The Kerry-McCain privacy bill, introduced in the Senate yesterday, would for the first time give consumers the right to opt out of behavioral targeting. While industry self-regulatory groups have
long said that ad networks should let people opt out of ad targeting anyway, those standards are voluntary. The Commercial Privacy Bill of Rights, by contrast, would be mandatory.
Yet it seems
like the bill isn't drawing nearly as much attention for what it includes as for what it leaves out: The proposal doesn't specifically refer to a do-not-track mechanism that would allow users
to opt out of all online tracking at once.
Given the bill's other provisions, however, that omission shouldn't be taken as a sign that lawmakers don't like the idea of a
do-not-track mechanism.
That's because proposals for what's now called "do-not-track" aren't proposals for a new concept, but for a technique to implement the
principles that industry groups have endorsed for more than 10 years. The Kerry-McCain bill would require ad networks and other companies to adhere to those principles, but it's neutral on what
technique they should use to do so. However, the bill talks about a "robust" opt-out. While that term isn't defined, it certainly seems as if adhering to a browser-based do-not-track
mechanism would qualify. In recent weeks, Mozilla and Microsoft have added do-not-track features to the newest versions of their browsers, while Google has an extension that allows users to
permanently opt out of behavioral targeting by companies that participate in the industry's self-regulatory program.
What's more, a document circulated by Kerry's staff
today hints that the bill doesn't include language about a universal do-not-track mechanism because the law is meant to cover a broader array of data collection techniques than those used by
companies involved in behavioral targeting. "Microsoft, Google, and Mozilla deserve credit for stepping up to the plate with Do Not Track-type tools for consumers," the document says.
"However, none of these tools have garnered industry-wide adoption as of yet, and no advertising networks have publicly stated that they will adhere to browsers' unilateral 'Do Not
Track' settings. Moreover, 'Do Not Track,' even if widely adopted in the behavioral advertising realm, only addresses a relatively narrow subset of all privacy risks, and does nothing to
address other privacy issues such as cloud computing, social networking, mobile device sharing, information collected or shared offline, or the free flow of data across international
borders."
Some observers also have said that the bill is industry-friendly because it would prohibit private lawsuits. Even so, that doesn't mean that consumers will stop
suing for privacy violations. Most of the lawsuits brought to date have hinged on the federal wiretap and computer fraud statutes. Those statutes -- which allow for private causes of action --
wouldn't be changed by either the Kerry-McCain bill or the Stearns bill, meaning that consumers still have plenty of legal support for new litigation.