That is, consumers would have to specifically permit advertisers to combine their personally identifiable data with their clickstream data. But privacy advocates ridicule both aspects of the plan, insisting that all consent should be opt-in and that advertisers should never be allowed to collect any data on consumers without first getting a consumer's permission to do so. And even where the NAI principles do require opt-in consent, privacy advocates pointed out the lack of oversight. Privacy advocates also assailed the NAI principles for not providing adequate guidelines for consumers to access information that online advertising networks have collected on them. They insisted that legislation will now be the only way to ensure that consumers' rights are protected.
Legislation is now necessary.
This makes clear that self-regulation isn't going to work. Even FTC Bureau of Consumer Protection Director Jodie Bernstein, while defending the FTC's decision to approve the NAI principles, said legislation is likely, noting that Arizona Senator John McCain, chairman of the Senate Commerce Committee, has already introduced legislation to protect consumer privacy online. But not everyone is willing to give up on self-regulation just yet. But she said those issues are not so easily worked out and consumers still will have a greater degree of protection than before. This isn't a solution, but it is a positive step.