Last week, Sens. John Kerry and John McCain and Reps. Cliff Stearns and Jim Matheson offered new privacy bills. The Kerry-McCain Senate bill and the Stearns-Matheson House bill each seeks to apply a common set of fair information practices on virtually all businesses, online and offline, that collect information about consumers or consumer behavior. For the moment, both bills are directed to commercial and non-profit organizations (such as many online businesses) that are currently not under privacy regulation.

Kerry-McCain would also apply to the cable, satellite and telephone industries that to date have been governed by Cable Act privacy and CPNI rules. Neither bill would displace current privacy laws applicable to health, educational, credit and financial records, debt collection, children’s online data, or the Electronic Communications Privacy Act (ECPA). As explained below, these new proposed laws could have a significant impact on advertising and advertising platforms.

Kerry-McCain bill

Background and framework

The Kerry-McCain bill would apply to any commercial or non-profit entity which collects, uses, transfers or stores “covered information” for more than 5,000 individuals a year. However, it applies this model only to organizations (such as many online businesses) that are currently not under privacy regulation; and to the cable, satellite and telephone industries that to date have been governed by Cable Act privacy and CPNI rules.

The bill’s approach to what information is “covered” reflects a significant advance over prior formulations. The FTC’s December 2010 Preliminary Staff Report and several earlier privacy bills were focused on online behaviorally targeted advertising, and therefore tended to treat device identifiers or de-identified information as if they were always personally identifiable. That approach not only undermined many advertising models that preserved anonymity, but also undermined business incentives to even bother protecting privacy by de-identifying information.