Executive Summary

As the Internet becomes an ever greater part of daily life, concerns about the protection of personal privacy while online grow stronger. The nature of the concern varies widely, from worries about identity theft to a general sense of unease about Web site operators "spying" on Internet users. These fears are having an impact on the New Economy; according to a recent poll, over half of Internet users in the United States have at least occasionally altered their online behavior because of fears about their privacy.¹ For this reason, Congress is gearing up to debate online privacy legislation.

The Progressive Policy Institute (PPI) has long espoused several principles with regard to online privacy: public policy should encourage private sector leadership, allow for regulatory flexibility, distinguish between sensitive and non-sensitive data, and be technology neutral. Most important, any online privacy legislation should balance the need to protect consumer privacy with the need to encourage the growth of a free and freely available Internet supported by targeted marketing. Just as advertising supports free television, the Internet must be used as a marketing tool if the content is to remain free. The recent shakeout in the "dot com" business sector and the plummeting prices of technology stocks make this reality all the more urgent: Internet companies must become profitable to survive, and if Web sites cannot derive significant revenue from marketing to support their operations, many will have no choice but to charge subscription fees. If overly strict online privacy legislation cuts into marketing revenues, the Internet as it currently exists -- a vast repository of free and easily accessible information -- may cease to exist.

It seems clear that some kind of privacy legislation is inevitable, though it is not at all clear that legislation will pass in the 107^th Congress. PPI believes that a balanced online privacy law must:

• refrain from dictating what Web sites can do with information about users;
• require Web sites to notify users of their privacy policies, with software that automatically conveys the policies constituting legal notice;
• mandate that Web sites allow users the ability to restrict the use of their personally identifiable information by "opting out";
• not set mandates for non-personally identifiable information;
• not require Web sites to serve users who choose to opt out;
• not mandate standards for protecting data or making it available to users;
• mandate strong federal preemption of state online privacy laws to prevent a patchwork of conflicting online regulations;
• set reasonable federal guidelines for penalties that can be imposed on violators; and
• give "safe harbor" to Web sites that participate in approved "seal programs" in which third parties certify the compliance of Web sites with privacy policies.

Endnote

1. A Wall Street Journal and Harris Interactive poll of 2,365 adult Internet users, taken March 14-16, 2001. In response to the question, "How often, if ever, have concerns about privacy caused you to stop using a Web site or forgo an online purchase?" 5 percent responded "all the time," 9 percent responded "frequently" and 39 percent responded "occasionally." (Twenty-eight percent responded "rarely" and 19 percent responded "never.")