The first draft of new legislation for online ads pleases neither ad men nor privacy groups.
As concern over Internet advertising and data collection grows, privacy advocates and the Internet advertising industry have been sharpening their legal knives for more than a year. Now two Congressmen have finally given them a piece of legislation they're all too happy to slice apart.
Rick Boucher, D-Va., and Cliff Stearns, R-Fla., released a draft Tuesday of a privacy bill aimed at defining broad new regulations for the data collection practices of online advertising. The bill would require sites to offer easier methods of letting users prevent their behavior from being tracked online, warn users about data collection with a symbol on Web pages and require sites to render anonymous any data they collect after 18 months.
But while those new safeguards are enough to raise hackles in the advertising industry, irate privacy groups say they fall short of their demands, and even represent a deterioration of current privacy protections. "This is very flawed legislation," Jeffrey Chester, president of the Center for Digital Democracy, told reporters on a conference call. "The bill is going to have to be radically revised, or it will face significant opposition from consumer and privacy groups and their supporters."
One of the key battles in online privacy has been over the question of "opt-out" vs. "opt-in": Should users have to agree to have their online behavior data collected, or should sites legally be allowed to track their behavior by default, with an option to stop that collection upon request?
Boucher's and Stearns' bill offers just enough of each approach to please neither advertisers nor privacy advocates. For sensitive data such as telephone numbers, postal and e-mail addresses, social security numbers or financial data, a site would have to explicitly request a user's permission to track and store the information. For tracking of users' paths around the Web for what the bill calls "transactional" or "operational" purposes, sites would be allowed to collect data on users' behaviors without their permission, though they would be required to overtly state on their site with a "seal or symbol" that the page engages in behavioral tracking, and would have to allow the user to prevent that tracking upon request.
The bill also puts strict regulations on tracking users' behavior on mobile devices, an increasing concern as Web-friendly devices like Android phones and iPhones make handsets a new destination for ads. Location-based tracking on cellphones or other portable gadgets would fall under the more sensitive category of data that requires users to opt in before it can be collected.
To Mike Zanneis, vice president of public policy at the Internet Advertising Bureau, the new safeguards sound ill-defined and potentially dangerous to the $23 billion online ad industry. "Opt-in is really the most burdensome privacy restriction that we implement in the U.S.," Zanneis says.
He argues that the data requiring opt-in measures defined by the bill in its current form could include not just names and addresses but also IP addresses and "cookie" files that sites download to a user's browser to note his or her path on the Web. "We know that greater than 70% of all online advertising depends on targeting techniques," he says. "If we have an opt-in standard for cookies, that would impact the vast majority of online advertising, and that's what we want to avoid."
Meanwhile, privacy advocates argue that the bill's exemption for "operational" collection of data--allowing those practices to take place under an "opt-out" rule--gives advertisers far too much leeway. "This bill really adopts an archaic and bankrupt 'notice and consent' regime that we all know doesn't' work," says John Simpson, head of the Google Privacy and Accountability project at Consumer Watchdog.
