Reps. Boucher and Stearns Release Long-Awaited Advertising Privacy Bill

• The bill would require any company that collects “covered information” from or about individuals to obtain opt-in consent to a statutorily mandated privacy policy containing at least fifteen enumerated disclosures.  Consent would be deemed adequate if the user expressly opted in to the information collection after being presented with the required disclosures, or in most circumstances if the user “does not decline consent at the time such statement is presented."  This would seem to imply that web sites would need to ensure that privacy policies appear on users’ screens at some point, to either expressly opt in or to fail to “decline consent” when the statement is presented to the user.  At the same time, however, the bill permits privacy policies to be “accessible through a direct link from the Internet homepage of the web site.”  It is unclear, then, whether the bill would consider the existence of such a link to be sufficient to infer that a user “does not decline consent” when merely accessing a web site, which would otherwise obviate the need to obtain opt-in consent.

• In a few specific circumstances, the bill would permit the use of web site user information for the purposes of marketing, advertising, or selling only with express opt-in consent.  This includes (1) when the web site wishes to disclose the information to unaffiliated third parties, such as advertisement networks, unless certain requirements are met (see the next bullet); (2) when the web site collects or discloses any “sensitive information,” which is defined as medical records or history, race, ethnicity, religious beliefs, sexual orientation, financial records or other information associated with a financial account, or geolocation information; or (3) when the web site collects or discloses “all or substantially all of an individual’s online activity.”

• Nevertheless, the bill would provide an exception permitting a web site to share user information with unaffiliated third parties for the purposes of marketing, advertising, or selling without express opt-in consent if it:  (1) provides users with a “readily accessible” opt-out mechanism; (2) deletes or renders anonymous any “covered information” within 18 months after it is first collected; (3) allows users to review and modify, or completely opt out of having, any profiles maintained about their preferences by web sites or their advertisement network partners for marketing purposes (these so-called “preference profiles” must be accessible through a hyperlinked “symbol or seal” on the web site and on or near any advertisement served based on the profile); and (4) prohibits advertisement networks from further disclosing any such information they receive.  This would seem to almost directly endorse the use of the online behavioral privacy icon put forth by groups supporting industry self-regulation of behavioral advertising.

• The term “covered information” would include a number of individual data elements – such as name, e-mail address, and Social Security number – that might otherwise be considered personally identifiable information under other statutory or regulatory regimes (at least in combination with other data elements).  In addition to the novel development of regulating the collection of these data elements individually, the bill includes in its definition of covered information:

  "Any unique persistent identifier, such as a customer number, unique pseudonym or user alias, Internet Protocol address, or other unique identifier, where such identifier is used to collect, store, or identify information about a specific individual or a computer, device, or software application owned or used by a particular user or that is otherwise associated with a particular user."

   Adopting this definition would be significant because no American privacy law has ever considered an anonymous identifier or IP address to be legally protected information (though IP addresses are considered to be personally identifiable in the EU and FTC Chairman Jon Leibowitz commented just a couple weeks ago that he believes that IP addresses should be considered personal information).  Additionally, this definition means that the bill would apply to any web site that maintains and uses information about users keyed to a unique identifier, which means that it applies to just about every web site that collects user registration information.

• The bill would not only regulate the online collection of covered information from individuals, but also about individuals.  This means that the bill as written would apply to businesses that compile covered information about individuals from publicly available web sites without the express consent of the individuals.  Since these businesses do not have a relationship with the users of the web sites from which they collect information, it is almost impossible for them to make the necessary disclosures to or obtain the consent of these users.  This consequence of the bill could affect businesses such as search engines if they collect and index any “covered information” without the express consent of the subjects of the information.

• The disclosure and consent requirement would apply to both online and offline collection of covered information.  Disclosure would not be required for the collection of certain information offline, and, importantly, consent would not be required if the information is collected, used, or disclosed for purposes related to the operation of the web site or for administering a specific transaction between the user and the web site.  The latter exception allows web sites to collect covered information, including IP addresses, for the purposes of maintaining the security of their web sites, or for providing services to individuals that use the sites.

• Web sites would be required to provide mechanisms for individuals to withdraw previously granted consent to use their information for the purposes of marketing, advertising, or selling the information, and must honor this withdrawal of consent.

• Web sites would be required to ensure the accuracy of the information they collect, and the FTC would be directed to establish data security safeguards that web sites would need to follow to protect covered information they maintain.

• If enacted, the bill could be enforced by the FTC and state attorneys general, though it expressly disclaims a private right of action.  The bill also would preempt state laws regulating behavioral advertising.

Reaction to the bill’s announcement was mixed. One commenter described the bill as one that “would push American privacy legislation closer to the strict rules that the European Union uses, and would extend privacy protections both on the Internet and offline.”  On the other hand, some privacy advocacy groups believe the bill would not provide tangible benefits for consumers, citing the preemption of stronger state laws, the provision allowing marketers to retain information for 18 months without express user consent, and the bill’s utilization and tacit endorsement of the much–criticized notice-and-consent regime.

In the end, the bill is still only in discussion draft form, Boucher is "facing what may be the most difficult re-election of his 28-year career" this fall, and there are many steps it would need to take before reaching the floor of Congress, which it is highly unlikely to do in the current term.  Still, the release of this bill signals that Congress is taking the issue of online behavioral advertising seriously, and even if not enacted it could create momentum leading to other legislation or increased FTC regulation of online behavioral advertising (as it has warned it might do when releasing and revising its Online Behavioral Advertising Principles most recently in February 2009), or encourage similar federal or state regulation of the collection and use of personal information for marketing purposes.

Thanks to Elizabeth Khalil in the Hogan Lovells privacy group for contributing to this report.

Authored by Elizabeth Khalil and Bret Cohen.