Lawmakers consider clampdown on the way Internet marketers collect personal data to target ads

Congress weighs landmark change in Web ad privacy

WASHINGTON — The Web sites we visit, the online links we click, the search queries we conduct, the products we put in virtual shopping carts, the personal details we reveal on social networking pages — all of this can give companies insight into what Internet ads we might be interested in seeing.

But privacy watchdogs warn that too many people have no idea that Internet marketers are tracking their online habits and then mining that data to serve up targeted pitches — a practice known as behavioral advertising.

So Congress could be stepping in. Rep. Rick Boucher, D-Va., chairman of the House Energy and Commerce Subcommittee on Communications, Technology and the Internet, is drafting a bill that would impose broad new rules on Web sites and advertisers. His goal: to ensure that consumers know what information is being collected about them on the Web and how it is being used, and to give them control over that information.

While Congress has waded into Internet privacy issues before, this measure could break new ground, as the first major attempt to regulate a nascent but fast-growing industry that represents the future of advertising. Boucher insists his bill will benefit consumers and preserve the underlying economics of the Internet, which relies on advertising to keep so much online content free.

“Our goal is not to hinder online advertising,” he said. “This will make people more likely to trust electronic commerce and the Internet.”

Although his proposal is still taking shape, Boucher is confident lawmakers will pass an online marketing privacy law of some sort. He is working with Cliff Stearns of Florida, the top Republican on the Internet subcommittee, as well as Rep. Bobby Rush, D-Ill., who chairs a separate subcommittee on consumer protection.

Already, Washington’s interest in Internet marketing has put online advertisers on notice. In July, the industry released a set of self-regulatory principles in an effort to head off concerns in Congress and the Federal Trade Commission. The FTC put out Internet ad guidelines early this year.

Boucher’s efforts have encouraged privacy activists, who point out that Internet surveillance has evolved beyond just data-tracking files, known as cookies, that Web sites place on visitors’ computers. Technologies such as “deep packet inspection” can now monitor a user’s every online move.

“Consumers have no idea that they are being followed online and that their information is being compiled into invisible digital dossiers,” said Jeffrey Chester, executive director of the Center for Digital Democracy, one of 10 privacy groups that recently issued recommendations for lawmakers. “There is an incredibly sophisticated, ever-advancing system for profiling online users.”

Chester believes several developments have put the issue on Washington’s radar. Those include the rise of social networking sites that capture detailed personal information, like Facebook and MySpace; Google Inc.’s acquisition of the Internet ad service DoubleClick Inc.; and the proposed Internet search partnership between Microsoft Corp. and Yahoo Inc., now under review by the Justice Department.

“Online privacy has finally taken off and become a serious political issue,” Chester said. “A perfect digital storm has created momentum toward action.”

The challenge facing Washington, said Federal Trade Commission Chairman Jon Leibowitz, is to strike the right balance between “protecting the fundamental rights of consumers” and preserving “business equilibrium.”

Boucher’s bill will seek a middle ground in a long-running debate over what the default assumptions should be when companies monitor consumers’ online interests.

On one side, privacy watchdogs say Web sites should be required to obtain user permission — that is, people would “opt in” — before collecting most data.

On the other side, Web sites and advertisers insist such a mandate would overwhelm consumers with privacy notices. The companies argue that it is more practical to simply allow people who do not want to be tracked to “opt out” of data collection.

Boucher expects to set different rules for different types of sites. Sites that collect visitor information in order to target advertising on their own pages, for instance, would have to offer consumers a chance to opt out of having their interests tracked. These sites would also be required to prominently disclose what information they collect and provide a detailed description of how that information is used.

Web sites that deal with sensitive personal information, such as medical and financial data, sexual orientation, Social Security numbers and other ID numbers, would have to ask users to opt in to being tracked.

Boucher’s bill would not be the first significant online privacy law. In 1986, Congress passed the Electronic Communications Privacy Act, which placed privacy obligations on companies and organizations that offer e-mail services. The Children’s Online Privacy Protection Act of 1998 requires commercial Web sites targeted at children under age 13 to obtain parental consent before collecting personally identifiable information.

But the current bill would mark the first significant attempt by Congress to regulate Internet advertising. Marc Rotenberg, executive director of the Electronic Privacy Information Center, said there had been little need for Congress to impose privacy protections on advertisers offline, since traditional media such as TV, radio and newspapers don’t enable marketers to profile individual consumers as easily as the Internet does.

Now, Rotenberg said, “privacy laws should be updated to reflect new business practices.”

It’s too soon to know whether Boucher’s final bill will go far enough to satisfy privacy activists. But they agree that a law would do much more than the self-regulatory principles released by the Interactive Advertising Bureau (IAB), the Association of National Advertisers (ANA) and three other advertising trade groups in July.

Among other things, those principles call for consumer education efforts and disclosure of behavioral advertising practices.

ANA Executive Vice President Dan Jaffe said self regulation is the best approach for managing an industry evolving as quickly as online advertising.

“Legislation would be too rigid because this is a moving target,” Jaffe said.

Mike Zaneis, IAB’s vice president of public policy, added that self regulation is effective since it is in advertisers’ interest to make sure consumers trust them.

“At the end of the day, the most important asset any online company has is a strong relationship with the consumer,” he said.

Yet that’s also why Chester insists that tougher rules from Congress would not cripple online advertising. Consumers might be more likely to favor Web sites that allow them to see and influence their personal data.

“It’s about treating consumers with respect,” said Joseph Turow, a professor at the University of Pennsylvania’s Annenberg School for Communication. “Companies keep saying they want to engage users. That means opening up and not sneaking behind someone’s back to draw up pictures of them. We need information reciprocity.”

Turow added that while he supports opt-in mandates as “the ultimate form of respect,” the debate over opt-in versus opt-out rules won’t matter “when people really have an opportunity to interact with their data.”

For now, privacy activists are pinning their hopes on lawmakers. Evan Hendricks, editor of the Privacy Times newsletter, believes Boucher’s bill will find bipartisan support in Congress.

“This stands a very realistic chance of passage,” he said. “Privacy is the kind of issue you can’t be against.”