Bits Blog: Senator John D. Rockefeller IV Introduces 'Do Not Track' Bill

Shawn Thew/European Pressphoto Agency By introducing this bill, Senator John D. Rockefeller IV indicates that he believes the industry has not acted in good faith on consumer privacy.

Before his planned retirement from Congress at the end of next year, Senator John D. Rockefeller IV, the West Virginia Democrat, intends to give American consumers more meaningful control over personal data collected about them online.

To that end, Mr. Rockefeller on Thursday introduced a bill called the “Do-Not-Track Online Act of 2013.”

The bill would require the Federal Trade Commission to establish standardized mechanisms for people to use their Internet browsers to tell Web sites, advertising networks, data brokers and other online entities whether or not they were willing to submit to data-mining.

The bill would also require the F.T.C. to develop rules to prohibit online services from amassing personal details about users who had opted out of such tracking.

Mr. Rockefeller proposed the same bill two years ago. But he did not push it in the Senate at the time because industry groups had pledged to voluntarily develop systems to honor the browser-based don’t-track-me flags. Last year, however, negotiations between industry groups and consumer advocates over how to execute these mechanisms essentially broke down and have since made little progress.

The new Rockefeller bill indicates that the senator believes the industry has not acted in good faith.

“The privacy of Americans is increasingly under assault as more and more of their daily lives are conducted online,” Mr. Rockefeller, the chairman of the Senate Committee on Commerce, Science and Transportation, wrote on Thursday in an e-mail sent to a reporter. “Industry made a public pledge to develop do-not-track standards that will truly protect consumer privacy — and it has failed to live up to that commitment. They have dragged their feet long enough.”

Industry representatives said that legislation was unnecessary because advertising networks and data brokers several years ago voluntarily introduced their own opt-out program for consumers, called Your AdChoices. Unlike the Do Not Track signals, which would allow users to make a one-time decision about all online tracking from their own browsers, the industry program requires people to go to a site, where they can opt out of receiving marketing offers from several hundred companies based on data-mining. Users also have the option to individually select the companies from whom they prefer not to receive such offers.

Stuart Ingis, a lawyer for the Digital Advertising Alliance, an industry consortium, said the program, which involves consumers installing individual cookies on their browsers, demonstrates that users already have choices about data collection.

“It’s a lot easier to use a system that is already built and works,” Mr. Ingis said.

Over the last few years, the number of companies that collect information about the reading habits, health concerns, financial capacity, search queries, purchasing patterns and other activities of online consumers has skyrocketed. Industry representatives argue that this benefits people because it enables companies to show them relevant ads, and that the ads themselves finance online sites and services that are free to consumers. Moreover, they say, the data collection is “anonymous” because online services typically use numerical customer codes, not real names or e-mail addresses, to track the behavior of individuals.

But consumer advocates warn that such profiling systems, which can collect thousands of details on nearly every adult in the United States, can be used to segment some people for preferential offers while relegating others to inferior treatment. Despite industry claims that online tracking is anonymous, a few computer scientists have reported that sites often leak information that can identify individuals, including names, addresses and other details, to third parties.

“Nowadays, there is an incredible proliferation of tracking,” said Dan Auerbach, a staff technologist at the Electronic Frontier Foundation, a digital rights group in San Francisco. “Data brokers, companies that you never heard of, are collecting massive dossiers about you as you browse around the Web and, right now, there are no limitations on the collection or use of those dossiers.”

To give people greater control over their own surveillance online, the Federal Trade Commission in a report on consumer privacy last March urged industry groups to adopt Do Not Track mechanisms by the end of 2012. In fact, the major browsers — Firefox from Mozilla, Google’s Chrome, and the more recent iterations of Internet Explorer — already offer the don’t-track-me buttons. When these options are turned on, they send out signals to sites, and third parties like ad networks operating on those sites, that certain users do not want to have their information collected.

But industry groups and consumer advocates have been at odds for more than a year over how “Do Not Track” mechanisms should be presented to users and how online services should respond to the signals. In the absence of legislation or industry consensus, companies are free to ignore those user preferences.

Some browsers have responded to this standstill by taking matters into their own hands and blocking third-party tracking cookies, as my colleague Somini Sengupta reported this week.

But Mr. Rockefeller’s bill indicates that legislative action could pre-empt voluntary industry measures.

“This is a signal that Senator Rockefeller is serious about getting Do Not Track done,” said David C. Vladeck, a professor at Georgetown Law. Until last month, Mr. Vladeck served as director of the bureau of consumer protection at the F.T.C. “I think industry writ large – browser companies, advertising networks, data brokers – are going to understand that he is serious about getting across the finish line.”

This post has been revised to reflect the following correction:

Correction: March 1, 2013

An earlier version of this post described incompletely the way the Your AdChoices site operates. While users are presented a list of companies that track Web activity for marketing purposes, they can press one button and opt out of them all; it is not the case that users must individually select companies they do not wish to receive marketing offers from.

Senator Opens Investigation of Data Brokers

On Wednesday, Senator John D. Rockefeller IV, Democrat of West Virginia, opened an extensive investigation of nine leading information brokers. Because Americans now conduct much of their daily business online, the senator said he was concerned that “an unprecedented amount” of personal, medical and financial information about people could be collected, mined and sold, to the potential detriment of consumers.

“An ever-increasing percentage of their lives will be available for download, and the digital footprint they will inevitably leave behind will become more specific and potentially damaging, if used improperly,” Mr. Rockefeller, who is the chairman of the Senate Committee on Commerce, Science and Transportation, wrote in letters to the data brokers. “It is critical that we understand what information companies like yours are already collecting and selling.”

Linda A. Woolley, the acting chief executive of the Direct Marketing Association, a trade group, called the senator’s investigation “a baseless fishing expedition.”

“I hope Senator Rockefeller understands what he’s tampering with,” she said in an e-mailed statement.

The Senate investigation represents the second Congressional inquiry into the industry’s practices this year. In July, Representative Edward J. Markey, Democrat of Massachusetts, and Representative Joe L. Barton, Republican of Texas, co-chairmen of the Bipartisan Congressional Privacy Caucus, began a House inquiry into data compilers, which is ongoing. And the Federal Trade Commission has been looking into the practices of about a dozen major data brokers.

Data brokers collect a wide variety of information from public sources and third parties, including details like consumers’ financial status, race or ethnicity, buying history, hobbies, health concerns, travel preferences, Internet providers and social networks.

The companies often use the information for a practice called “database marketing” — that is, using data mining to help clients like retailers, banks and airlines tailor marketing pitches to their best customers or identify potential new ones.

Collecting, analyzing and selling such information for marketing purposes is perfectly legal. Indeed, it’s a huge business. Some data brokers have said they maintain several thousand details on the majority of adults in the United States.

But some legislators and regulators say they are concerned that neither they nor consumers know the extent of the material that data brokers collect; whom they disclose or sell it to; and exactly what they are doing with it.

Unlike consumer reporting agencies, which are required by federal law to show people their own credit reports and allow them to correct errors, data brokers are not required to show consumers information collected about them for marketing purposes.

Earlier this year in a report on protecting consumer privacy, the F.T.C. urged the industry to create a centralized Web portal where consumers could learn about companies’ practices and their options for controlling information collected about them. The agency also recommended that Congress pass legislation giving people access to information that data brokers hold about them. Underlying regulators’ efforts is their concern that some information brokers could create financial dossiers about individuals that are akin to credit reports and use them to unfairly exclude individual consumers from certain offers or charge some people higher prices than others.

“There are data brokers whose marketing lists may not cross the line into credit reports but come very close,” said Julie Brill, a member of the F.T.C. “The question is whether the lists are being used for marketing purposes or for something very close to credit purposes.”

Industry representatives say that data-based marketers use consumer marketing data for legitimate commercial practices, not for regulated purposes like making offers of credit or insurance.

They add that collecting marketing data benefits consumers because it allows companies to send people offers for products and services they are interested in. It also increases efficiency because companies know ahead of time not to send pitches for, say, lawn mowers to people who live in apartments.

“Consumers love getting what they want — information, products, benefits, upgrades — when they want it,” said Ms. Woolley of the Direct Marketing Association. “There is no evidence that data-driven marketing harms consumers in any way.”

On Wednesday, Mr. Rockefeller sent letters of inquiry to established database marketers like Acxiom, headquartered in Little Rock, Ark.; credit reporting agencies like Experian and Equifax, which have separate marketing arms; and newer companies, like Rapleaf and Datalogix, that specialize in helping companies pursue online and mobile consumers.

Mr. Rockefeller asked each company to provide extensive business details about its data collection operations since Jan. 1, 2009.

Scott Howe, the chief executive of Acxiom, said the company looked “forward to continuing to work with the Congress to help the members gain a deeper understanding of Acxiom’s business and how people and the economy benefit from the appropriate use of data.”

In an e-mail, Demitra L. Wilson, a spokeswoman for Equifax, said the company is not a data broker and that the only a small portion of its business involves unregulated, aggregated data about consumers.

And Gerry Tschopp, a spokesman for Experian, said the company welcomed the opportunity to discuss “the benefits of the appropriate use of consumer data” with legislators.

Representatives of Datalogix and Rapleaf did not immediately respond to e-mail and phone requests for comment.

Mr. Rockefeller asked the companies to respond by Nov. 2.