Lawmakers Probe Web Privacy


Washington -- Major cable, phone and Internet companies, including Google, Yahoo and Microsoft, are under pressure from Capitol Hill to disclose whether their methods of tracking consumer behavior on the Internet comply with federal privacy statutes.

The pressure came Friday in a letter loaded with probing questions sent by the bipartisan leadership of the House Energy and Commerce Committee and its Telecommunications and the Internet Subcommittee.

The letter was signed by Reps. John D. Dingell (D-Mich.) and Joe Barton (R-Texas), chairman and ranking member of the full committee and Reps. Ed Markey (D-Mass.) and Cliff Stearns (R-Fl.), the chairman and ranking member of the subcommittee.  

The letter was sent to: AOL; AT&T; Bresnan Communications; Bright House Networks; CableOne; Cablevision; Cbeyond; CenturyTel; Charter; Citizen Communications; Comcast; Covad; Cox; Earthlink; Google; Insight; Knology; Level 3; Mediacom; Microsoft; PAETEC; Qwest; RCN; Suddenlink; Time Warner Cable; tw telecom; WideOpenWest; TDS Telecom; United Online; Windstream Communications; Verizon; XO Communications; and Yahoo!.

In the letter, the lawmakers expressed concern that Internet users were being tracked in a manner that could violate privacy laws found in the Communications Act of 1934, the Cable Act of 1984, the Electronic Communications Privacy Act.

“We are writing with respect to the growing trend of companies tailoring Internet advertising based upon consumers' Internet search, surfing, or other use,” the letter said. “We are interested in the nature and extent to which you engage in such practices, and the impact it could have on consumer privacy.”

The letter came about two weeks after Markey's panel held a hearing on the uses of deep packet inspection technology to track consumer movements on the Internet without their permission, and then selling the data to advertisers that place a high premium on such specific consumer information.

Markey called on companies to notify consumers when DPI technology is being used. DPI technology, he added, shouldn't be used to track customers until they had affirmatively opted in to be included.

Stearns argued that the subcommittee shouldn't focus just on network broadband network providers. He said companies such as Google, Yahoo and Microsoft had established histories of tracking consumer movement on the Internet and their methods should be studied.

The letter gave the companies until Aug. 8 to answer the following questions:

* Has your company at any time tailored, or facilitated the tailoring of, Internet advertising based on consumers' Internet search, surfing, or other use?

* Please describe the nature and extent of any such practice and if such practice had any limitations with respect to health, financial, or other sensitive personal data, and how such limitations were developed and implemented.

*In what communities, if any, has your company engaged in such practice? How were those communities chosen, and during what time periods was such practice used in each?  If such practice was effectively implemented nationwide, please say so.

* How many consumers have been subject to such practice in each affected community, or nationwide?

*Has your company conducted a legal analysis of the applicability of consumer privacy laws to such practice?  If so, please explain what that analysis concluded.

* How did your company notify consumers of such practice?  Please provide a copy of the notification. If your company did not specifically or directly notify affected consumers, please explain why this was not done.

*Please explain whether your company asked consumers to ‘opt in” to the use of such practice or allowed consumers who objected to “opt out.”  If your company allowed consumers who objected to opt out, how did it notify consumers of their opportunity to opt out?  If your company did not specifically or directly notify affected consumers of the opportunity to opt out, please explain why this was not done.

*How many consumers opted out of being subject to such practice?

*Did your company conduct a legal analysis of the adequacy of any opt-out notice and mechanism employed to allow consumers to effectuate this choice?  If so, please explain what that analysis concluded.

*What is the status of consumer data collected as a result of such practice?  Has it been destroyed or is it routinely destroyed?

* Is it possible for your company to correlate data regarding consumer Internet use across a variety of services or applications you offer to tailor Internet advertising?  Do you do so?  If not, please indicate what steps you take to make sure such correlation does not happen.  If you do engage in such correlation, please provide answers to all the preceding questions with reference to such correlation.