• by Wendy Davis  @wendyndavis, June 5, 2010

Potential privacy legislation being floated by Rep. Rick Boucher "would fundamentally change online information and online advertising practices to the detriment of consumers," the Interactive Advertising Bureau said Friday in written comments to lawmakers.

"We believe that self-regulation, which is inherently more flexible and better suited to govern a dynamic environment than legislation, is the best approach to help ensure that consumers receive transparency and choice online," the IAB wrote to Boucher, chairman of the House Energy and Commerce Committee, and Rep. Cliff Stearns, ranking member of the committee.

The IAB sent the letter in response to draft privacy legislation, circulated last month by Boucher, that would require ad networks that track people to obtain users' consent. The proposal specifically calls for opt-in consent unless companies notify consumers via an icon and also allow people to view and edit their profiles. (Some ad companies, including Google, Yahoo and BlueKai, already allow users to access and revise their profiles.)

The IAB objected to that idea, arguing that companies should be able to target users by default, without moving to a system that allows consumers to manage their profiles. "Requiring consumers to opt-in to transfers to third parties would drastically reduce the free flow of information that is the heart and soul of today's Internet offerings," the group writes.

The organization adds that even though a few companies now allow users to edit their targeting preferences, "it is too soon in the experimentation of these practices to codify managed preference profiles into federal legislation."

The IAB also took issue with several other terms in the draft bill. Among the most significant, Boucher's bill requires that consumers consent to the collection of information that has not traditionally been considered "personally identifiable," such as IP addresses or pseudonyms.

The IAB argues that collecting such data shouldn't require explicit consent. "The mere fact that information could identify a computer or device does not necessarily raise privacy issues," the group argues. "If such information becomes identifying information -- where it is actually tied to a person's name -- at that point it could be subject to the higher standard."

The IAB's letter, authored by vice-president for public policy Mike Zaneis, highlights the industry's recent self-regulatory efforts, including the guidelines issued last year by a coalition including itself, the American Association of Advertising Agencies, the Association of National Advertisers, the Direct Marketing Association, and the Council of Better Business Bureaus. Those guidelines generally call for companies to notify consumers about behavioral targeting and allow them to opt out.

Some consumer advocates also are not happy with the draft bill. In a letter to Boucher and Stearns, Consumer Reports publisher Consumers Union criticizes the proposal for relying too heavily on a notice-and-choice system. "Consumers Union hopes that as the legislation progresses, it will include other methods of privacy protection, such as principles addressing data collection minimization, data quality, purpose specification, extensive security safeguards, individual participation, and accountability," the group said in a letter to Boucher and Stearns.

A coalition of 10 advocacy organizations including the Center for Digital Democracy, Electronic Frontier Foundation and World Privacy Forum also weighed in. Those groups said they favored a system that would allow marketers to collect non-sensitive information by default, but would also require them to obtain explicit consent to keep the data for longer than 24 hours.

"We would also like to challenge the conventional wisdom that privacy legislation that is based on an opt-in approach is not feasible," they wrote to Boucher and Stearns. "It is ironic that while many in the business community profess to want to offer consumers real and meaningful control over the collection and use of their data, these same companies and associations are unwilling to provide the most effective means of control for consumers -- opt-in."

The watchdog groups also opposed a provision in Boucher's draft that would ban individual consumers from suing companies who violated the privacy standards. "The FTC does not have the resources to pursue all or even most privacy violations occurring on the Internet today," Consumers Union wrote. "Giving individuals a private right of action against companies who violate the law will have a greater deterrent effect and give individuals some control over the way their personal information is used."