Search for: All records

Children’s and adolescents’ online data privacy are regulated by laws such as the Children’s Online Privacy Protection Act (COPPA) and the California Consumer Privacy Act (CCPA). Online services that are directed towards general audiences (i.e., including children, adolescents, and adults) must comply with these laws. In this paper, first, we present DiffAudit, a platform-agnostic privacy auditing methodology for general audience services. DiffAudit performs differential analysis of network traffic data flows to compare data processing practices (i) between child, adolescent, and adult users and (ii) before and after consent is given and user age is disclosed. We also present a data type classification method that utilizes GPT-4 and our data type ontology based on COPPA and CCPA, allowing us to identify considerably more data types than prior work. Second, we apply DiffAudit to a set of popular general audience mobile and web services and observe a rich set of behaviors extracted from over 440K outgoing requests, containing 3,968 unique data types we extracted and classified. We reveal problematic data processing practices prior to consent and age disclosure, lack of differentiation between age-specific data flows, inconsistent privacy policy disclosures, and sharing of linkable data with third parties, including advertising and tracking services. 

Disagreements over peering fees have risen to the level of potential government regulation. ISPs assert that content providers should pay them based on the volume of downstream traffic. Transit providers and content providers assert that consumers have already paid ISPs to transmit the content they request and that peering agreements should be settlement-free. Our goal is to determine the fair payment between an ISP and an interconnecting network. We consider fair cost sharing between two Tier-1 ISPs, and derive the peering fee that equalizes their net backbone transportation costs. We then consider fair cost sharing between an ISP and a transit provider. We derive the peering fee that equalizes their net backbone transportation costs, and illustrate how it depends on the traffic ratio and the amount of localization of that content. Finally, we consider the fair peering fee between an ISP and a content provider. We derive the peering fee that results in the same net cost to the ISP, and illustrate how the peering fee depends on the number of interconnection points and the amount of localization of that content. We dispense with the ISP argument that it should be paid regardless of the amount of localization of content. 

Disagreements between Internet Service Providers (ISPs) and content providers over peering fees have risen to the level of potential government regulation. ISPs assert that content providers should pay peering fees based on the volume of downstream traffic. Content providers assert that consumers pay ISPs to transmit the content they request, and thus peering agreements should be settlement-free. We determine the fair peering fee between an ISP and a transit provider or content provider. We first consider cost sharing between an ISP and a transit provider. We derive the peering fee that equalizes their net backbone transportation costs. We illustrate how the peering fee depends on the traffic ratio and the amount of localization of that content. We then derive the peering fee between an ISP and a content provider that results in the same net cost to the ISP, and illustrate how the peering fee depends on the number of interconnection points and the amount of localization. We use these results to dispense with the ISP argument that they should be paid regardless of the amount of localization of content. 

We compare the notice and consent requirements of the three recent privacy regulations that are most likely to serve as the starting points for the creation of a comprehensive consumer privacy bill in the United States: the European General Data Protection Regulation, the California Consumer Privacy Act/California Privacy Rights Act, and the Federal Communications Commission’s Broadband Privacy Order. We compare the scope of personal information under each regulation, including the test for identifiability and exclusions for de-identified information, and identify problems with their treatment of de-identified information and of pseudonymous information. We compare notice requirements, including the level of required detail and the resulting ability of consumers to understand the use and flow of their personal information, and identify deficiencies with consumers’ ability to track the flow of their personal information. Finally, we compare consumer choices under each regulation, including when a consumer must agree to the use of their personal information in order to utilize a service or application, and find that none of the regulations take full advantage of the range of options, and thereby fail to disincentive tracking. 

Large Internet Service Providers (ISPs) often require that peers meet certain requirements to be eligible for free-settlement peering. The conventional wisdom is that these requirements are related to the perception of roughly equal value from the peering arrangement, but the academic literature has not yet established such a relationship. The focus of this paper is to relate the settlement-free peering requirements between two large ISPs and understand the degree to which the settlement-free peering requirements between them should apply to the peering between large ISPs and content providers. We analyze settlement-free peering requirements about the number and location of interconnection points (IXPs). Large ISPs often require interconnection at a minimum of 6 to 8 interconnection points. We find that the ISP’s traffic-sensitive cost is decreasing and convex with the number of interconnection points. We also observe that there may be little value in requiring interconnection at more than 8 IXPs. We then analyze the interconnection between a large content provider and an ISP. We show that it is rational for an ISP to agree to settlement-free peering if the content provider agrees to interconnect at a specified minimum number of interconnection points and to deliver a specified minimum proportion of traffic locally. 

Debates over paid peering and usage fees have expanded from the United States to Europe and South Korea. ISPs argue that content providers should pay fees based on the amount of downstream traffic they generate. In contrast, content providers contend that customers already pay ISPs for delivering the content they request, and therefore that peering agreements should be settlement-free. The issue has arisen in debates in the United States, Europe, and South Korea over net neutrality, universal service, and infrastructure funding. Regulatory entities are considering whether to regulate peering prices and/or impose usage fees. A key part of the debate concerns whether the market determines the socially beneficial peering price, and if not, how much of a difference there is between the socially beneficial peering price and the market-determined peering price. Our objective here is to understand the range from a cost-based peering price to a profit-maximizing peering price. First, we determine an ISP’s cost for directly peering with a content provider, by analyzing the incremental cost for transporting the content provider’s traffic when it directly peers with the ISP versus when it sends its traffic through a transit provider. We find that this cost-based peering price is positive if there is little localization of content, but it is zero (i.e., settlement-free peering) if there is sufficient localization of content. We also find that the required amount of localization varies with the number of interconnection points. Next, we determine the peering price that maximizes an ISP’s profit using a two-sided market model in which a profit-maximizing ISP determines broadband prices and the peering price, and in which content providers determine their service prices based on the peering price. We find that the profit-maximizing peering price decreases with content localization. These prices establish a range if the peering price is unregulated, from the cost-based peering price (at the low end) to the profit-maximizing peering price (at the high end). Regulatory oversight of peering prices may be warranted when there is a substantial difference between cost-based and profit-maximizing prices. 

Peering between two networks may be either settlement-free or paid. In order to qualify for settlement-free peering, large Internet Service Providers (ISPs) require that peers meet certain requirements. However, the academic literature has not yet shown the relationship between these settlement-free peering requirements and the value to each interconnecting network. We develop two models to analyze the value to each network from the most common and important requirements in the United States. Large ISPs in the U.S. often require potential settlement-free peers to interconnect at a minimum of 6-8 locations. We find that there is a substantial benefit from this requirement to the ISP, but little incremental benefit from a larger number of interconnection points. Large ISPs often require that the ratio of incoming traffic to outgoing traffic remain below approximately 2:1. In the case of two interconnecting ISPs, we find that this requirement ensures a roughly equal exchange of value. We also show that it is rational for an ISP to agree to settlement-free peering if the content provider agrees to interconnect at a specified minimum number of interconnection points and to deliver a specified minimum proportion of traffic locally, but a limit on the traffic ratio is irrational.