• by Wendy Davis  @wendyndavis, September 13, 2022

Congress should consider passing “comprehensive” online privacy legislation that would give consumers new protections, a federal agency said Tuesday.

“By enacting comprehensive legislative changes, Congress can help address long-standing challenges and create a framework that will address changing risks,” the nonpartisan Government Accountability Office said in its new report titled "Consumer Data: Increasing Use Poses Risks to Privacy."

“Businesses collect, use, and sell consumer data for their commercial benefit, but consumers may be unaware of how their data are being collected and used,” the agency wrote. “Consumers generally do not have the ability to stop the collection of their data, verify data accuracy, or maintain privacy.”

The accountability office flagged several areas of particular concern -- including “consumer scores,” which differ from more traditional credit scores.

The agency says that consumer scores are generally used to predict people's behavior, but adds that the “full range of consumer scores and their uses is unknown, creating a variety of potential risks.”

One risk, according to the accountability office, is that businesses may use those scores “to maximize their aims and treat consumers differently,” which could result in consumers being treated unfairly.

“No federal law expressly governs the creation, sale, and use of consumer scores, and gaps may remain in federal consumer protections,” the report says. “We recommended that Congress consider ways to determine and implement appropriate consumer protections for consumer scores beyond existing federal laws, such as allowing consumers to view and correct data and to be informed of score uses and their potential effects.”

The report looked at other potential privacy risks, including companies' ability to transfer internet users' data to other parties -- as famously happened when political consultancy Cambridge Analytica harvested data about millions of Facebook users.

“We recommended that Congress consider comprehensive legislation on internet privacy that would enhance consumer protections and include the oversight authorities agencies should have,” the agency wrote.

The report comes as Congress is weighing the American Data And Privacy Protection Act, which would broadly curb online data collection and use. Among other restrictions, the bill would prohibit companies from collecting or processing data about people's cross-site activity for ad purposes -- effectively preventing companies from serving ads to web users based on their browsing activity.

The House Energy and Commerce Committee advanced the bill by a 53-2 vote, but House Speaker Nancy Pelosi (D-California) recently suggested she won't support the bill because it would override much of California's privacy law.

Five states (Connecticut, California, Colorado, Virginia and Utah) recently passed privacy laws that allow consumers to reject online ad targeting, while a sixth, Maine, enacted a narrower law that requires broadband access providers to obtain consumers' opt-in consent before drawing on their web use for ad targeting.