WASHINGTON — In a sign of Congress’ seriousness in passing legislation to shield consumers’ personal Web browsing history and other online information from misuse, members of a key Senate committee on Tuesday questioned representatives of Google, Facebook and Apple about recent high-profile privacy lapses and expressed alarm about the state of privacy protections on the Web.
The hearing before the Senate Commerce, Science and Transportation Committee came on the heels of privacy miscues involving all three Silicon Valley companies: Google’s collection of unsecured data from private Wi-Fi networks, Facebook’s frequently shifting and confusing privacy settings, and AT&T’s disclosure of more than 100,000 e-mail addresses of Apple iPad owners.
Bills pending in Congress would force websites to clearly disclose to users how their personal information is used or shared with third parties for advertising, and in some cases require that consumers “opt in,” or expressly agree, to have their data shared with outside entities.
Web companies are looking to head off far-reaching legislation they fear would hurt their advertising business, particularly when it comes to targeting ads to consumer preferences based on their Web surfing activity. Alma Whitten, a top privacy official for Google, began her testimony with a none-too-subtle reminder to senators of the tens of billions of dollars in economic activity that the Mountain View-based Internet giant drives through its advertising.
But senators said private data is being used in ways people would never imagine, with one calling the practice “creepy.” At the same time, some lawmakers said they want to strike a balance to allow the kind of targeted ads that are useful to consumers.
Sen. Jay Rockefeller, D-W.Va., the committee chairman, opened the hearing by likening online shopping to a trip to the mall. Imagine, he said, that a machine recorded every store a person visited and every product he or she examined, and then created a profile used to send that person ads. Sometimes the machine would even share that profile with other businesses.
That’s essentially what’s happening online, Rockefeller said.
“If consumers fully understand just what was being collected and shared with them, what could they do to stop it?” Rockefeller said. “Can consumers demand the same degree of anonymity on the Internet that they have in a shopping mall?”
Sen. Claire McCaskill, D-Mo., said: “I recognize advertising makes the Internet work and keeps it free. But I’m a little spooked out.”
The hearing at times had the feel of a group of misbehaving schoolchildren being called to the principal’s office, as senators bemoaned the lack of consumer protections online and the company officials defended their practices.
“There’s the unfortunate fact that we do have oversight over you,” Rockefeller told the Web company representatives, “and this is hard for you to deal with.”
“I very much sympathize with the feeling of people being followed,” Google’s Whitten responded, adding that the search giant has tried to make its privacy settings easy for users to understand and adjust.
Other senators struck a mostly conciliatory tone with the tech company officials, while at the same time indicating that they see online privacy as a serious matter, as more of Americans’ lives are conducted online. Sen. John Kerry, D-Mass., said privacy protections vary from one website to another, and often users gloss over privacy policies and offer their consent without realizing the consequences.
“We ought to figure out if we can get to a (standard) where it’s simpler and more direct,” Kerry said.
Federal Trade Commission Chairman Jon Leibowitz, one of the federal government’s top enforcers of privacy regulations, agreed with the mall analogy. He said that far too often consumers have no idea how their personal surfing habits are being tracked and used. He voiced support for new rules requiring consumers to opt in before sensitive information about themselves, such as medical or banking data, is shared.
“There’s a huge disconnect,” Leibowitz said, “between what consumers think happens to their data and what actually happens.”
Leibowitz also said his agency is considering creating a “do not track” list for Web users that would essentially allow them to opt out of targeted advertising, a notion based on the popular “do not call” registry to block phone solicitations.
Leibowitz said Web firms need to step up their disclosure of what they are doing with consumers’ information if they want to avoid overly restrictive legislation.
“It’s in their hands,” Leibowitz said.
It’s unlikely Congress will pass a privacy bill this year because of its packed legislative calendar, but Kerry said he hoped the Senate will approve legislation on the topic early next year.