On May 4, Representatives Rick Boucher (D-Va.) and Cliff Stearns (R-Fl.) of the House Subcommittee on Communications, Technology, and the Internet published a discussion draft of long-anticipated privacy legislation that would restrict companies’ online collection and use of personal information and online activity, including use for the purpose of targeted online advertising. Here are some observations about the draft bill, in its current form:
- In a few specific circumstances, the bill would permit the use of web site user information for the purposes of marketing, advertising, or selling only with express opt-in consent. This includes (1) when the web site wishes to disclose the information to unaffiliated third parties, such as advertisement networks, unless certain requirements are met (see the next bullet); (2) when the web site collects or discloses any “sensitive information,” which is defined as medical records or history, race, ethnicity, religious beliefs, sexual orientation, financial records or other information associated with a financial account, or geolocation information; or (3) when the web site collects or discloses “all or substantially all of an individual’s online activity.”
- Nevertheless, the bill would provide an exception permitting a web site to share user information with unaffiliated third parties for the purposes of marketing, advertising, or selling without express opt-in consent if it: (1) provides users with a “readily accessible” opt-out mechanism; (2) deletes or renders anonymous any “covered information” within 18 months after it is first collected; (3) allows users to review and modify, or completely opt out of having, any profiles maintained about their preferences by web sites or their advertisement network partners for marketing purposes (these so-called “preference profiles” must be accessible through a hyperlinked “symbol or seal” on the web site and on or near any advertisement served based on the profile); and (4) prohibits advertisement networks from further disclosing any such information they receive. This would seem to almost directly endorse the use of the online behavioral privacy icon put forth by groups supporting industry self-regulation of behavioral advertising.
- The term “covered information” would include a number of individual data elements – such as name, e-mail address, and Social Security number – that might otherwise be considered personally identifiable information under other statutory or regulatory regimes (at least in combination with other data elements). In addition to the novel development of regulating the collection of these data elements individually, the bill includes in its definition of covered information:
"Any unique persistent identifier, such as a customer number, unique pseudonym or user alias, Internet Protocol address, or other unique identifier, where such identifier is used to collect, store, or identify information about a specific individual or a computer, device, or software application owned or used by a particular user or that is otherwise associated with a particular user."
Adopting this definition would be significant because no American privacy law has ever considered an anonymous identifier or IP address to be legally protected information (though IP addresses areconsidered to be personally identifiable in the EU and FTC Chairman Jon Leibowitz commented just a couple weeks ago that he believes that IP addresses should be considered personal information). Additionally, this definition means that the bill would apply to any web site that maintains and uses information about users keyed to a unique identifier, which means that it applies to just about every web site that collects user registration information.
Reaction to the bill’s announcement was mixed . One commenter described the bill as one that “would push American privacy legislation closer to the strict rules that the European Union uses, and would extend privacy protections both on the Internet and offline.” On the other hand, some privacy advocacy groups believe the bill would not provide tangible benefits for consumers, citing the preemption of stronger state laws, the provision allowing marketers to retain information for 18 months without express user consent, and the bill’s utilization and tacit endorsement of the much–criticized notice-and-consent regime.
In the end, the bill is still only in discussion draft form, Boucher is "facing what may be the most difficult re-election of his 28-year career" this fall, and there are many steps it would need to take before reaching the floor of Congress, which it is highly unlikely to do in the current term. Still, the release of this bill signals that Congress is taking the issue of online behavioral advertising seriously, and even if not enacted it could create momentum leading to other legislation or increased FTC regulation of online behavioral advertising (as it has warned it might do when releasing and revising its Online Behavioral Advertising Principles most recently in February 2009), or encourage similar federal or state regulation of the collection and use of personal information for marketing purposes.
Bret Cohen and Elizabeth Khalil of the Privacy and Information Management practice in Hogan Lovells’ Washington, D.C. office prepared this entry.