FTC Tells House Subcommittee that Self-regulation Is the Preferred Method of Protecting Consumers' Online Privacy

The Federal Trade Commission today told a House Subcommittee that the Commission is still hopeful that industry self-regulation will achieve adequate online privacy protections for consumers. Chairman Robert Pitofsky, who testified today along with his fellow Commissioners Sheila F. Anthony, Mozelle W. Thompson, and Orson Swindle, pointed out, however, that there remain considerable barriers to be surmounted for self-regulation to work. Therefore, he said, the "Commission believes that, unless industry can demonstrate that it has developed and implemented broad-based and effective self-regulatory programs by the end of this year, additional governmental authority in this area would be appropriate and necessary."

The Commission presented a legislative model that would address consumer privacy online. Under its proposal, all commercial Web sites that collect personal identifying information from or about consumers online would be required to comply with four basic information practices: "Notice," "Choice," "Security" and "Access," Pitofsky said.

The testimony, delivered before the House Subcommittee on Telecommunications, Trade and Consumer Protection, notes that the "Commission has been involved in addressing online privacy issues for almost as long as there has been an online marketplace and has held a series of workshops and hearings on such issues." It describes the extent of information collection online, consumer concerns about the lack of privacy protections, and the lack of effective self-regulatory initiatives. The testimony recognizes that there have been several, promising self-regulatory initiatives in recent months, but also that there are considerable barriers to establishing effective self-regulation.

In June, the Commission released a comprehensive report on Internet privacy, "Privacy Online: A Report to Congress." The report, a comprehensive analysis of the effectiveness of self-regulation as a means of protecting consumer privacy on the World Wide Web, sets forth the details of the agency's extensive survey of 1,400 Web sites' information practices. It concludes that "industry's efforts to encourage voluntary adoption of the most basic fair information practices have fallen short of what is needed to protect consumers."

Also in June, the Commission released legislative recommendations for protecting children's privacy online. The Commission's recommendations with respect to children's online privacy would fit within the framework of the legislation announced today, the testimony states. The Commission's recommendations on online privacy generally, provided in today's testimony, had been promised to Congress this summer in the report.

Chairman Pitofsky and Commissioners Anthony, Thompson and Swindle outlined the proposed legislative model, which would provide an incentive for industry to develop self-regulatory guidelines, and encourage industry participation and input in the implementation of the fair information practices. The four basic information practices the FTC proposes to be required by statute are:

(1) notice/awareness -- Web sites would be required to provide consumers notice of  their information practices, (i.e., what information they collect and how they use it);  

(2) choice/consent -- Web sites would be required to offer consumers choices as to how their information is used beyond the purpose for which the information was provided (e.g., to consummate a transaction);

(3) access/participation -- Web sites would be required to offer consumers reasonable access to their information and an opportunity to correct inaccuracies; and

(4) security/integrity -- Web sites would be required to take reasonable steps to protect the security and integrity of personal information.

The testimony notes that "[t]he implementation of these practices will vary by industry and with technological developments. For this reason, the Commission recommends that any legislation be phrased in general terms and be technologically neutral."

The Commission's legislative recommendation on children would empower parents to make choices about when and how their children's information is collected and used on the Web, the testimony states. It would provide for legislation which would require Web sites that collect this information from kids under 13 years old to provide actual notice to the parents and to obtain prior parental consent before collecting information.

The Commissioners testified that because they wished to create an incentive for continued participation by industry, the legislative model would provide a means by which industries could develop their own guidelines for protecting consumers' privacy, and that those guidelines could receive governmental approval. Industries also would be required to ensure that they comply with and enforce their guidelines.

In addition, the testimony calls for the granting of rule-making authority to the government agency charged with implementing the statute. Rule-making would allow for the promulgation of specific rules and procedures for the approval of industry guidelines.

The Commission vote to approve the testimony was 4-0.

Copies of the testimony, "Privacy Online: A Report to Congress," FTC consumer publications about the Internet, as well as other information about the Commission's privacy initiative are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 6th Street and Pennsylvania Avenue, N.W., Washington, D.C. 20580; 202-FTC-HELP (202-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.