The Obama administration is backing legislation to protect the personal data of Internet users, toughening its stance from a call last year for voluntary codes of conduct for data companies and advertisers.
"The administration is now at the point of recommending that this be dealt with in legislation," said Lawrence Strickling, an assistant secretary at the Commerce Department's National Telecommunications and Information Administration.
Testifying on Wednesday to the Senate Commerce Committee, Strickling backed creation of a bill of rights for Internet users with legally enforceable standards for the collection and sale of personal data gathered from Internet use.
Strickling steered clear of specific recommendations of what practices should be allowed or banned, saying that industry and consumer groups could do that work more nimbly.
"It's impossible for us to say today what the privacy issue will be six months from now," he said, noting that it can take a year to get a regulation on the books.
Democratic Senator John Kerry, who has been circulating proposed privacy legislation drafted with Republican Senator John McCain, said he planned to introduce a commercial privacy bill of rights "in short order."
"We approached this with a real open mind, and I think people will acknowledge a fair amount of reasonableness and flexibility. But we can't let the status quo stand," Kerry said.
Advertisers and data aggregators defend their practices as necessary to give Internet users more relevant advertising.
Federal Trade Commission Chairman Jon Leibowitz told the Senate hearing that his agency was already going after companies that were deceptive about their privacy policies.
These included an online advertising company named Chitika Inc, which allowed people to opt out of being tracked but the opt-out expired after 10 days.
The FTC has called for a "Do Not Track" option, where people could tell companies that they did not want information gathered on them.
"We don't think tracking is per se bad at all," said Leibowitz. "We just think that consumers should be able to opt out of tracking. ... You should have the right not to be followed around if you don't want to be followed around."
Microsoft endorsed privacy legislation, and introduced a version of Internet Explorer this week that includes a tracking protection tool that allows users to bar web sites from gathering information on them.
A coalition of five privacy groups warned in a statement that giving industry a large say in developing online privacy codes was unlikely to lead to a regime that protects consumers.
"Any meaningful privacy legislation should direct the Federal Trade Commission to create and enforce a 'Do Not Track Me' mechanism," said the coalition, which is made up of Consumer Watchdog, Center for Digital Democracy, Consumer Federation of America, Consumer Action, U.S. PIRG and the World Privacy Forum.