Web Privacy Bill Could Come by November

Privacy legislation affecting the online advertising industry could be submitted by November. According to statements made recently by Rep. Rick Boucher, who heads up the House Subcommittee on Communications, Technology and the Internet, a bill with bipartisan support could be introduced before Congress adjourns for its winter holiday break.

“We are making rapid progress and hope to have a bill introduced before recess,” Boucher said in an interview with beltway pub The Hill yesterday.

“The key elements [of the legislation] are going to be that every website will have to disclose every piece of information that they collect from visitors and how that information is used by the website that collects it. And then users should have control over that process,” added Boucher in the interview. Such information should be provided in “an easy-to-locate privacy policy,” suggested the Congressman in a separate article he wrote for the same publication, published last week.

The Virginia Democrat also suggested there could be restrictions on Web publishers’ ability to provide user data to third parties, though it’s unclear to what extent the possible law could affect relationships between publishers, ad networks, and third party tracking, targeting, and optimization firms. “[If] a website wants to provide information to an unrelated third party whose activities are not required for delivering ads by the information-collecting website to the person from whom it is collected, it should not be permitted to engage in that information-sharing unless the Internet user affirmatively opts in to that use.”

In his article, Boucher specifically mentioned deep packet inspection, a controversial technology that enables ISPs to track user interactions across the Web for ad targeting purposes. Although ISPs in the U.S. and U.K. have backed away from plans to enable DPI, Boucher stated that it would be acceptable for ISPs to use such technologies on an express consumer opt-in basis.

Earlier this year the House Subcommittee on Communications, Technology and the Internet met to discuss potential online privacy legislation. During that talk, Boucher indicated that legislation introduced in 2002 by the subcommittee’s Ranking Republican Cliff Stearns of Florida and co-sponsored by Boucher would “be the starting point and the foundation for our privacy bill this year.”

Although Congress has been overwhelmed with issues such as the economy and healthcare reform, Boucher’s article demonstrates he believes there is a need to keep online privacy legislation on the table this year. Still, the issue has not been considered recently at the full House Energy and Commerce Committee level.

Online advertising and other ad industry organizations such as the Network Advertising Initiative and the Interactive Advertising Bureau have put forth self-regulatory guidelines to encourage more transparency in online data collection and usage. The Federal Trade Commission also unveiled revised principles for behavioral advertising earlier this year. In his article, Boucher noted that the FTC would be granted regulatory authority to enforce the privacy principles he plans to submit.

He also stated the bill would “create a safe harbor for companies that participate in robust self-regulatory programs that have been approved by the Federal Trade Commission.” The FTC has signaled that industry self-regulatory efforts are not stringent enough and must require more prominent disclosure of data tracking and usage in or near ads themselves, outside privacy policies.

The NAI is “working on the mechanics and infrastructure that will go into providing more notice in and around ads,” said Chuck Curran, the organization’s executive director and general counsel. “How that plays out in the legislative context, it’s too early to tell,” continued Curran. The NAI’s membership is comprised of online ad networks.

Boucher pointed to existing programs that could be given safe harbor, such as models allowing users to opt-out of collection and disclosure of data by ad networks — something currently enabled by the NAI — and systems that let users view or modify their profiles, or opt-out of ad targeting based on that information. Companies including Google and Exelate, a firm that collects data for ad targeting, allow users to modify preferences, or opt-out of such targeting.