Two US congressional representatives have released a draft of legislation that intends to reshape how online privacy and advertising currently work, at least sort of. The bill, announced earlier today, goes too far, according to some in the online ad industry, and not far enough, according to some privacy groups.
If companies want to collect sensitive user information, like medical and financial records, social security numbers, or precise geographic location, they need to ask users to “opt-in” to share it with them, according to the draft. Other data, like information about user browsing activity that many companies collect through web cookies, would be “opt-out,” meaning users would have to choose to not share it.
Other changes could affect how data is exchanged between third parties. While the bill says it would generally restrict companies from sharing data with each other, it has also made a big qualification to that idea:
As an exception to the general rule requiring opt in consent for third-party information sharing, Opt-out consent would apply to sharing of an individual’s information with a third-party ad network if there is a clear, easy-to-find link to a webpage for the ad network that allows a person to edit his or her profile and, if he chooses, to opt out of having a profile, provided that the ad network does not share the individual’s information with anyone else.
The Federal Trade Commission would be charged with adopting and enforcing the bill; state governments, including attorney generals and consumer protection agencies, would also be able to enforce the FTC rules.
While Facebook has been heavily criticized for a variety of product changes that diminish user privacy options, the bill appears to be aimed more at online advertising networks and the many other companies that have built businesses using sometimes secretly collected data about users. One of Facebook’s most recent controversial changes is that it allows third parties to access some personally-identifiable Facebook user data, and users have to opt out if they don’t want that to happen. It’s not clear how that product would be affected by this legislation, if at all.
Facebook itself is still looking at the bill, but isn’t commenting much at this point. Here’s the official statement we got from company representative Andrew Noyes:
We applaud Rep. Boucher for engaging in a thoughtful, deliberative process by releasing a discussion draft prior to introducing legislation. As public attitudes towards sharing and control over information evolve and become more diverse, Rep. Boucher has taken an important step in what promises to be a productive and vigorous public dialogue about privacy in the Internet age. We look forward to being part of the discussion.
This is just a draft of the bill. But now that it’s out, expect all concerned parties to step up their efforts to shape it.