• by Wendy Davis  @wendyndavis, April 12, 2011

A bipartisan privacy bill introduced in the Senate on Tuesday would, for the first time, require ad networks to notify consumers about online data collection and allow them to opt out of anonymous behavioral targeting. 

The Commercial Privacy Bill of Rights, unveiled by Sens. John Kerry (D-Mass.) and John McCain (R-Ariz.), also would require companies to obtain users' opt-in consent before collecting data that is both "personally identifiable" and "sensitive." Personally identifiable information would include names, addresses, email addresses and phone numbers; sensitive data is defined as information that carries a significant risk of economic or physical harm, or relates to a medical condition, health record or religious affiliation.

Reaction to the proposal was mixed.

Stuart Ingis, general counsel to the Direct Marketing Association, calls the bill "unnecessary," but also says it largely allows current practices to continue. "We're not either for or against the law right now," he says. "There are provisions in here that are a lot more palatable than what we've seen in other bills." Ingis adds that the bill's requirement of opt-out consent for behavioral advertising "recognizes that's the appropriate standard." Some consumer groups have said that companies should seek users' explicit opt-in consent before tracking them in order to serve targeted ads.

At the same time, Ingis says, the measure could impose additional costs on marketers and ad companies. Among other provisions, the bill would require companies that collect data to make someone available to address consumers' privacy complaints. Ingis points out that this requirement goes far beyond current consumer protection laws, which don't require companies to address complaints about fundamentals like their products and services.

Another potential problem for ad networks, says Ingis, is that the bill talks about a "robust" mechanism for opting out of behavioral targeting, but doesn't define the term. While the bill doesn't specifically authorize creation of a universal do-not-track mechanism, a "robust" opt-out arguably could serve as the equivalent.

Some consumer advocates criticized the proposal for not going far enough. "A consumer today is subject to real-time 'on the fly' targeting, where many discrete details about their lives are assembled and sold to the highest bidder via ad exchange auctions, even when they are using their mobile phone or watching a video online," a coalition of groups said in a letter to Kerry and McCain. "We fear this bill could simply enshrine these practices, allowing the continued compilation of vast digital dossiers that can negatively affect consumers in transactions involving their finances, health and families."

Groups signing the letter were representatives from Consumer Watchdog, Center for Digital Democracy, Consumer Action, Privacy Rights Clearinghouse and Privacy Times. They also took issue with the bill's enforcement provisions. The current proposal would ban private lawsuits and preempt state laws -- but the groups say users' ability to bring private lawsuits is "essential to ensure that privacy protections are enforced." The advocates also argue that state legislation "has repeatedly been a model for improved protections on the federal level at a later time."

Not all privacy advocates were critical. Representatives from the Center for Democracy & Technology said the bill "contains many strong elements" and marks "an important step toward the enactment of a comprehensive privacy law for this country."