Internet privacy issues encompass several concerns. One is the collection of personallyidentifiable information (PII) by website operators from visitors to government and commercialwebsites, or by software that is surreptitiously installed on a user's computer ("spyware") andtransmits the information to someone else. Another is the monitoring of electronic mail and Webusage by the government or law enforcement officials, employers, or e-mail service providers. Another issue, identity theft, is not an Internet privacy issue per se, but is often debated in the contextof whether the Internet makes identity theft more prevalent. For example, Internet-based practicescalled "phishing" and "pharming" may contribute to identity theft. This report provides an overview of Internet privacy-related issues and related laws passedin previous Congresses, and discusses legislative activity in the first session of the 109th Congress. Background information on Internet privacy issues is available in an archived CRS Report RL30784, Internet Privacy: An Analysis of Technology and Policy Issues , by Marcia Smith(available from author); and CRS Report RL31289 , The Internet and the USA PATRIOT Act:Potential Implications for Electronic Privacy, Security, Commerce, and Government , by MarciaSmith, et al. One aspect of the Internet ("online") privacy debate focuses on whether industry selfregulation or legislation is the best route to assure consumer privacy protection. In particular,consumers appear concerned about the extent to which website operators collect "personallyidentifiable information" (PII) and share that data with third parties without their knowledge. Although many in Congress and the Clinton Administration preferred industry self regulation, the105th Congress passed legislation (COPPA, see below) to protect the privacy of children under 13as they use commercial websites. Many bills have been introduced since that time regardingprotection of those not covered by COPPA, but the only legislation that has passed concerns federalgovernment, not commercial, websites. Congress, the Clinton Administration, and the Federal Trade Commission (FTC) initiallyfocused their attention on protecting the privacy of children under 13 as they visit commercialwebsites. Not only are there concerns about information children might divulge about themselves,but also about their parents. The result was the Children's Online Privacy Protection Act (COPPA),Title XIII of Division C of the FY1999 Omnibus Consolidated and Emergency SupplementalAppropriations Act, P.L. 105-277 . (1) The FTC's final rule implementing the law became effective April21, 2000 http://www.ftc.gov/os/1999/10/64fr59888.htm . Commercial websites and online servicesdirected to children under 13, or that knowingly collect information from them, must inform parentsof their information practices and obtain verifiable parental consent before collecting, using, ordisclosing personal information from children. The Commission adopted a "sliding scale" forcomplying with the verifiable consent requirement depending on how the data would be used. Thatis, if the information was for internal use only, the verifiable consent could be obtained from theparent by e-mail, plus an additional step to ensure the person giving consent is, in fact, the parent. If the website operator planned to disclose the information publicly or to third parties, a higherstandard was set. This sliding scale was set to expire in 2002 with the expectation that betterverification technologies would become available. However, in 2002, the FTC determined that suchtechnologies still were not available, and the sliding scale was extended to April 12, 2005. In 2005,the Commission extended it again, and is seeking public comment on how to proceed, as part of itsoverall review of the COPPA rule. (2) The law also provides for industry groups or others to develop self-regulatory "safe harbor"guidelines that, if approved by the FTC, can be used by websites to comply with the law. The FTCapproved self-regulatory guidelines proposed by the Better Business Bureau on January 26, 2001. On June 11, 2003, then-FTC Chairman Timothy Muris stated in testimony to the Senate CommerceCommittee that the FTC had brought eight COPPA cases, and obtained agreements requiringpayment of civil penalties totaling more than $350,000. (3) As required by COPPA, on April 21, 2005, the Commission issued a request for publiccomment on its final rule, five years after the rule's effective date. (4) Comments were requestedon the costs and benefits of the rule; whether it should be retained, eliminated, or modified; and itseffect on practices relating to the collection of information relating to children, children's ability toaccess information of their choice online, and the availability of websites directed to children. The FTC conducted or sponsored several surveys between 1997 and 2000 to determine theextent to which commercial website operators abided by four fair information practices -- providing notice to users of their information practices before collecting personal information, allowing users choice as to whether and how personal information is used, allowing users access to data collectedand the ability to contest its accuracy, and ensuring security of the information from unauthorizeduse. Some include enforcement as a fifth fair information practice. Regarding choice, the term" opt-in " refers to a requirement that a consumer give affirmative consent to an information practice,while " opt-out " means that permission is assumed unless the consumer indicates otherwise. Seearchived CRS Report RL30784, Internet Privacy: An Analysis of Technology and Policy Issues , byMarcia Smith (available from author), for more information on the FTC surveys and fair informationpractices. The FTC's reports are available on its website http://www.ftc.gov . Briefly, the first two FTC surveys (December 1997 and June 1998) created concern about theinformation practices of websites directed at children and led to the enactment of COPPA (seeabove). The FTC continued monitoring websites to determine if legislation was needed for thosenot covered by COPPA. In 1999, the FTC concluded that more legislation was not needed at thattime because of indications of progress by industry at self-regulation, including creation of "seal"programs (see below) and by two surveys conducted by Georgetown University. However, in May2000, the FTC changed its mind following another survey that found only 20% of randomly visitedwebsites and 42% of the 100 most popular websites had implemented all four fair informationpractices. The FTC voted to recommend that Congress pass legislation requiring websites to adhereto the four fair information practices, but the 3-2 vote indicated division within the Commission. On October 4, 2001, Timothy Muris, who had recently become FTC Chairman, stated that he did notsee a need for additional legislation at that time. (Mr. Muris was succeeded as FTC Chairman onAugust 16, 2004 by Deborah Platt Majoras.) In 1998, members of the online industry formed the Online Privacy Alliance (OPA) toencourage industry self regulation. OPA developed a set of privacy guidelines, and its members arerequired to adopt and implement posted privacy policies. The Better Business Bureau (BBB),TRUSTe, and WebTrust have established "seals" for websites. To display a seal from one of thoseorganizations, a website operator must agree to abide by certain privacy principles (some of whichare based on the OPA guidelines), a complaint resolution process, and to being monitored forcompliance. Advocates of self regulation argue that these seal programs demonstrate industry'sability to police itself. Technological solutions also are being offered. P3P (Platform for Privacy Preferences) is onesuch technology. It essentially creates machine-readable privacy policies through which users canmatch their privacy preferences with the privacy policies of the websites they visit. One concern isthat P3P requires companies to produce shortened versions of their privacy policies, which couldraise issues of whether the shortened policies are legally binding, since they may omit nuances and"sacrifice accuracy for brevity." (5) For more information on P3P, see http://www.w3.org/P3P/ . Consumer, privacy rights and other interest groups believe self regulation is insufficient. They argue that the seal programs do not carry the weight of law, and that while a site may discloseits privacy policy, that does not necessarily equate to having a policy that protects privacy. TheCenter for Democracy and Technology (CDT, at http://www.cdt.org ) and the Electronic PrivacyInformation Center (EPIC, at http://www.epic.org ) each released reports on this topic. EPIC's mostrecent report, Privacy Self Regulation: A Decade of Disappointment , argues that the National DoNot Call list, which restricts telemarketing phone calls, demonstrates that government regulation canbe more effective than industry self regulation. Calling telemarketing a 20th century problem, thereport concludes that the FTC has given self regulation a decade to work in the Internet privacyarena, and it is time for the agency "to apply the lessons from telemarketing and other efforts toaddress the 21st century [sic] problem of Internet privacy." (6) Some privacy interest groups, such as EPIC, also feel that P3P is insufficient, arguing thatit is too complex and confusing and fails to address many privacy issues. An EPIC report from June2000 further explains its findings http://www.epic.org/reports/prettypoorprivacy.html . Privacy advocates have been particularly concerned about online profiling, where companiescollect data about what websites are visited by a particular user and develop profiles of that user'spreferences and interests for targeted advertising.