White House yanks 'YouTube' from privacy policy

Someone at the White House appears to be listening to those of us in the privacy community.

For the third time in just six days, the Obama administration has modified the White House Web site privacy policy in response to criticism from the blogosphere.

When the site launched on January 20, it exempted YouTube from federal anticookie tracking rules that would have otherwise cast a legal shadow over the use of embedded videos on the White House blog.

Reacting to criticism from the blogosphere, the White House first modified its Web site on Friday to limit the cookie exposure to only those users who clicked on videos. Then, on Sunday, the White House again tinkered with its privacy policy to scrub YouTube's name from the cookie exemption.

The original YouTube-specific exemption stated:

For videos that are visible on WhiteHouse.gov, a "persistent cookie" is set by third-party providers when you click to play the video.

This persistent cookie is used by YouTube to help maintain the integrity of video statistics. A waiver has been issued by the White House Counsel's office to allow for the use of this persistent cookie.

However, by Sunday evening, the exemption had been edited to remove all mention of YouTube:

For videos that are visible on WhiteHouse.gov, a "persistent cookie" is set by third-party providers when you click to play the video.

This persistent cookie is used by some third-party providers to help maintain the integrity of video statistics. A waiver has been issued by the White House Counsel's office to allow for the use of this persistent cookie.

The decision by the White House to revisit the cookie exemption does not come as a complete shock. The YouTube rule had in just a few short days generated both bad press and direct criticism from several public-interest groups.

It should be noted that this change is, for the most part, cosmetic. YouTube continues to be the only company whose video content is embedded within the White House Web site. Furthermore, the Google-owned video-sharing site is the only one that has received both official legal clearance from the White House Counsel and direct assistance by the White House tech staff (who embed the YouTube content) in planting tracking cookies within the Web browsers of millions of Americans.

Google CEO Eric Schmidt, who has advised President Obama and who personally donated $25,000 to the president's inauguration celebration (out of a total of $150,000 by six Google executives) must be rather pleased.

Still no transparency
In spite of Obama's much-publicized commitment to transparency, the White House has yet to actually provide a copy of the waiver (something this blogger has requested from White House officials informally, as well as via the Freedom of Information Act).

The text of the original privacy policy implied that a specific waiver had been issued for the cookies forced upon end users who intentionally viewed YouTube videos embedded within the White House Web site. The text now implies a far broader waiver for multiple video-sharing Web sites. However, it remains unclear if a new waiver has been issued, or if the old waiver was broad enough to cover multiple sites.

When I first wrote about the privacy policy text last week, I criticized the White House for providing YouTube with a specific exemption. At the time, I noted that no other company had received such special treatment.

The motivation of my criticism was to try to shame the White House staff into doing away with the exemption--as cookies are in no way required in order to serve online video. Instead of recognizing the need to protect consumer privacy, White House officials reacted by expanding the exemption to other companies.

In many ways, the current policy is actually worse than before: non-tech-savvy consumers now have no idea how many companies might be forcing their Web browser to accept tracking cookies. At least up until last week, visitors could take some comfort in the knowledge that only one company might be invading their privacy when they visited the White House Web site (and then only by a firm that had pledged to "do no evil"). Now, at least according to the White House's wide exemption, there could be many.

Last week, I said we should be reasonable and give the White House Web team a bit of time--after all, it is in a brand-new office, managing a new computer network, and scrambling to meet the demands of a very busy boss. However, if the team has had enough time to tinker with the privacy policy at least three times in the past six days, then it has more than enough time to post a copy of the waiver.

[pentest]

Big deal. Block third party cookies in your browser.

Could you please limit your use of nonsense buzzwords like "blogosphere"? Please?

[sexy_sofie]

people need to learn to use the flash player settings manager. furthermore, they need to learn what a local shared object is and manually find the hidden folder on their computer and delete them. adobe flash player plugin is NOT to be trusted. it is a security vulnerability and potential spyware. search for these terms and educate yourselves people, if you value your privacy.

[AndrewRich]

"cookies forced upon end users who intentionally viewed YouTube videos". Really? This is what you're worrying about?

[G-DC]

Dude, chill out over this topic. You're obsessed and it's just not necessary. Using persistent cookies is helpful to know what content is being accessed and how the White House Web site can be improved. It's 2009, not 1999. It's very easy to day to surf anonymously. Spend some time educating people how to surf anonymously if there's such an "outcry" and "outrage" over this beyond three or four bloggers.

Metrics govern a Web site and all of its pieces. I can't wait for the day with the federal government lifts its stupid rule on banning persistent cookies -- a rule that was put in place 10 years ago and it woefully outdated.

There are no privacy concerns. It's all hogwash. If you're a Web user and you're so overly concerned about your privacy, then a.) don't use the Web or b.) learn more about private browsing. I don't think most people avoid Facebook, NYTimes, ESPN or Amazon because they're going to pee their pants about privacy. The same should hold true for government sites.

[ask_observvideo]

Chris, you stated "...the Google-owned video-sharing site is the only one that has received both official legal clearance from the White House Counsel and direct assistance by the White House tech staff (who embed the YouTube content) in planting tracking cookies within the Web browsers of millions of Americans." Well sir, you need to check your facts a little more thoroughly. The White House has been posting in an authorized fashion to other video sharing sites prior to your blog posting. If you employed some simple searchign techniques, you will find videos exist on Vimeo.com (which are higher in quality than YouTube) and on other video sharing sites as well. Though they may not be embedded on whitehouse.gov per se, these videos do exist, from the white house, to other video sharing sites. I have often found that if this type of mistake occurs by a blog poster, there are many others as well. Lack of thorough reporting. Please be more thorough and accurate in your findings in the future. Thank you.