• by Wendy Davis , Staff Writer @wendyndavis, April 13, 2011

The Kerry-McCain privacy bill, introduced in the Senate yesterday, would for the first time give consumers the right to opt out of behavioral targeting. While industry self-regulatory groups have long said that ad networks should let people opt out of ad targeting anyway, those standards are voluntary. The Commercial Privacy Bill of Rights, by contrast, would be mandatory. 

Yet it seems like the bill isn't drawing nearly as much attention for what it includes as for what it leaves out: The proposal doesn't specifically refer to a do-not-track mechanism that would allow users to opt out of all online tracking at once.

Given the bill's other provisions, however, that omission shouldn't be taken as a sign that lawmakers don't like the idea of a do-not-track mechanism.  

That's because proposals for what's now called "do-not-track" aren't proposals for a new concept, but for a technique to implement the principles that industry groups have endorsed for more than 10 years. The Kerry-McCain bill would require ad networks and other companies to adhere to those principles, but it's neutral on what technique they should use to do so. However, the bill talks about a "robust" opt-out. While that term isn't defined, it certainly seems as if adhering to a browser-based do-not-track mechanism would qualify. In recent weeks, Mozilla and Microsoft have added do-not-track features to the newest versions of their browsers, while Google has an extension that allows users to permanently opt out of behavioral targeting by companies that participate in the industry's self-regulatory program.  

What's more, a document circulated by Kerry's staff today hints that the bill doesn't include language about a universal do-not-track mechanism because the law is meant to cover a broader array of data collection techniques than those used by companies involved in behavioral targeting. "Microsoft, Google, and Mozilla deserve credit for stepping up to the plate with Do Not Track-type tools  for consumers," the document says. "However, none of these tools have garnered industry-wide adoption as of yet, and no advertising networks have publicly stated that they will adhere to browsers' unilateral 'Do Not Track' settings. Moreover, 'Do Not Track,' even if widely adopted in the behavioral advertising realm, only addresses a relatively narrow subset of all privacy risks, and does nothing to address other privacy issues such as cloud computing, social networking, mobile device sharing,  information collected or shared offline, or the free flow of data across international borders." 

Some observers also have said that the bill is industry-friendly because it would prohibit private lawsuits.  Even so, that doesn't mean that consumers will stop suing for privacy violations. Most of the lawsuits brought to date have hinged on the federal wiretap and computer fraud statutes. Those statutes -- which allow for private causes of action -- wouldn't be changed by either the Kerry-McCain bill or the Stearns bill, meaning that consumers still have plenty of legal support for new litigation.