use of personal information could set the stage for a rigid set of rules that might well protect privacy, but at the expense of both innovation and commerce. The key distinction is voluntary buy-in to flexible application versus compulsory and unenthusiastic observance of inflexible rules. With the latter, we risk significant ossification of a most vibrant and promising industry sector. With the former, reconciling of the several imperatives at work here – privacy, innovation and commerce – can be much more effectively made, and a usable and useful balance created.

In our view, the Department of Commerce and other organs of the U.S. Government should continue to exercise the restraint they have demonstrated to date for just a bit longer, in order to permit the intense efforts by OPA, DMA and others to come to fruition.

The staff's draft paper entitled "Elements of Effective Self Regulation" reflects the concept of proportionality, which we commend. It acknowledges that the level of consumer access may vary from industry to industry in light of the nature of the information collected, the nature of the enterprise, and the ways in which the information is to be used. See Notice, 63 Fed. Reg. at 30,731. This concept, however, should apply to other privacy fundamentals, such as notice and awareness. Information and its collection and use are not monolithic, as DOC recognizes. It should not be pulled and tugged into a one-size-fits-all approach. There should be greater flexibility. Thus, we urge DOC to use the concept of proportionality in the rest of its "Elements."

Time Warner agrees with DMA that privacy protection measures should be commensurate to the harm that can arise from use of the information being protected. Information collected for marketing purposes generally does not rise to the level of information that "harms" consumers. Unlike, say, medical or financial information, the worst "harm" that normally results from the use of marketing information is the receipt of an unsolicited marketing communication. Elaborate and costly mechanisms, therefore, simply are not needed to address the legitimate privacy considerations raised by the collection and use of this information for marketing purposes. And information used solely to improve the attractiveness to consumers of products or the websites themselves, do not rise even to that minimal level.

To evaluate the ways in which a company has responded to privacy concerns, it is important to understand the nature of the information collected and the ways in which the information is used. We summarize below the information practices of Time Warner's websites and the benefits of their use of the information. We will then turn to the measures we have instituted to protect the privacy of our users and customers.

Time Warner supports over 200 sites and services. Virtually all of them permit consumers to visit without charge. Moreover, for nearly all the information and entertainment they make available, Time Warner websites do not require visitors to furnish personally identifying information ("PII") as a condition of access.

Indeed, of our more than 200 individual websites, relatively few collect PII from site visitors. Many of our websites do collect information from users that either is not personally identifiable, or is used only in the aggregate. This aggregate information helps us to determine the preferences of our consumers. Those preferences inform to a significant degree the changes we make to both our products and our websites, in order to increase the attractiveness of both. Some of our sites, however, occasionally do collect PII. This PII is used for limited purposes, such as online sales transactions, the publishing of letters to the editor or contests. Other websites collect PII through voluntary online surveys. For example, the Time Warner Order Center ("TWOC") which is a transaction system for fulfilling orders from Time Warner record label and merchandise sites, contains a survey that elicits PII used only to target future promotions and new product releases.

E-mail communications sent by our sites to individual users are generally optional newsletters or updates specifically requested by the user. Warner Bros. Records and Atlantic Records, for instance, provide users with the option of joining a mailing list of individuals who automatically receive information regarding new releases and online events.

PII is critical to marketing online. Most fundamentally, products cannot be delivered to a customer without that customer’s name and address. In addition, such information enables companies to determine individual product preferences. These preferences can be used by websites to ensure that consumers receive information only about products in which they would likely be interested.

Significant marketing research can be accomplished by using PII in the aggregate. For example, the Pathfinder site has occasionally conducted user surveys. The information is subsequently used in the aggregate for marketing research, audience research, and advertising research. Names are often collected in surveys to prevent the duplication of information.

Time Warner websites targeted at children under 13 do not collect PII, with the following very limited exceptions, all of which entail notification or parental consent -- or both -- first. These limited exceptions include contests or newsletters, where an e-mail address would be necessary to deliver a website newsletter requested by the child or to notify a child (s)he had won a contest. For example, Sports Illustrated for Kids ("SIFK") sponsors a popular program called "fantasy sports leagues." Because it is necessary in order for these leagues to function that they provide users with updates regarding team standings and player statistics, SIFK must obtain an e-mail address and name from the user entering the league.

In addition, the SIFK website collects PII so that SIFK can contact the parent of a child whose electronic submission has been selected for publication in S.I. for Kids magazine. An example is when SIFK conducted an online discussion entitled "Kids Debate: Do Skateboarders Still Rule?" SIFK asked children whether they had an opinion on this subject, provided an area for comment, and collected enough PII to enable the magazine to ask for parental permission to publish. This information is not otherwise used or kept.

PII is also important to making sites interactive and interesting to visitors. For example, it enables visitors to the Quest for Camelot movie site to create Quest for Camelot fantasy adventures starring themselves. The information collected to enable the creation of their personalized adventures is not retained by WB Online or used for any other purpose.

As illustrated by the examples above, Time Warner businesses use the minimal amount of PII collected from sites targeted to children under 13 for internal purposes only; they do not rent or otherwise share the information with third parties, including elsewhere within the company.

Finally, it should not be overlooked that the collection of PII can serve other important policy purposes. PII obviously would enable web operators to identify individuals who post information on bulletin boards and in chat areas. This benefits both website owners and consumers alike in that it allows website owners to identify users who post information that is illegal or violates specific rules, as well as not mistakenly or falsely accusing other users of improper conduct.

IV. TIME WARNER HAS IMPLEMENTED ADEQUATE
MEASURES TO PROTECT PERSONAL PRIVACY ONLINE

We have taken a number of significant steps to respect and protect the privacy interests of our users, including children.

First, again, few of Time Warner's websites collect PII. As reflected in the original version of the Fair Information Practices, and as recognized by the U.S. Privacy Protection Study Commission, privacy advocates, and others, limiting the information that is collected is a principal means of protecting personal privacy.

Second, our websites furnish individuals with notice of the information practices in effect at the sites. For example, our popular websites at Pathfinder and Warner Bros. Online ("WB Online") provide notice of their online collection practices and post their policies one click away from the home page, and have been doing so for some time. Indeed, the Electronic Privacy Information Center (EPIC) in 1997 recognized that Pathfinder was one of only two of the top five most frequently visited websites that posted a privacy notice.

In addition to furnishing general privacy notices easily accessible from the home page, the Time Warner sites provide specific privacy notices at the points of data collection. Some of our individual sites also provide supplemental notices to raise consumer awareness that disclosure of personal information in public forums could compromise consumer privacy. Pathfinder's Subscriber's and Member's Agreement advises that PII disclosed in online bulletin boards, chatrooms and other interactive areas can be collected and used by third parties. Such notice is primarily intended to make consumers aware that providing PII in public forums could have additional privacy implications. This is another example demonstrating the utility of consumer education in safeguarding privacy interests online.

Our websites targeted at children direct them to obtain parental consent before providing any PII. As in the limited circumstances described above, the SIFK website occasionally asks for some PII, but it is coupled with a notice made conspicuous by use of a contrasting background color and a different bolded typeface. The notice states:

WB Online and many of our other sites also prominently remind children to ask their parents for permission before signing up for a site's e-mail newsletter.

Third, Time Warner websites may collect PII when the consumer makes an affirmative decision to access additional website features or purchase additional services. For example, Pathfinder requires the collection of PII when a consumer is seeking access to additional features or services, such as the ability to post messages to bulletin boards. Consequently, Time Warner websites enable consumers to choose whether or not to access information or services that require the provision of PII.

Fourth, we limit the dissemination of PII collected at the websites. Time Warner businesses generally use the PII collected from websites targeted at adults or minors age 13 and over only for internal purposes; they do not rent or otherwise share the information with third parties, unless that use is disclosed at the point of data collection and an opportunity to opt out is provided by hyperlink.

Fifth, we ensure that the collected information is accurate for the purposes for which it is to be used and that it is protected from misuse. For example, to maintain the security of personal information collected from users, Pathfinder uses password protection as well as a transmission encryption system; it has a double firewall system. Other sites, such as WB Online, Warner Bros. Records, and Atlantic Records operate firewall-protected servers to ensure information security. Moreover, websites supporting sales transactions, like TWOC, typically use both firewall protected servers and password protection. TWOC was an early adopter of the Secure Electronic Transaction specification, which is a payment protocol developed by leading technology companies to secure credit card transactions over open networks such as the Internet. Indeed, none of the customers of TWOC or its predecessors have reported fraudulent use of a credit card as a result of purchases made on the site.

V. CONCLUSION

As electronic commerce continues to grow, Time Warner and other companies with heavily trafficked sites have taken the lead in implementing measures that protect personal privacy online, including the privacy of children. Time Warner endorses and supports the strong efforts in the business community to develop a system of effective self-regulation. We believe that effective self-regulation will best protect consumers in a global medium and strike the critical balance between legitimate privacy interests and the promising opportunities provided by the development of the Net.