Net Privacy 2010: How Far Will the Needle Move?

For consumer groups that concern themselves with Internet privacy, the efforts to press policymakers to enact regulations or pass laws setting boundaries for collecting data online recall the plight of the long-suffering Brooklyn Dodgers fan: "Wait 'til next year" serves as a fitting mantra for both.

So 2009 came and went with little movement on the privacy front, but advocates are looking ahead to 2010 with high hopes that this year, finally, will be their year.

And they may be right.

The best hope for groups looking to advance the privacy agenda in 2010 rests with the Federal Trade Commission, which has been sending signals that closer scrutiny is on its way.

Already this year, the FTC held a workshop probing the data collection practices of online marketers, inviting advocates, academics and industry executives to speak their mind.

At that meeting, FTC Chairman Jon Leibowitz said the industry was at a "watershed moment in privacy," saying he was deeply troubled by the massive amounts of information marketers were compiling about consumers, echoing previous comments in which he hinted that the government should take a more assertive role in policing data collection.

To date, and to the great dismay of privacy watchdog groups, the FTC has taken a policy of self-regulation. It has published guidelines for the industry to follow, which were last updated in February. But without the threat of an enforcement action, critics have said the policy is toothless.

At the meeting in December, Leibowitz did not lay out any specific policy proposals, saying only that "the time is right to build on the February behavioral targeting principles."

That event was the first in a series of three workshops the FTC has scheduled to inform its consideration of new rules for online advertisers. The second, scheduled in January, is due to be held at the University of California, Berkeley. The commission hasn't set a date for the third, which is to be held in Washington.

Leibowitz isn't the only leader at the commission concerned with Internet privacy. David Vladeck, the head of the FTC's bureau of consumer protection, has also made the issue a priority. The commission has been hiring technical experts to help decision makers get a better understanding of how different data tracking and collection mechanisms work.

But the problem with regulating Internet privacy, Web companies and free market advocates are quick to point out, is that advertising makes content free. When marketers receive more detailed profiles about the behavior and interests of their potential customers, they are willing to pay higher premiums to target them with messages.

This is the friction that has kept Congress and the FTC from rushing to laws or regulations.

In the interest of preserving the practice of self-regulation, several companies and industry organizations have developed new tools to help users see and control how their information is being used, and adopted or agreed to best-practice guidelines such as the ones offered by the FTC.

Some of the largest companies in the industry, including Google (NASDAQ: GOOG) and Microsoft (NASDAQ: MSFT), have expressed support for baseline privacy legislation, providing it doesn't get too specific in targeting specific technologies.

In the early part of 2010, Rep. Rick Boucher, who chairs the House subcommittee on technology and the Internet, has said he plans to introduce a bill that would do just that. He has been working with Cliff Stearns, the ranking Republican on the subcommittee, as well as the leaders of the subcommittee on consumer protection, to draft the bill, and spent the better part of 2009 seeking input from a variety of stakeholders.

Many consumer groups are hoping for twin victories in the privacy battle. They would like to see the FTC tighten its guidelines into binding rules that carry the weight of enforcement, and for Congress to enact legislation setting rigid requirements for consumer notice and consent.

The more pragmatic among them concede that the prospect of a privacy bill winning the president's signature in 2010 is extremely unlikely. The following year would be more realistic, but that will also bring a new, and potentially very different Congress, and it wouldn't solve the political challenge of securing votes for a bill that critics will portray as anti-business.

On the Hill, political momentum could be tough to build for privacy legislation, particularly if the industry continues to develop and promote tools like Google's privacy dashboard, which the company cites as evidence that it's taking the privacy problem seriously. Without a major privacy crisis, such as AOL's search-data disaster in 2006, the push to legislate will be a slow grind.

Many lawmakers will be far happier to see how the FTC handles the matter. The likeliest area for real action on the privacy front in 2010 will be the FTC circulating, and eventually adopting, binding regulations for online marketers that would prohibit collecting information for the purposes of targeting ads in sensitive areas like health and finance.

Whatever action the FTC takes, groups on both sides of the debate will be disappointed. It won't go far enough for the fiercest of the advocates, who would like to see all information collection shift to an opt-in model. Others will resent any effort by a federal agency to write rules governing an industry that's still evolving at a breakneck pace, one that they say has been doing a fine job of policing itself.

Kenneth Corbin is an associate editor at InternetNews.com. Based in Washington, D.C., Kenneth's coverage areas range from government regulation to e-commerce and online media.