The FTC says the industry's efforts to safeguard consumer privacy have failed. Industry groups decry government interference.
In a stark reversal of policy, the Federal Trade Commission asked Congress on Monday for new authority to regulate how companies use personal information collected on their Web sites.
The commission recommended that lawmakers pass legislation to bolster its ability to oversee online privacy, concluding that the industry has failed to safeguard consumer privacy through self-regulation.
The FTC voted 3-2 to send its decision to Capitol Hill and cited the findings of a new report on online privacy. The FTC survey found that only 20 percent of a random sample of all Web sites with more than 39,000 visitors had implemented the four key components of widely accepted fair information practices. Of the 100 most popular U.S. commercial sites, only 42 percent had adopted these standards.
"The study indicates that there is still a long way to go," said FTC commissioner Mozelle Thompson. "This is something that consumers have gotten more and more concerned about."
The legislation recommended by the FTC would require commercial Web sites to implement such principles as notifying consumers what information is collected and how it will be used; the option to choose whether information can be shared with third parties; access to review information a site has collected; and security of that information during transmission and storage.
The commission's proposal still puts industry efforts at the forefront but gives the FTC the ability to address any gaps, Thompson said. He stressed that the commission also wants to provide enough flexibility to encourage innovation in the industry.
The report cited only a limited use of voluntary self-regulation options such as programs run by the Better Business Bureau or Truste, which audit companies to see whether they keep their privacy promises to consumers.
Only 8 percent of all Web sites post privacy seals indicating their participation in such programs.
"The FTC has been very indulgent with businesses' slow progress toward privacy protection," said Jason Catlett of Junkbusters Corp., a New Jersey privacy advocate. "The commission properly made the decision this shouldn't be put off any longer."
Industry groups said privacy regulation could hinder the ability of the Internet to respond quickly to new consumer demands and would impose undue burdens on companies.
"I'm a little confounded that they think that at this juncture they should jump in and regulate," said Christine Varney of the Online Privacy Alliance, an industry trade group.
"It's starting down a slippery slope toward Internet regulation, which is unwarranted," said Harris Miller, president of the Information Technology Association of America.
Commissioner Orson Swindle, who voted against the recommendations, said the FTC's plan doesn't adequately address why new legislation is needed.
"Legislation should be reserved for problems that the market cannot fix on its own," Swindle said. He also warned that any law should consider "unintended consequences that could severely stifle the thriving new economy."
It's unclear what prospects such legislation would have for passage during an election year, and some lawmakers already have questioned whether the industry needs regulation.
"A vast number of sites disclose what their privacy policies are and give consumers more control on what information is gathered and how it will be used," said Rep. Billy Tauzin, R-La., chairman of the House Commerce Committee's telecommunications, trade and consumer protection panel.
But Sen. Robert Torricelli, D-N.J., used the commission report to press for legislation he introduced earlier this year that would bolster privacy requirements on the Internet.
"People should not be forced to sacrifice their privacy rights to the new technologies," Torricelli said.