Senator Josh Hawley (R-Missouri) is introducing a privacy law that would require online companies to honor do-not-track requests.
The proposed Do Not Track Act would also prohibit web companies from collecting more data than they need to operate their services.
Hawley's bill would prohibit “first parties” -- meaning sites users intentionally visit, like Amazon or Google's search engine -- from collecting or sharing data for ad targeting when they encounter users who have activated do-not-track.
“Third parties,” including ad-tech companies, would be forbidden from collecting data from users who have activated do-not-track, with a narrow exception for analytics. The measure would also prohibit companies from discriminating against people who reject tracking.
Hawley's proposed Do Not Track Act would task the Federal Trade Commission with implementing a system “to protect consumers from unwanted online data harvesting and targeted advertising.” That agency would be required to offer downloadable software that would send do-not-track instructions to sites users visit.
The FTC expressed approval for the do-not-track concept in 2010. Soon after, the major browser developers began offering do-not-track settings, which signal that consumers don't want to be tracked for ad purposes. But those settings -- which don't actually prevent anyone from tracking users -- appear to be widely ignored by online publishers and ad-tech companies.
One major reason why the headers didn't gain more traction is that tech companies, the ad industry and privacy advocates disagreed about how to interpret the signals.
The internet standards group World Wide Web Consortium spent years trying to forge a consensus on that point between privacy advocates, computer scientists and industry representatives, but the process was extremely contentious. The group repeatedly changed leadership, and saw high-profile defections by some privacy advocates as well as the self-regulatory trade organization Digital Advertising Alliance.
Hawley's new proposal comes as lawmakers are increasingly focusing on data collection and sharing by tech companies. In the last two months, at least three separate pieces of potential privacy legislation have been introduced in Congress.
One of those bills, introduced in April by Sen. Ed Markey (D-Massachusetts), would require companies to obtain people's opt-in consent before collecting or sharing their personal information. That measure would also prohibit companies from using data to discriminate based on factors like race, religion and gender.
Another proposed bill unveiled in April, the Algorithmic Accountability Act, introduced by Sens. Ron Wyden (D-Oregon), Cory Booker (D-N.J.) and Rep. Yvette D. Clarke (D-N.Y.), would require companies to study whether their algorithms pose risks to privacy, as well as whether they may result in inaccurate, unfair or discriminatory decisions.
A third, introduced by Sens. Mark Warner (D-Virginia) and Deb Fischer (R-Nebraska), aims to prevent companies from duping people into consenting to data collection
Late last year, Wyden also unveiled a draft bill that would create a “do not track” regime. That measure would task the Federal Trade Commission with creating a national opt-out website, and establishing an opt-out system.