• by Wendy Davis  @wendyndavis, June 18, 2009

Influential lawmaker Rep. Rick Boucher (D-Va.) said Thursday that he plans to introduce legislation that will require Web companies to obtain consumers' opt-in consent before sharing information about users with third parties.

"I believe consumers are entitled to some baseline protections in the online space," Boucher, chair of the House Subcommittee on Telecommunications and the Internet, said at a hearing Thursday about behavioral advertising and privacy. The hearing was conducted by two House subcommittees -- the one chaired by Boucher as well as the one on Commerce, Trade, and Consumer Protection.

Like many of the other lawmakers to speak Thursday morning, Boucher stressed the importance of clearly informing users about data collection practices and obtaining people's consent. At the same time, Boucher said he's a fan of online ad targeting. "I am a supporter and beneficiary of targeted advertising," he said. "I would much prefer to receive Internet advertisements that are relevant to my interests."

Boucher specifically proposed that Web companies should notify consumers about online data collection and give them the chance to opt out of "first party use of the information and for its use by third parties or subsidiaries who are part of the company's normal first party marketing operations, or without whom the company could not provide its service."

He said that consumers should opt in before the information is used by "third parties for those parties' own marketing purposes."

But there appears to be much room for debate about what the types of third parties would be considered part of a site's "normal first party marketing operations."

Boucher himself said that those distinctions were not ironclad, and solicited opinions on whether he had "suggested a workable line between opt-in and opt-out consent."

Not all lawmakers sounded enthusiastic about legislation. "We want to do no harm here," Rep. Cliff Stearns (R-Fla.) said. "Overreaching privacy regulation could have a significant negative economic impact at a time when many businesses in our economy are struggling."

Rep. Joe Barton (R-Texas) also said he favored industry self-regulation. At the same time, he sounded a critical note about current practices, saying he "hits the delete button" every few days to erase cookies. "The information about myself is mine," he said. "Unless I choose to share it, I would just as soon it stay as my information only."

Executives from Google, Yahoo and Facebook were among those who testified at the hearing. Yahoo's Anne Toth, vice president of policy and head of privacy, touted the benefits of behavioral targeting in her written remarks. "Yahoo might deliver ads about travel deals if a user has recently researched vacation destinations for their summer family getaway," she said in her statement. "Put simply, customized advertising helps consumers save time and energy since they are more likely to find what they are looking for when we've anticipated what they are most interested in."

Google's deputy general counsel Nicole Wong said in her written testimony that the company supports "a comprehensive federal privacy law," as opposed to a law that would regulate only online behavioral targeting.

"We believe that as information flows increase and more and more information is processed and stored -- on remote servers rather than on users' or businesses' own computers -- there is a greater need for uniform data safeguards, data breach notification procedures, and stronger procedural protections covering government and third-party litigant access to individuals' information."

Facebook's chief privacy officer Chris Kelly said the company "learned many lessons about the importance of user education and extensive control" from its launch of Beacon in November of 2007. The ill-fated program told Facebook members about their friends' off-site e-commerce activity.

When Facebook launched the program, it operated by default, meaning that purchase information was shared unless people opted out. Some users didn't see the opt-out notices and were later surprised to discover that information about their purchases was shared with all of their Facebook friends. Facebook later revised the program so that it wouldn't operate without users' explicit consent.

Privacy advocate Jeff Chester, executive director of the Center for Digital Democracy, urged Congress to enact new laws. "Industry self-regulation, it is clear, has failed to offer meaningful protections to consumer privacy," he said in his prepared statement.