The collection and use of personal information by websites, Internet service providers, direct marketers, data brokers, network advertisers, law enforcement entities, and others has raised privacy concerns. Personal information is readily available because of the widespread usage of the Internet and of cloud computing, the availability of inexpensive computer storage, and increased disclosures of personal information by Internet users in participatory Web 2.0 technologies. The increased availability of online personal information has fueled the creation of a new tracking industry. Behavioral advertising, a form of online advertising, is delivered based on consumer preferences or interest as inferred from data about online activities. In 2010, over $22 billion was spent on online advertising. This revenue allows websites to offer content and services for free. What They Know , an in-depth investigative series by the Wall Street Journal, found that one of the fastest growing Internet business models is of data-gatherers engaged in "intensive surveillance of people [visiting websites] to sell data about, and predictions of, their interests and activities, in real time." Websites such as Spokeo, an online data aggregator and broker, give site visitors vast quantities of personal information. Congress is examining the use of new technologies (such as flash cookies), and the privacy practices of the 15 websites identified as installing the most tracking technology on their visitors' computers. Consumers and public interest groups are filing complaints to challenge the collection and use of consumer data without consumer consent or knowledge. Online privacy concerns are widespread. Stakeholders routinely acknowledge that the continued success of electronic commerce depends upon the resolution of issues related to the privacy and security of online personal information. The U.S. Department of Commerce recently reiterated that the large-scale collection, analysis, and storage of personal information is central to the Internet economy; and that regulation of online personal information must not impede commerce. The Commerce Department's report on Commercial Data Privacy calls on Congress to create a "privacy bill of rights," and concludes that privacy policies are now widely viewed as ineffective for the protection of personal information. A recent Federal Trade Commission (FTC) Staff Report recommended implementation, either through legislation or self-regulation, of a Do Not Track system to allow consumers to opt out of online tracking or advertising. Developers, organizations, and businesses are voluntarily working on ways to allow users to opt out of behavior advertising. The U.S. Congress continues to examine the federal legal framework that protects personal information. Historically, Congress has played a major role in protecting personal information online. Beginning in the late 1990s, Congress passed laws aimed at specific online harms and amended existing laws to reflect the ways in which technology was being used to collect, use, and share personal information. Beginning with the 109 th Congress, every Congress has held numerous privacy-related hearings. The current Congressional privacy agenda is broad and includes items that Congress has worked on for several years, new issues posed by advances in technology, and items related to efforts to update the electronic surveillance laws for advances in technology. Reportedly, several Members in the 112 th Congress plan to introduce or reintroduce substantive privacy legislation. Online consumer privacy is an issue that is at the forefront of the Senate Commerce Committee's agenda, and it is a top priority for Chairman Rockefeller. Senator Kerry, Chairman of the Commerce Subcommittee on Communications, Technology and the Internet, along with Senator McCain, intend to introduce a privacy bill similar to the Obama Administration's legislative framework. Representative Rush reintroduced a comprehensive privacy bill, H.R. 611 , to require businesses to disclose details about their data-collection practices and allow consumers to make choices about such activities. Representative Stearns announced that he had drafted a consumer privacy bill with a provision to establish an FTC-approved self-regulatory program. The House Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade Chair Bono Mack said that the subcommittee will examine online privacy issues in hearings. Senate Judiciary Chairman Leahy has a long-standing interest in privacy, and his committee has several initiatives underway. A new Senate Committee on the Judiciary Subcommittee on Privacy, Technology and the Law was created in the 112 th Congress with jurisdiction covering oversight of laws and policies governing the collection, protection, use, and dissemination of commercial information by the private sector, including online behavioral advertising, privacy within social networking websites, and other online privacy issues. Senator Wyden has also announced plans to draft a bill to clarify what legal standards law enforcers and intelligence agents must satisfy before tracking an individual's physical movements using geolocation data generated by a mobile device. Important policy questions include whether Congress should draft legislation tailored to specific privacy threats (such as online behavioral advertising) or whether a broader, comprehensive federal privacy law is desirable. There is a growing consensus among stakeholders that basic privacy rules are necessary. However, consensus is lacking about the elements of a federal privacy law: what types of information it should cover (personal identifying information or more general information that is associated with a computer or device); how far it should reach; whether it should cover data collection or merely use; and who should be able to enforce it. One legal scholar posits that [i]t may be helpful to pull back the lens and see if it is possible to create a larger-scale outline of privacy. This broader perspective may help to illuminate the constituent elements of a privacy incursion, and the interrelationships between those elements. In this context, . . [there are] six discrete aspects of privacy relating to: (1) actors–relationships; (2) conduct; (3) motivations; (4) harms–remedies; (5) nature of information; and (6) format of information. Businesses view U.S. sector-by-sector regulation of personal information as an impediment to commerce and seek simplification. For example, Microsoft recommends a multi- pronged approach to the protection of individuals' privacy that includes legislation, industry self- regulation, technology tools, and consumer education. Three principles—transparency, control, and security—underpin Microsoft's approach to privacy. Under this approach, privacy protections would not be specific to any one technology, industry, or business model; would apply across sectors; would provide consistent baseline protections for consumers; and would simplify compliance. In addition, privacy legislation would preempt state laws that are inconsistent with federal policy. At the end of the 19 th century, a seminal law review article was published that developed the basic principle of American privacy law—the "right to be let alone." The article was written in response to invasions of personal privacy caused by the technological innovations of mass printing (newspapers) and the portable camera (photographs). Following this article, American common law jurisprudence developed four distinct tort remedies to protect personal privacy: false light, misappropriation, public disclosure of private facts, and intrusion upon seclusion. With the late 20 th century technological innovations of the Internet and the World Wide Web, the collection, use, and dissemination of electronic personal information is potentially much more invasive. As noted above, the right to privacy has long been characterized as the "the right to be let alone." And yet, today the more practical view may be that "[i]n the digital era, privacy is no longer about being 'let alone.' Privacy is about knowing what data is being collected and what is happening to it, having choices about how it is collected and used, and being confident that it is secure." Some advocate the expansion of this concept to include the right to "information privacy" for online transactions and personally identifiable information. The term "information privacy" refers to an individual's claim to control the terms under which "personal information"—information that can be linked to an individual or distinct group of individuals (e.g., a household)—is acquired, disclosed, and used. Others urge the construction of a market for personal information, to be viewed no differently than other commodities in the market. In the United States there is no comprehensive legal protection for personal information. The Constitution protects the privacy of personal information in a limited number of ways, and extends only to the protection of the individual against government intrusions. Constitutional guarantees are not applicable unless "state action" has taken place. Many of the threats to the privacy of personal information addressed in this report occur in the private sector, and are unlikely to meet the requirements of the "state action" doctrine. As a result, any limitations placed on the data collection activities of the private sector will be found not in the federal Constitution but in federal or state statutory law or common law. The federal Constitution makes no explicit mention of a "right of privacy," and the "zones of privacy" recognized by the Supreme Court are very limited. The Fourth Amendment search-and-seizure provision protects a right of privacy by requiring warrants before government may invade one's internal space or by requiring that warrantless invasions be reasonable. However, "the Fourth Amendment cannot be translated into a general constitutional 'right to privacy.' That Amendment protects individual privacy against certain kinds of governmental intrusion, but its protections go further, and often have nothing to do with privacy at all." Similarly, the Fifth Amendment's self-incrimination clause was once thought of as a source of protection from governmental compulsion to reveal one's private papers, but the Court has refused to interpret the self-incrimination clause as a source of privacy protection. In Whalen v. Roe , the Supreme Court recognized an implicit constitutional "right of informational privacy." Whalen concerned a New York law that created a centralized state computer file of the names and addresses of all persons who obtained medicines containing narcotics pursuant to a doctor's prescription. Although the Court upheld the state's authority, it found this gathering of information to affect two interests. The first was an "individual interest in avoiding disclosure of personal matters"; the other, "the interest in independence in making certain kinds of important decisions."