Senator Josh Hawley
(R-Missouri) is introducing a privacy law that would require online companies to honor do-not-track requests.
The proposed Do Not Track Act would also prohibit web companies from collecting more data than they need to
operate their services.
Hawley's bill would prohibit “first parties” -- meaning sites users intentionally visit, like Amazon or Google's search engine -- from collecting or sharing
data for ad targeting when they encounter users who have activated do-not-track.
“Third parties,” including ad-tech companies, would be forbidden from collecting data from
users who have activated do-not-track, with a narrow exception for analytics. The measure would also prohibit companies from discriminating against people who reject tracking.
Hawley's
proposed Do Not Track Act would task the Federal Trade Commission with implementing a system “to protect consumers from unwanted online data harvesting and targeted advertising.” That
agency would be required to offer downloadable software that would send do-not-track instructions to sites users visit.
“The FTC has endorsed this approach in the past, but it was
voluntary,” Hawley said Tuesday during a Senate Judiciary Committee hearing on digital advertising, privacy and competition policy. “The dominant platforms ended up not agreeing to comply
with it, so I think we should make it compulsory.”
The FTC expressed approval for the do-not-track concept in 2010. Soon after, the major browser developers began offering do-not-track
settings, which signal that consumers don't want to be tracked for ad purposes. But those settings -- which don't actually prevent anyone from tracking users -- appear to be widely ignored by online
publishers and ad-tech companies.
One major reason why the headers didn't gain more traction is that tech companies, the ad industry and privacy advocates disagreed about how to interpret the signals.
The internet
standards group World Wide Web Consortium spent years trying to forge a consensus on that point between privacy advocates, computer scientists and industry representatives, but the process was
extremely contentious. The group repeatedly changed leadership, and saw high-profile defections by some privacy advocates as well as the self-regulatory trade organization Digital Advertising
Alliance.
Hawley's new proposal comes as lawmakers are increasingly focusing on data collection and sharing by tech companies. In the last two months, at least three separate pieces of
potential privacy legislation have been introduced in Congress.
One of those bills, introduced in April by Sen. Ed Markey (D-Massachusetts), would require companies to obtain people's opt-in
consent before collecting or sharing their personal information. That measure would also prohibit companies from using data to discriminate based on factors like race, religion and gender.
Another proposed bill unveiled in April, the Algorithmic Accountability Act, introduced by Sens. Ron Wyden (D-Oregon), Cory Booker (D-N.J.) and Rep. Yvette D. Clarke (D-N.Y.), would require
companies to study whether their algorithms pose risks to privacy, as well as whether they may result in inaccurate, unfair or discriminatory decisions.
A third, introduced by Sens. Mark
Warner (D-Virginia) and Deb Fischer (R-Nebraska), aims to prevent companies from duping people into consenting to data collection
Late last year, Wyden also unveiled a draft bill that
would create a “do not track” regime. That measure would task the Federal Trade Commission with creating a national opt-out website, and establishing an opt-out system.