Strong Online Privacy Bill Introduced

Masem writes "Senator John Edwards (NC) is introducing a strong privacy bill to Congress, as reported by CNN. While CNN's details are sketchy, the bill would require commercial web sites to ask permission from the user before a cookie can be set or personal information collected. Needless to say, this is an ideal time to snail-mail your representative or senator and ask them to vote in favor of this bill. Of interest that I cannot locate is if this allows 'grandfather' protection of existing data, or will all commercial sites have to start anew by erasing their databases and recollecting the information."

Comments

Will be ineffective against offshore websites

[Sanity]

As has been found by many European countries who have "Data protection" laws designed to protect people's privacy, the fact that you can't apply your country's laws to foreign websites may make this rather ineffective.

--

Re:That's a nice bill, but what we really need...

[lizrd]

If you want to get rid of the evil cookies in IE, just add the offending domains to the list of restricted sites. Long lists of known ad servers can be easily found on the interent. Cookie setting is disabled by default for the restriced sites list.

If you want to be more restrictive you can disable cookies for the internet zone and add sites you want to allow to set cookies into the trusted sites zone. Keep in mind that it is necessary to enable cookie setting on most e-tail sites to keep track of your shopping cart.
_____________

Why legislate?

[luckykaa]

We already give permission. Netscape allows a warning before cookies are accepted. This isn't perfect, but it does the job. Lynx (and a few others) ask before accepting cookies and give a yes/no/always/never option. IE allows a trusted sites, untrusted sites distinction. Added to this are a huge number of third party cookie blocking solutions.

We just need to be warned that people are using cookies and how they're using the things.

different types of cookies?

[www.sorehands.com]

It does not say much about different types of cookies; actually different uses.

Cookies to save login id is not bad. Cookies by doubleclick to track across sites is another story.

But, isn't someone leaving data on your computer and picking them up without authorization a form of computer tresspass? Just because it can be done does not mean it is authorized. Leaving a window open on a house does not mean that a person is allowed to climb through it and take a nap.

Re:different types of cookies?

[use_preview]

Leaving a window open on a house does not mean that a person is allowed to climb through it and take a nap.

And if they do climb through and take a nap, they'd better do it in the bedroom.

won't change anything

[peccary]

So now, every web site will add a boiler-plate disclaimer and an "Enter" button. Ok, you've been informed, you consented, now we'll get down to tracking.

Or alternatively, they will move to a different regulatory jurisidiction, say, Anguilla.

Unless the people care about their own privacy and take steps to protect it, there is little the state can do that will matter. The most important thing the people need to do is stop divulging personal information for any purpose.

Re:I can see a loophole that can be exploited heav

[Sodium Attack]

How is this a loophole? Seems to me this is how it ought to work.

The obligatory four questions

[Cerlyn]

• The first attempt to pass this bill failed. What are the odds of it passing this time, especially in the face of corporate lobbyists?
  
• How might this bill be modified as it passes through the legislature? Could it become the opposite of what was originally intended?
  
• Site A contracts site B to provide inline content/ads/etc. for their site. What does site A have to report about site B's policies? What happens if site A's understanding about site B's rules is incorrect, or site B changes them without contacting site A?
  
• How explicitly will companies have to spell out details of their user tracking techniques? Too many web sites use the phrase "basic user information such as..." in their privacy policies, allowing them to give an incomplete list.