Industry is to be commended for its recent advancement of self-regulatory principles. However, while proactive, these entirely voluntary principles do not go far enough, and there is no guarantee that every company that collects information from the Internet-using public will abide by them.

{mosads}Because consumers need an assured level of control over the collection, use and sharing of information about them, a statute providing those assurances is now called for. That goal should be achieved by legislation, which reflects best industry practices and requires that they be followed by all websites that collect information from Internet users. Legislation assuring Internet users that their online experience is more secure will be a driver of greater levels of Internet uses such as e-commerce, not a hindrance to them.

With proper privacy protections in place, advertising targeted to the interests of Internet users benefits both of the advertiser and the person to whom the ad is targeted. I personally appreciate the convenience that arises from ads that are targeted to my specific interests delivered by websites that I frequently visit for online shopping.

It is also important to note that online advertising supports much of the commercial content, applications and services that are available to Internet users today without charge, and I have no intention of disrupting this well-established and successful business model.

At the same time, consumers are entitled to some baseline protections in the online space. For these reasons, I plan to introduce, with bipartisan participation, a measure based on the following principles, which will extend a clear set of privacy rights to Internet users:

• Disclosure. Consumers should be given clear, concise information in an easy-to-locate privacy policy about what information a website collects about them; for what purposes that information is collected; how and for how long the information is stored; what happens to it when it is no longer stored and whether and under what circumstances it is given or sold to third parties. A website that makes material changes to its privacy policy will be required to give consumers notice of those changes.

• Collection. As a general rule, websites should be permitted to collect information about website visitors sufficient to build preference profiles about those visitors unless the website visitor affirmatively opts out of permitting the website to collect the information.

However, a website may only knowingly collect sensitive information, such as medical information, financial information, information about sexual preference, precise geographic location information and information about children and adolescents, with a consumer’s express opt-in consent.

In addition, a network operator or Internet service provider should be permitted to use technologies like deep packet inspection, which collect information about all of a subscriber’s online activities across the Internet with that subscriber’s express opt-in consent.

• Use of information. As with the collection of information, if someone does not want a website he visits to use information it collects to deliver ads to him, he should opt out of that use. However, a consumer has a reasonable expectation that a website he visits will not be sharing his information with unrelated third parties. Accordingly, if a website wants to provide information to an unrelated third party whose activities are not required for delivering ads by the information-collecting website to the person from whom it is collected, it should not be permitted to engage in that information-sharing unless the Internet user affirmatively opts in to that use.

• Safe harbor. To encourage proactive industry efforts that give consumers extra control over how information about them is collected, used and disclosed, the legislation should create a safe harbor for companies that participate in robust self-regulatory programs that have been approved by the Federal Trade Commission. A variety of models that place the power to make privacy-related decisions in the hands of consumers might qualify and allow, subject to consumer opt-out, the sharing of information among unrelated websites that participate in ad networks.

{mosads}Such programs could, for example, allow consumers to opt out of the collection, use and disclosure of information by all companies participating in a particular ad network that serves targeted advertising to those companies’ websites by taking a single step, such as checking one box on one website.

Other programs might allow consumers to view and modify, or opt out of entirely, the profile a website maintains about them; or give consumers a ready means of obtaining more information about the source of particular online advertisements and the opportunity to opt out of them. Such a safe harbor will encourage these and other pro-consumer creative self-regulatory efforts.

The Federal Trade Commission will be given regulatory authority to enforce the privacy principles set forth in the statute and to define the pro-consumer policies which will qualify for the safe harbor provision.

The structure I have set forth should not prove burdensome for Internet-based businesses that rely on targeted advertising. In fact, it is in line with the practices of reputable service providers today. More importantly, by giving Internet users a greater confidence that they have control over the collection and use of information about them by websites, it will encourage greater levels of general Internet usage and e-commerce, benefiting not only consumers, but also the companies that transact business online and our nation’s economy.

Boucher is chairman of the Subcommittee on Communications, Technology and the Internet.