US regulator backs 'do not track' list for Web users

Washington: US regulators backed the creation of a "do not track" option for the Internet that would limit the ability of advertisers to collect consumers' data.

In a preliminary staff report, the Federal Trade Commission said on Wednesday that while companies generally manage consumer information responsibly, there are exceptions.

"Self-regulation in privacy has not worked adequately," said FTC Chairman Jon Leibowitz. "A legislative solution will surely be needed if industry doesn't step up to the plate."

Leibowitz said he supported creation of a mechanism that allows consumers to opt out of some tracking, adding that Congress would probably need to act, which may be difficult because of legislative gridlock next year.

Senator John Kerry, a Massachusetts Democrat, said on Wednesday that he planned to introduce legislation that would require companies to secure data and inform consumers about what data is being collected.

"Consumers should be given a simple mechanism for opting out of the process," Kerry said in a statement.

Republicans in the House of Representatives, like Representative Joe Barton, have said, without offering details, they would focus on privacy issues.

Any legislation could be two years off, at minimum, said Amy Mushahwar, a privacy expert with Reed Smith, who predicted industry would strike a deal with the government.

If consumers gain more control over their data, the biggest losers could be companies serving third-party ads, said Mushahwar. "Those are the targets," she said.

Privacy expert Lisa Sotto at law firm Hunton & Williams said the industry needed to pay close attention to the report. "The report gives industry a strong sense of where there is likely to be future FTC enforcement."

The FTC staff report also urged that special care be taken with information about sensitive topics such as finances, health, children or an individual's location.

"Before any of this data is collected, used or shared, staff believes that companies should seek affirmative express consent," the report said.

The agency's report urged the development of ways to build privacy into the design of business practices by, for example, collecting only the data that is needed and disposing of it when it is no longer being used.

The agency also proposed that company privacy policies be simpler, clearer and shorter.

"Staff also proposes providing consumers with reasonable access to the data that companies maintain about them, particularly for companies that do not interact with consumers directly, such as data brokers," the report said.

"In addition, all entities must provide robust notice and obtain affirmative consent for material, retroactive changes to data policies."

The report comes as the FTC is under pressure to contain the growing strength and savvy of companies collecting Internet users' personal data and selling it to advertisers.

A recent report by a privacy group found, for example, that some websites that present themselves as a way for ill people to connect with other people with the same ailments were actually created by companies to collect and sell data on those people to market medicines to them.

A final version of the FTC report will be released next year after taking into account comments from interested parties.