Onward online privacy

Responding to a steady drumbeat of privacy violations online, the White House proposed a privacy bill of rights for Internet users Thursday that could give them more say over how personal information is collected and used. The initiative is a good starting point, as is a new effort by California Atty. Gen. Kamala Harris to require companies developing applications for smartphones and tablet computers to disclose their privacy policies. But they also highlight how tricky it is to set rules that guard sensitive personal information without hindering innovation or quickly becoming obsolete.

The “Consumer Privacy Bill of Rights” offers a sensible set of principles for online privacy, calling on Web companies to minimize their collection of personal data, help users make informed choices about the information they reveal, and not use personal data for new purposes without the user’s consent. The point is to set privacy standards without telling companies how to meet them. That flexibility is indispensable, considering how rapidly technology is changing online.

One challenge is how to enforce those principles. The White House wants to put them into law, and that’s a good idea — provided that lawmakers resist the urge to require or ban specific technolgies. Until then, the administration plans to work with industry groups and other interested parties on an optional code of conduct that will be legally enforceable. Why any Web company’s legal advisers would allow it to agree to such a code is a mystery, especially if there’s no guarantee that its competitors or disruptive new entrants will.

Nor will the principles stop privacy abuses online. Consider the first fruit of the initiative: an agreement by a coalition of major Web companies to give Web users a “do not track” button in browsers to block some advertisers from following their movements online. Although the button could make it harder for ad networks to personalize the ads people see online, it won’t stop a company from assembling and selling revealing portraits of its users based on the things they see and say on all the sites run by that company. The company would simply have to disclose what it’s doing.

Ultimately, however, a disclosure-based approach may strike the best balance. Federal law already provides safeguards for sensitive personal information, such as health and credit data. The Federal Trade Commission and California prosecutors have the power to crack down on companies that make misleading statements about their privacy policies. And pressure from users has forced companies such as Facebook and Google to be more protective of other types of personal information they collect. Like Harris’ move, the White House initiative will not only give consumers a bit more control over their information, but also shine more light on what companies are doing with it so users can make better choices.