Legislative Update: ‘Do Not Track’ Advances from California to Capitol Hill

Legislation that would dramatically change the way online advertising and Web companies are allowed to collect and retain consumers’ personal data is moving forward in the U.S., from sea to shining sea.

California moved one step closer to enacting the first ‘Do Not Track’ legislation in the nation that would give consumers in the state an “opt-out” privacy mechanism to restrict online advertisers and Web companies from collecting their personal data.

The proposed bill, SB-761, was approved by a 3-2 Senate Judiciary Committee vote last week, marking the first time a bill of its type has made it out of committee in any state legislature.

The idea of a “do not track” mechanism for the Web, similar to the existing “Do Not Call” registry for telemarketers, has moved forward quickly in the past months after endorsements from the White House and the FTC, and ongoing consumer concerns over how their information is collected and stored.

The bill in California now moves on to the Appropriations Committee, but must also pass the Senate and State Assembly before it could eventually reach the state’s Democratic governor, Jerry Brown.

The bill still also faces stiff resistance from the likes of Google, Facebook and the state’s Chamber of Commerce, each of whom signed a joint letter in opposition to the measure saying it “would create an unnecessary, unenforceable and unconstitutional regulatory burden on Internet commerce.”

While California pursues its own path towards online privacy, lawmakers on the opposite coast, Capitol Hill, continue to push for a federal approach towards tighter regulation.

Reps. Joe Barton (R-Texas) and Ed Markey (D-Mass.), the two co-chairs of the Bipartisan Congressional Privacy Caucus, on Friday released a draft bill that goes beyond existing federal law to specifically prohibit companies from tracking children on the Internet without parental consent.

Among other protections, their bill, the “Do Not Track Kids Act of 2011,” would require an “Eraser Button” that would allow parents to eliminate kids’ personal information already online, create a ‘digital marketing bill of rights’ for teens and establish a set of new rules regarding the collection of consumers’ geo-location data.

The long-anticipated draft bill from Barton and Markey in the House arrives just  as critical privacy developments unravel on the Hill, from the recent Sony data breach to the high-profile focus on smartphone tracking in response to activities by Google and Apple.

The Barton-Markey bill also follows on the heels of no fewer than five pieces of legislation now circulating Congress relating to online privacy.

In April, Reps. Cliff Stearns (R-Fla.) and Jim Matheson (D-Utah) introduced the “Consumer Privacy Protection Act of 2011,” that relies on privacy policies to alert consumers to data collection and usage, rather than requiring a specific ‘opt-out mechanism.  Before that, Rep. Bobby Rush (D-Ill.) re-introduced his own privacy legislation, followed by Rep. Jackie Speier’s (D-Calif.) own “Do Not Track Me Online Act of 2011,” both of which call for the FTC to establish regulations and determine the standards for “an online opt-out mechanism.”

And soon to come in the Senate is another privacy bill, as announced Friday by Sen. Jay Rockefeller (D-West Virginia), chairman of the Commerce Committee.  Rockefeller said in a statement that his bill, the “Do Not Track Online Act of 2011” would require online firms to offer a do-not-track option and allow the FTC  to take action against companies who violate consumers’ privacy requests,

In cases where the consumer does not want his or her personal information to be tracked, Rockefeller noted his bill would allow companies “to collect only the information that is necessary for the website or online service to function and be effective, but then place a legal obligation on the online company to destroy or anonymize the information once it is no longer needed.”

Rockefeller’s bill will join a similar bill introduced by Senators John Kerry (D-Mass.) and John McCain (R-Ariz.) last month.  Their “Commercial Privacy Bill of Rights Act of 2011,” would also direct the FTC to require companies to offer consumers “a robust, clear, and conspicuous” opt-out mechanism from use of their personally-identifiable data by third parties “for behavioral advertising or marketing.”

Apple’s addition of a do-not-track privacy tool to its latest Web browser, reported last month, left just Google as the only major Web browser provider to not yet commit to supporting a do-no-track capability in its browser to protect users from having their Web movements tracked.

Mozilla added such a tool to the beta version of its Firefox 4 in February, while Microsoft Tracking Protection was included in the beta release of Internet Explorer 9, announced earlier this year.

Google, meanwhile, so far offers only a Chrome extension called Keep My Opt-Outs, which lets users permanently opt out of tracking cookies and request that their data not be used for targeted advertising.