• by Wendy Davis , Staff Writer @wendyndavis, April 11, 2011

Tomorrow, Sens. John Kerry and John McCain will unveil the Commercial Privacy Bill of Rights Act of 2011, a measure that could potentially impose a host of new legal obligations on ad networks.

A draft of the bill unveiled last month would authorize the Federal Trade Commission to craft privacy regulations and operate a site where people could opt out of behavioral targeting. The draft bill also required companies to notify consumers about the collection of their data. Additionally, it appeared to require that companies allow people to opt out of having their data used by third parties like ad networks, at least in some circumstances.

While Kerry and McCain haven't yet introduced the final version of the measure, it's a safe bet that the bill will come in for criticism by industry groups, given that they tend to say any regulation is unnecessary and could prove economically damaging.

At the same time, some provisions that appeared in the earlier bill also appear likely to draw the ire of consumer groups. Among others, the bill contained a clause that would prohibit consumers from suing to enforce its terms.

Whatever else Kerry's measure contains, banning private lawsuits could be a boon to ad companies -- some of whom currently face class-actions for allegedly violating other federal laws. (While consumers would still be able to allege violations of old wiretap and computer fraud laws, they wouldn't be able to sue based on violations of the Kerry-McCain bill.)

In recent years, individual consumers have had a surprising amount of success in obtaining settlements from companies that allegedly used questionable data collection methods. Consider, two years ago researchers from University of California, Berkeley and other schools published a report outlining how Web companies can recreate deleted HTTP cookies with Flash cookies, circumventing consumers' attempts to avoid tracking. Various officials condemned the practice, but neither the FTC or Congress took action specifically aimed at regulating how companies use Flash cookies. Nonetheless, consumers sued and quickly obtained a $2.5 million settlement from Quantcast and Clearspring.

Meantime, the FTC is forging ahead with enforcement actions that could go a long way toward shaping the limits of data-sharing online. In March, the agency said it had settled a case with the ad network Chitika. That company promised users they could opt out of behavioral targeting, but set the opt-outs to expire after only 10 days. (Chitika said it did so by mistake.)

Also in March, the FTC unveiled a tentative settlement with Google for violating users' privacy with the launch of Buzz, which transformed people's Gmail contacts into social networking friends; in the process, Google revealed the identities of some users' email contacts in violation of its privacy policy.