• by Wendy Davis  @wendyndavis, May 3, 2010

More than one year after announcing plans to introduce new privacy legislation, Rep. Rick Boucher (D-Va.) intends on Tuesday to unveil a draft of a new proposal to regulate online behavioral targeting.

Speaking at a meeting of the American Business Media on Monday, Boucher reportedly said the draft bill would require Web publishers, advertisers and other companies that collect data about people to notify them about the practice and obtain their consent.

The proposal also reportedly would require that publishers that collect data in order to serve ads on their own sites allow consumers to opt out of the targeting. Ad networks that track users across a variety of sites would have to obtain users' opt-in consent, unless the networks allow people to access and revise their profiles. (Some companies that serve targeted ads, like Google, Yahoo and BlueKai, already have this feature.)

Boucher has previously said that the bill also would include provisions requiring mobile phone users' consent before their location is shared.

Some portions of the proposal, at least as reported on Monday, appear particularly controversial. For instance, any requirements that publishers or other "first-parties" allow opt-outs of targeted ads on their own sites mark a departure from current self-regulatory standards as well as the Federal Trade Commission's guidelines.

Mike Zaneis, vice president of public policy for the Interactive Advertising Bureau, said the organization hopes that any proposals "would recognized a strong first-party carve out from behavioral advertising restrictions, just as the FTC's own principles and the cross industry principles do."

He adds that the IAB hopes that any proposal "will not be overly proscriptive, but rather allow industry the flexibility to innovate and discover new and more effective ways of providing consumer notice."

In general, industry guidelines and the FTC say that Web companies that track people as they surf the Web in order to serve them targeted ads should tell consumers about the practice and allow them to opt out. Tracking people within a single site for ad-serving purposes isn't usually seen as raising the same kinds of privacy concerns as tracking them across different sites.

Privacy advocates also likely won't be satisfied with the bill. Jeff Chester, executive director of the Center for Digital Democracy, criticized it for appearing to endorse the same basic notification and opt-out framework as current self-regulatory standards. "The notice-and-choice model doesn't work," Chester says.

Chester's group -- along with 10 other organizations including the Electronic Frontier Foundation, Consumers Union and the World Privacy Forum -- sent a letter to Congress on Monday urging it to enact sweeping online privacy protections. Among other proposals, the groups say that Web sites and ad networks should only be able to use data about consumers for 24 hours after collection unless they obtain users' opt-in consent.