More than one year
after announcing plans to introduce new privacy legislation, Rep. Rick Boucher (D-Va.) intends on Tuesday to unveil a draft of a new proposal to regulate online behavioral targeting.
Speaking at a meeting of the American Business Media on Monday, Boucher reportedly said the draft bill would
require Web publishers, advertisers and other companies that collect data about people to notify them about the practice and obtain their consent.
The proposal also reportedly would require that
publishers that collect data in order to serve ads on their own sites allow consumers to opt out of the targeting. Ad networks that track users across a variety of sites would have to obtain users'
opt-in consent, unless the networks allow people to access and revise their profiles. (Some companies that serve targeted ads, like Google, Yahoo and BlueKai, already have this feature.)
Boucher
has previously said that the bill also would include provisions requiring mobile phone users' consent before their location is shared.
Some portions of the proposal, at least as reported on
Monday, appear particularly controversial. For instance, any requirements that publishers or other "first-parties" allow opt-outs of targeted ads on their own sites mark a departure from current
self-regulatory standards as well as the Federal Trade Commission's guidelines.
Mike Zaneis, vice president of public policy for the Interactive Advertising Bureau, said the organization hopes
that any proposals "would recognized a strong first-party carve out from behavioral advertising restrictions, just as the FTC's own principles and the cross industry principles do."
He adds
that the IAB hopes that any proposal "will not be overly proscriptive, but rather allow industry the flexibility to innovate and discover new and more effective ways of providing consumer notice."
In general, industry guidelines and the FTC say that Web companies that track people as they surf the Web in order to serve them targeted ads should tell consumers about the practice and allow them to
opt out. Tracking people within a single site for ad-serving purposes isn't usually seen as raising the same kinds of privacy concerns as tracking them across different sites.
Privacy advocates
also likely won't be satisfied with the bill. Jeff Chester, executive director of the Center for Digital Democracy, criticized it for appearing to endorse the same basic notification and opt-out
framework as current self-regulatory standards. "The notice-and-choice model doesn't work," Chester says.
Chester's group -- along with 10 other organizations including the Electronic Frontier
Foundation, Consumers Union and the World Privacy Forum -- sent a letter to Congress on Monday urging it to enact sweeping online privacy protections. Among other proposals, the groups say that Web
sites and ad networks should only be able to use data about consumers for 24 hours after collection unless they obtain users' opt-in consent.