Congress to Push Web Privacy

Support is building for a measure that would make companies get consumers' approval before collecting info about their Web surfing

by Heather Green

Support for a law aimed at protecting consumers' online privacy is gathering steam in Washington. Representative Edward Markey (D-Mass.), head of the House Energy & Commerce Committee, says he and others plan to introduce comprehensive online privacy legislation in the coming congressional session.

Dubbed the Online Privacy Bill of Rights, the law may require companies to get approval from consumers before collecting information about their Web-surfing habits, a process known as behavioral targeting that helps Web sites more strategically place ads. The legislation may also demand that companies disclose more information on how they collect and use people's Web-use data. "There is a reasonable chance that we will see something in the next Congress," says Michael Hintze, an associate general counsel at Microsoft (MSFT).

Watching what you watch

Legislative interest in ad targeting spiked amid recent hearings over a company called NebuAd, which makes devices that attach to the networks of Internet Service Providers and log surfers' movements (BusinessWeek.com, 8/14/08). Lawmakers are particularly interested in the implications of NebuAd's technology, known as deep packet inspection (DPI), one of the most comprehensive ways of keeping tabs on what people do online.

An examination of NebuAd prompted congressional staffers to look at ad targeting more broadly. On Aug. 1, Markey's committee sent letters to 33 companies, including Google (GOOG), Yahoo! (YHOO), and Microsoft, asking each to outline its tracking practices.

Behavioral targeting has come into its own in recent years as companies crafted ever more powerful methods for combing through data. Internet companies have bolstered their ability to target ads through the acquisition of large ad networks able to amass their own information on consumers' site-viewing habits. During the past year, Microsoft acquired aQuantive, Time Warner's (TWX) AOL snapped up Tacoda, Google purchased DoubleClick, and Yahoo bought BlueLithium. The use of ad networks surged from 5% of total ad impressions sold in 2006 to 30% in 2007, according to a study released Aug. 12 by the Interactive Advertising Bureau.

Google's Move Toward Transparency

Markey's office says the legislation is still in the planning stages. For instance, it's unclear what kinds of targeting would fall under requirements that companies let consumers opt-in to letting their data be collected and used. Opt-in clauses could apply to DPI only, or they could include less comprehensive targeting, such as the methods employed by companies such as Google and Yahoo.

The industry is already reacting to new scrutiny from Congress and the Federal Trade Commission in an attempt to avoid federal intervention. During the past year, Yahoo, Microsoft, and AOL began allowing people to opt out of tracking on their sites. They also adopted policies for deleting or making search data anonymous after a certain time period. Updated policies were "long overdue," says Jules Polonetsky, AOL's chief privacy officer. "After behaving rather glacially, there has been a huge jump forward just in the past year."

More changes may be on the way, Polonetsky says. "The heightening focus on the Hill is going to prod companies to do more to give users transparency and control," he says. He expects companies to roll out data-retention limits on other kinds of information they collect.