March 18, 2011, NY Times
Considering how much information we entrust to the Internet every day, it is hard to believe there is no general law to protect people’s privacy online. Companies harvest data about people as they surf the Net, assemble it into detailed profiles and sell it to advertisers or others without ever asking permission.
So it is good to see a groundswell of support emerging for minimum standards of privacy, online and off. This week, the Obama administration called for legislation to protect consumers’ privacy. In the Senate, John Kerry is trying to draft a privacy bill of rights with the across-the-aisle support of John McCain.
Microsoft, which runs one of the biggest Internet advertising networks, said it supports a broad-based privacy law. It has just introduced a version of its Explorer browser that allows surfers to block some tools advertisers use to track consumers’ activities online.
It is crucial that lawmakers get this right. There is strong pressure from the advertising industry to water down rules aimed at limiting the data companies can collect and what they can do with it.
Most oppose a sensible proposal by the Federal Trade Commission for a do-not-track option — likely embedded in Web browsers. They have proposed self-regulation instead, and we applaud their desire to do that, but the zeal to self-regulate tends to wane when it is not backed by government rules and enforcement.
Senator Kerry has not yet proposed specific legislation, but he has laid out sound principles. Companies that track people’s activities online must obtain people’s consent first. They must specify what data they are collecting and how they will use it. They need consumers’ go-ahead to use data for any new purpose. They are responsible for the data’s integrity. And consumers should have the right to sever their relationship with data collectors and ask for their file to be deleted.
But there are potential areas of concern. Senator Kerry so far has not called for a do-not-track option. He would allow companies to write their own privacy plans and submit them to the F.T.C. for approval.
That would give companies flexibility to adapt their solutions as technology evolved, but it lacks the simplicity and universality of a do-not-track feature. It could yield a dizzying array of solutions that would confuse consumers about their rights and options and make it more difficult to enforce clear standards. Moreover, it would make it tougher for consumers to keep track of how their information is used and to whom it is sold.
Advertising firms still argue that privacy protections could undermine the free Internet, depriving it of ad revenue by reducing advertisers’ ability to target consumers. This is overstated. Advertisers will still need to advertise. If many people opt out of behavioral targeting, the firms will find other ways to do it.
Privacy protections are long overdue. We hope the swell of support will lead to significant legislation.