The Federal Trade Commission promised consumers on Monday it would work with Congress on legislation that would provide an easy "do not track" option to protect their privacy online.
In a final staff report on the issue, the commission says it will work with Congress to enact “baseline” privacy legislation as well as legislation to prevent data breaches. The FTC report goes beyond a White House proposal released in February for a “privacy bill of rights” based on new legislation and self-regulation by the industry.
The FTC plan outlines three ways companies should protect consumer privacy online: by incorporating privacy measures by design; offering consumers the ability to choose how and when they will be tracked; and explaining more about how the collected information will be used.
“Simply put, your computer is your property and no one – no one – has the right to put anything on it that you don’t want,” FTC Chairman Jon Leibowitz told reporters on Monday. Leibowitz said the FTC will not be creating any new privacy rules of its own, other than an ongoing effort to update children’s privacy regulations.
Companies need to build in privacy controls and protections the report recommends.
“By considering and addressing privacy at every stage of product and service development, companies can shift the burden away from consumers who would otherwise have to seek out privacy-protective practices and technologies,” the FTC wrote.
The report called on companies to give users more control over their information by offering a “do-not-track” feature to allow them block websites from tracking web browsing. Leibowitz said he is hopeful that companies will institute “do-not-track” options on their own, but if they don’t, Leibowitz said, he doesn’t doubt Congress will act.
Finally, the report urges companies to streamline the way they explain their privacy policies. Long, convoluted privacy policies are “generally ineffective” in educating consumers, the report concludes.
A draft version of the report was released in December. After comments from a range of industry and consumer groups, the final FTC report excluded from its recommendations smaller companies that only gather limited amounts of non-sensitive information from fewer than 5,000 people.
The final report also singled out third-party data brokers that trade in consumer information. Web users are often unaware of the companies or how they use the data and therefore have little control, noted the report, which called for a centralized website where data brokers would be identified.
The commission approved the report on a 3 to 1 vote. Commissioner J. Thomas Rosch, who has long criticized do-not-track proposals, dissented. He said the implications of do-not-track options remain unclear, and he argued that the commission’s recommendations may have the effect of burdensome federal requirements.
Web marketers have called on the government to rely on voluntary, self-regulation methods, rather than legislation. On Monday the Software & Information Industry Association, for example, said it doesn’t endorse the FTC’s recommendation for new laws.
“In light of the FTC’s substantial authority in this area, we do not believe there is a need for new privacy legislation,” the group’s president, Ken Wasch, said in a statement.