• by Wendy Davis  @wendyndavis, May 4, 2010

As expected, Rep. Rick Boucher unveiled a draft of privacy legislation on Tuesday that would require online ad networks to obtain people's consent before using data about them.

While the measure in some ways imposes more stringent requirements than current self-regulatory guidelines, it nonetheless drew harsh criticism from some consumer advocates who said it didn't go far enough.

"The online ad industry has dodged a regulatory bullet here," Jeff Chester, executive director of the Center for Digital Democracy, said in a conference call with reporters. He added that the measure relied on a "failed notice-and-choice regime," which, he said, doesn't adequately protect users' privacy.

John Simpson of Consumer Watchdog went further: "To describe it as industry-friendly is a major understatement," he said.

The bill would require ad networks that track people and collect any information covered by the law for ad purposes to obtain users' consent. But the proposal says networks need only obtain opt-out consent if they provide prominent notice through an icon and also allow people to view and edit their profiles. (Some ad companies, including Google, Yahoo and BlueKai, already allow users to access and revise their profiles.) Otherwise, the ad networks must obtain opt-in consent.

The draft bill covers information that has long been considered "personally identifiable" -- such as names or addresses -- as well as information that has often been deemed "anonymous," such as IP addresses, pseudonyms and other "unique identifiers."

The draft bill also would require sites like Amazon to notify consumers about the on-site use of data about them and allow them to opt out. Amazon and many other companies currently do so, but no law presently mandates that.

In a major blow to privacy advocates, the measure would preempt state laws -- some of which have been extremely unfriendly to marketers. In Maine, for instance, lawmakers passed -- and then repealed -- a law that would have restricted collecting and sharing information about teens. Boucher's draft bill also would bar individuals from bringing private lawsuits.

Santa Clara University law professor Eric Goldman says those two clauses could spur industry groups to endorse the potential bill.

Indeed, Mike Zaneis, vice president of public policy at the Interactive Advertising Bureau, called those provisions "very positive."

At the same time, Zaneis also warned that the proposal had some language that could result in "unintended consequences" for advertisers. For instance, he said, marketers that serve ads themselves across a variety of sites and cap the number of times an ad is shown could be considered "ad networks" under the bill's definition of the term.

Boucher's proposal also would require companies to obtain users' explicit consent before disclosing sensitive information, defined as medical records, race or ethnicity, religious beliefs, sexual orientation, financial records and precise geolocation information.

Some consumer advocates criticized that definition of sensitive as too limited. For instance, they argue that sensitive information should encompass a range of health-related data and not just official medical records.

A further provision in the draft bill would prohibit ad networks from re-selling data about consumers without their opt-in consent.

For now Boucher is only seeking comment on the draft, which hasn't yet been introduced into Congress.

"This is the beginning of the process," Zaneis says. "It's a hard bill to write and a hard bill to understand. There are going to be a lot of question marks."