• by Wendy Davis  @wendyndavis, March 21, 2008

Privacy advocates praise the bill's substance, saying that proposals to curb online data collection practices are long overdue. They also say the industry should be regulated on a national level. The Interactive Advertising Bureau (IAB), on the other hand, says the measure is unnecessary, would hurt online marketers and impede publishers' ability to offer free content online.

"Absent consumer harm, why are we rushing to regulate this space--a medium that has been nothing but kind to consumers and provides free content and services to them?" said Mike Zaneis, the Interactive Advertising Bureau's vice president for public policy.

Zaneis added that the IAB intends to lobby against the measure. "It's priority number one, and we will certainly reach out to the sponsor's office and try to work with them productively," he said.

But consumer advocates, who have pressed for tighter regulation of online marketing practices for several years, argue that legislation is overdue.

"The bill clearly reflects the glaring problem that the online advertising industry hasn't wanted to come clean with consumers about data collection practices," said Jeffrey Chester, founder and executive director of the Center for Digital Democracy.

Privacy advocates also are challenging the idea that data collection isn't in itself harmful. "The harm can be subtle, the harm can be cumulative over time--like mercury poisoning from eating tuna," said Pam Dixon, executive director of the World Privacy Forum.

The bill's sponsor, state Assemblyman Richard Brodsky, says he's aware of the online advertising industry's objections, but thinks people's privacy needs to be protected.

"There is a legitimate conflict here between the economic model that drives the Internet and legitimate privacy interests," he said. "I have no objection to targeted advertising or collection of data, as long as people have consented to it."

Brodsky argued that the existing scope of data collection poses a threat to consumers. "It seems to me that we're letting our expectations of what private matters are erode and deteriorate with not even a whimper across the board. This is '1984,' except Big Brother isn't the government--it's large corporations with an economic interest in your life and private behaviors."

Portions of the New York bill, currently in the state Assembly's consumer affairs and protection committee, closely track the Network Advertising Initiative's 7-year-old voluntary guidelines--with the key exception that the bill's requirements would be mandatory and offenders subject to fines of up to $3,000 per violation.

Big industry players including Microsoft's Atlas, Yahoo, AOL's Advertising.com, and Google's DoubleClick currently comply with the NAI's voluntary principles.

But Brodsky said voluntary standards aren't sufficient.

"Guidelines don't work," Brodsky said. "If there's a legitimate public policy, there should be legislation."

The measure would require that companies monitoring users' Web-surfing activity for marketing purposes--often via cookies that track online activity associated with specific computers--tell users about the practice and give them an opportunity to opt-out.

The bill requires that companies get people's affirmative consent before merging personally identifiable information--names, addresses, phone numbers--with tracking information collected anonymously. It also would forbid companies from using personally identifiable information about sensitive financial or medical data, sexual orientation or Social Security numbers for online marketing.

The measure was quietly introduced last year, but did not receive widespread attention until an article about it appeared Thursday in The New York Times. New York isn't the only state considering new laws. A bill pending in Connecticut would regulate ad networks, although that one isn't as far along in the legislative process.

While privacy advocates mostly praised the New York bill's concepts, some also said regulation of the Web should be national.

"We'd rather see a general privacy law at the federal level," said Ari Schwartz, deputy director of the Center for Democracy & Technology. "But it's not a surprise that we're seeing this at the state level, since the federal legislators have failed to act."

World Privacy Forum's Dixon also said federal legislation would make more sense. "There does need to be regulation and consumer protection in this space, but I would prefer to see strong, robust national legislation, because of the nature of the Internet," she said.

Marc Rotenberg, executive director of the Electronic Privacy Information Center, added that inaction at the federal level has spurred other states to pass privacy laws. "Washington has had a lot of difficulty moving significant privacy bills," he said. "It's not surprising at all that the states are proposing legislation."

Some past state efforts to regulate marketing have filtered up to Washington. For instance, the national do-not-call registry came about after states began passing their own laws.

But there's also the question of whether state laws regulating the Internet would be constitutional. Eric Goldman, director of the High Tech Law Institute at Santa Clara University School of Law, said courts have split on whether state laws regarding the Web violate the constitutional principle that states can't regulate interstate commerce. He said anti-spam laws have survived constitutional challenges, but a 2005 Utah law banning targeted advertising via adware was struck down.

The Center for Digital Democracy's Chester said he thinks the New York bill should go even further, requiring that companies obtain users' affirmative consent to online tracking. "We will work with the assemblyman to strengthen the bill and to move towards a framework for an opt-in."

Brodsky said the bill is still evolving, and the final proposal could require that online ad companies obtain people's opt-in consent. It also might be tweaked to define IP addresses as personally identifiable information.