A bipartisan privacy
bill introduced in the Senate on Tuesday would, for the first time, require ad networks to notify consumers about online data collection and allow them to opt out of anonymous behavioral
targeting.
The Commercial Privacy Bill of Rights, unveiled by
Sens. John Kerry (D-Mass.) and John McCain (R-Ariz.), also would require companies to obtain users' opt-in consent before collecting data that is both "personally identifiable" and "sensitive."
Personally identifiable information would include names, addresses, email addresses and phone numbers; sensitive data is defined as information that carries a significant risk of economic or physical
harm, or relates to a medical condition, health record or religious affiliation.
Reaction to the proposal was mixed.
Stuart Ingis, general counsel to the Direct Marketing Association, calls
the bill "unnecessary," but also says it largely allows current practices to continue. "We're not either for or against the law right now," he says. "There are provisions in here that are a lot more
palatable than what we've seen in other bills." Ingis adds that the bill's requirement of opt-out consent for behavioral advertising "recognizes that's the appropriate standard." Some consumer groups
have said that companies should seek users' explicit opt-in consent before tracking them in order to serve targeted ads.
At the same time, Ingis says, the measure could impose additional costs on
marketers and ad companies. Among other provisions, the bill would require companies that collect data to make someone available to address consumers' privacy complaints. Ingis points out that this
requirement goes far beyond current consumer protection laws, which don't require companies to address complaints about fundamentals like their products and services.
Another potential problem
for ad networks, says Ingis, is that the bill talks about a "robust" mechanism for opting out of behavioral targeting, but doesn't define the term. While the bill doesn't specifically authorize
creation of a universal do-not-track mechanism, a "robust" opt-out arguably could serve as the equivalent.
Some consumer advocates criticized the proposal for not going far enough. "A consumer
today is subject to real-time 'on the fly' targeting, where many discrete details about their lives are assembled and sold to the highest bidder via ad exchange auctions, even when they are using
their mobile phone or watching a video online," a coalition of groups said in a letter to Kerry and McCain. "We fear this bill could simply enshrine these practices, allowing the continued compilation
of vast digital dossiers that can negatively affect consumers in transactions involving their finances, health and families."
Groups signing the letter were representatives from Consumer
Watchdog, Center for Digital Democracy, Consumer Action, Privacy Rights Clearinghouse and Privacy Times. They also took issue with the bill's enforcement provisions. The current proposal would ban
private lawsuits and preempt state laws -- but the groups say users' ability to bring private lawsuits is "essential to ensure that privacy protections are enforced." The advocates also argue that
state legislation "has repeatedly been a model for improved protections on the federal level at a later time."
Not all privacy advocates were critical. Representatives from the Center for
Democracy & Technology said the bill "contains many strong elements" and marks "an important step toward the enactment of a comprehensive privacy law for this country."