The Federal Trade Commission on Monday urged Congress to enact Internet privacy laws that would force data brokers to reveal what information they buy and sell about consumers.
In a wide-ranging report that also supports self-regulatory efforts by businesses, the FTC stopped short of supporting laws that would mandate anti-tracking buttons on Web sites — a proposal that Internet advertisers have lobbied hard to keep out of legislation.
The report largely mirrors similar proposals made last month by the White House and highlights a growing consensus among federal officials that consumers need stronger protection for their online privacy.
Over the past year, the FTC has cracked down on Google and Facebook for allegedly exposing user data when launching new products. The agency said that cellphone applications present new privacy challenges: Legal statements are unclear and too hard to read on small screens and companies such as Apple and Google do not force developers to post notices in app stores.
After two years of intense debate between powerful companies and privacy advocates, the FTC’s recommendations were a relief to businesses that hope to use consumer data to customize advertising based on a user’s likes and dislikes without strict government rules.
We wanted “not to erect a stop light” for businesses but to “take a closer look at traffic patterns,” FTC Chairman Jon Leibowitz said during a news conference.
Much of the 73-page report focused on the need for companies to clearly explain how they collect data about users and for what purposes they use that information.
The FTC called for legislation on data brokers — the Web's information middlemen, such as Lexis Nexis and Choicepoint — who take data that has been collected online and merge the information with documents offline to create detailed portraits of consumers.
The brokers “sell a wealth of highly personal information about consumers but never interact directly with them,” according to the report. “Consumers are often unaware of the existence of these entities, as well as the purposes for which they collect and use data.”
The FTC said a law should allow consumers to see what those portraits would look like . And the agency said that data brokers should be forced to reveal their data-collection practices.
The agency did not urge a law on cellphone privacy. Instead, it suggested that companies do a better job of creating short and clear policies that don’t require dozens of clicks to read through.
On a topic that has drawn intense interest, the enforcement agency said it was unnecessary to create a “do-not-track” law. Two years ago, the agency introduced the idea that all Web firms should be forced to offer anti-tracking mechanisms to their users. But Leibowitz noted that online firms have recently volunteered to create their own anti-tracking icon that users could click to stop the practice.
The Digital Advertising Alliance, which represents the vast majority of Web advertisers, promised to launch the icon by the end of the year. It said it would work with the Commerce Department, FTC and privacy advocates on the technology.
But Leibowitz warned that if the icon isn’t launched by the end of the year, he would use his bully pulpit to push for laws. The FTC has limited rule-making ability, but it has the authority to enforce laws set by Congress.
“We are confident that consumers will have an easy-to-use and effective do-not-track option by the end of the year because companies are moving forward expeditiously to make it happen and because lawmakers will want to enact legislation if they don’t,” he said.
Privacy advocates have pushed for anti-tracking mandates, saying that consumers should be offered an easy option to prevent browsers from depositing cookies that can store records of a user’s shopping, entertainment and communications history.
“If this goal can be reached, it will be a crucial milestone for protecting the First Amendment rights of consumers,” said Christopher Calabrese, legislative counsel for the ACLU. “For the first time they will be able to read whatever they want online without fear of surveillance from companies, employers or the government.”
Web companies said they prefer self-regulation — even if it curbs their ability to collect valuable data.
“There is a long way to go before the DAA’s guidelines become effective and (businesses) implement do-not-track browser standards, but the fact that the FTC is willing to continue to work with industry is a very positive sign,” said Amy Mushahwar, an Internet privacy attorney at Reed Smith, who represents Web businesses.