David Kirkpatrick

August 14, 2008

Coming soon — Online Privacy Bill of Rights?

New legislation is almost never a solution to any problem, real or perceived, but something along these lines might be necessary given the technology out there for collection and mining of data.

I’m not rendering any judgement on the idea of an “online bill of rights” being proposed by Representative Edward Markey (D-Mass.), head of the House Energy & Commerce Committee, since there are no real details to latch on to. One big problem with any legislation is little bits and pieces of odd law always end up in the body of the bill

There are plans to introduce comprehensive online privacy legislation in the next congressional session.

From the second link:

Dubbed the Online Privacy Bill of Rights, the law may require companies to get approval from consumers before collecting information about their Web-surfing habits, a process known as behavioral targeting that helps Web sites more strategically place ads. The legislation may also demand that companies disclose more information on how they collect and use people’s Web-use data. “There is a reasonable chance that we will see something in the next Congress,” says Michael Hintze, an associate general counsel at Microsoft (MSFT).

Watching what you watch

Legislative interest in ad targeting spiked amid recent hearings over a company called NebuAd, which makes devices that attach to the networks of Internet Service Providers and log surfers’ movements(BusinessWeek.com, 8/14/08). Lawmakers are particularly interested in the implications of NebuAd’s technology, known as deep packet inspection (DPI), one of the most comprehensive ways of keeping tabs on what people do online.

An examination of NebuAd prompted congressional staffers to look at ad targeting more broadly. On Aug. 1, Markey’s committee sent letters to 33 companies, including Google (GOOG), Yahoo! (YHOO), and Microsoft, asking each to outline its tracking practices.

Behavioral targeting has come into its own in recent years as companies crafted ever more powerful methods for combing through data. Internet companies have bolstered their ability to target ads through the acquisition of large ad networks able to amass their own information on consumers’ site-viewing habits. During the past year, Microsoft acquired aQuantive, Time Warner’s (TWX) AOL snapped up Tacoda, Google purchased DoubleClick, and Yahoo bought BlueLithium. The use of ad networks surged from 5% of total ad impressions sold in 2006 to 30% in 2007, according to a study released Aug. 12 by the Interactive Advertising Bureau.

Google’s Move Toward Transparency

Markey’s office says the legislation is still in the planning stages. For instance, it’s unclear what kinds of targeting would fall under requirements that companies let consumers opt-in to letting their data be collected and used. Opt-in clauses could apply to DPI only, or they could include less comprehensive targeting, such as the methods employed by companies such as Google and Yahoo.

The industry is already reacting to new scrutiny from Congress and the Federal Trade Commission in an attempt to avoid federal intervention. During the past year, Yahoo, Microsoft, and AOL began allowing people to opt out of tracking on their sites. They also adopted policies for deleting or making search data anonymous after a certain time period. Updated policies were “long overdue,” says Jules Polonetsky, AOL’s chief privacy officer. “After behaving rather glacially, there has been a huge jump forward just in the past year.”