S. 913 Do-Not-Track Online Act

On May 9, 2011, Sen John Rockefeller (D-WV) introduced a bill to require the Federal Trade Commission to prescribe regulations regarding the collection and use of personal information obtained by tracking the online activity of an individual (S 913). The Do-Not-Track Online Act of 2011 would give consumers the ability to opt out of having their online activities tracked by Internet companies.

Sen Rockefeller offered this section-by-section summary:

Section 2: Regulations Relating to “Do-Not-Track” Mechanisms.

Section 2 establishes the framework for a “Do-Not-Track” legal obligation that allows individuals to indicate their preference to not have their online activities – including online mobile activities – tracked and, with limited exceptions, prohibits online providers from collecting personal information from individuals who indicate such a preference.

The Federal Trade Commission (FTC) is tasked with issuing two regulations within a year of enactment of the Act, utilizing the procedures set forth under section 553 of the Administrative Procedures Act (APA). The first rule would establish standards for the implementation of a Do-Not-Track mechanism by which individuals could simply and easily indicate a preference that personal information not be collected by providers of online services. The second rule would prohibit providers from collecting personal information from those individuals who have expressed such a preference.

Section 2 further establishes that providers may continue to collect personal information from individuals who have utilized the Do-Not-Track mechanism if such collection is (1) necessary to provide a service requested by the individual and the information is anonymized or deleted as soon as that service is provided, or (2) the individual is given clear notice on the collection and use of such information and affirmatively consents to that use.

This section also establishes factors that the FTC must consider when promulgating the required rules. The FTC must consider (1) the appropriate scope of such rules, (2) the technical feasibility and costs of implementing a Do-Not-Track mechanism and of complying with the associated rules, (3) how a Do-Not-Track mechanism should be publicized and offered to individuals, (4) the applicability of existing Do-Not-Track mechanisms, (5) whether and how information can be collected anonymously so that it cannot be reasonably linked to a single person or computer and therefore would not qualify as personal information, and (6) the standards under which personal information may be collected and used to provide content or services requested by the user, including fulfilling the basic functionality of an online service, even if that user has utilized the Do-Not-Track mechanism.

Section 3. Enforcement of “Do-Not-Track” Mechanisms
Section 3 establishes a dual enforcement regime, whereby both the FTC and state attorneys general enforce the provisions of the Act. The FTC treats violations of the rules promulgated under section 2 as violations of a rule defining unfair or deceptive acts or practices under Section 18 of the Federal Trade Commission Act (FTC Act). By so doing, the FTC is empowered to seek civil penalties against violators in addition to its full panoply of equitable remedies. Among other remedies, State attorneys general are authorized to seek civil penalties, which are statutorily capped and indexed for inflation. State attorneys general must notify the FTC prior to its enforcement actions, and the FTC can, in turn, intervene. During a pending federal action, state enforcement action is precluded.

This section also allows FTC to enforce the rules promulgated under this Act against nonprofit organizations, overriding the general exemption of non-profit entities under the FTC Act.

Section 4. Biennial Review and Assessment
Section 4 calls on the FTC to review the implementation of the Act, assess the effectiveness of its regulations, assess the effect of the regulations on online commerce, and submit a report to Congress on the results of the review no later than two years after the effective date of the regulations promulgated pursuant to this Act.