Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Similar to the bill introduced by <a href="https://www.dataprivacymonitor.com/behavioral-advertising/speier-introduces-do-not-track-me-online-act-of-2011/">Rep. Jackie Speier</a> in February 2011, Sen. John Rockefeller (D-WV) introduced the <a href="http://commerce.senate.gov/public/?a=Files.Serve&amp;File_id=85b45cce-63b3-4241-99f1-0bc57c5c1cff">Do-Not-Track Online Act of 2011</a> on May 9, 2011.&nbsp; Sen. Rockefeller <a href="http://commerce.senate.gov/public/index.cfm?p=PressReleases&amp;ContentRecord_id=971b9c02-b6a3-462f-933a-0ec0bd9c4c24&amp;ContentType_id=77eb43da-aa94-497d-a73f-5c951ff72372&amp;Group_id=4b968841-f3e8-49da-a529-7b18e32fd69d">announced</a> that the bill would offer a &ldquo;simple, straightforward way for people to stop companies from tracking their movements online.&rdquo;
The FTC would be given one year to establish standards for implementing and enforcing a Do-Not-Track mechanism.&nbsp; The standards would apply to online service providers, including providers of mobile applications and services.&nbsp; If an individual expresses a Do-Not-Track preference, online service providers may only collect and use personal information from that person if: (1) it is necessary to provide a service requested by the individual and the information is anonymized or deleted after providing the service; or (2) the individual affirmatively consents after receiving &ldquo;clear, conspicuous, and accurate notice on the collection and use of such information.&rdquo;&nbsp;
The Act directs the FTC to consider six factors when implementing the Do-Not-Track standards: (1) the appropriate scope of covered conduct and persons; (2) technical feasibility and cost associated with the mechanism; (3) existing mechanisms; (4) how to make the public aware of the mechanism; (5) whether and how information could be collected on an anonymous basis so that it is not subject to the rules; and (6) standards by which personal information can be collected and used to provide a service requested by the user even if the user expressed a Do-Not-Track preference.
The FTC would be authorized to enforce the Do-Not-Track rules by treating violations as unfair and deceptive acts or practices.&nbsp; Moreover, state attorneys general may bring a civil enforcement action with penalties for non-compliance of up to $16,000 per day and a maximum total liability of $15,000,000&mdash;three times the cap on penalties proposed by Rep. Speier&rsquo;s bill.&nbsp; Lastly, no private right of action is created, non-profit organizations are not exempt, and the FTC would be required to conduct a biennial review to assess the effectiveness of the rules and their effect on online commerce.
Unlike Rep. Speier&rsquo;s bill, Rockefeller&rsquo;s bill does not address preemption of inconsistent state laws.&nbsp; Preemption will be an interesting issue to follow in conjunction with the pending Do-Not-Track legislation in <a href="http://www.pcworld.com/article/227212/californias_do_not_track_law_takes_a_step_forward.html">California</a>.&nbsp;

Senator Rockefeller Introduces Do-Not-Track Legislation