Congress is set to hold yet another hearing Thursday on behavioral targeting and privacy, marking the second time this year -- and at least the fifth since last summer -- that federal lawmakers are
tackling the topic.
This week's hearing will focus on Web companies like Google, Yahoo and Facebook that target via cookies. In April, the spotlight was Internet service providers, who can
only target ads by employing deep packet inspection to determine which sites users are visiting.
Rep. Rick Boucher (D-Va.) is widely expected to introduce new privacy legislation soon, but
nothing is on the table as of today. Still, industry insiders are speculating that new legislation might require Web companies to obtain consumers' explicit opt-in consent before tracking them online
and serving targeted ads.
If Congress is leaning in that direction, it would mark a big shift in sentiment from last year, when some leading policymakers said that ISP-based targeting should
require opt-in consent, but that cookie-based targeting requires only opt-out consent.
It would mark a shift even from two months ago, when it appeared that Democrats were supporting opt-in
consent for ISP-based targeting but opt-out consent for cookie-based targeting. A Republican briefing memo prepared in advance of that hearing and obtained by MediaPost argued against that position:
"Internet privacy models that focus on a particular technology or corporate structure ... will merely insulate companies such as Google, Yahoo, and Microsoft from scrutiny while protecting their
dominance," states the April memo.
Yet, there are valid reasons to differentiate between ISP-based targeting and cookie-based targeting. First, Internet service providers have access to all
activity, including search queries and visits to non-commercial sites. Older companies only track people within a limited number of sites.
Additionally, users have a lot more control over
cookie-based targeting. People can set their browsers to reject certain cookies and also can delete cookies manually. Ad companies promise that they will allow people to opt out of ISP-based targeting
as well, but telling users they can opt out -- or rather, that they can ask ad companies to exclude them -- is very different from enabling users to take matters into their own hands by rejecting
cookies.