Out of the valley: The battle is on for consumer privacy

Fresh from his battles to keep the lights on during California's energy crisis, Governor Gray Davis last week found himself heavily embroiled in another major battle – consumer privacy. Over the next few weeks, the Californian state legislature will be grappling with a bill designed to bring in the tightest consumer protection seen so far in the US. This is not just a local issue: what passes in California may pave the way for federal legislation.

Much of the privacy legislation in the US has evolved on an ad hoc basis. Many loopholes exist, and any protection is usually provided on an "opt-out" basis, where data can be shared with third parties unless consumers specifically request otherwise, as opposed to "opt-in", where the onus is on companies to seek consumers' prior approval. But as companies become more sophisticated with electronic data, the arguments for greater protection are becoming vociferous. Privacy campaigners are seeking umbrella legislation that tackles these issues across all industries.

The original bill goes some way to meeting campaigners' demands. Last week, however, Mr Davis stepped into the fray, generally siding with business lobbyists in favour of "opt-out" provisions, rejecting clauses that would have allowed individuals to sue for breaches of the law, and suggesting companies should be able to sell data to telemarketing firms without specific consent. As Ed Mierzwinski, consumer program director at the Public Interest Research Groups' (PIRG) national office, says, that's like "writing your details down on the sidewalk".

Even if it's passed in a watered-down form, privacy campaigners believe the bill could seriously strengthen their hand. Faced with the prospect of fighting 49 other states over similar proposals, industry lobbyists may choose to take the battle straight to Congress, where they'll be arguing from a weaker position.

This heightened activity comes at a time when that other bastion of consumer protection, Microsoft, is fighting its own privacy battles. Earlier this summer, PIRG joined 12 other lobbying groups in filing a complaint to the Federal Trade Commission over the privacy implications of Microsoft's forthcoming XP operating system. Much of the controversy centres on two technologies that allow users to develop personal profiles as they access web services provided by Microsoft or its partners. While the features are ostensibly designed to personalise users' experiences on the web, the protesters argue that they have far-reaching privacy implications. "Internet users who seek to engage in online commerce will routinely disclose to Microsoft virtually all aspects of their private transactions with other merchants," the FTC submission claims. Microsoft, which has since modified some of its personalisation plans, responded with a scathing attack, accusing the groups of pursuing their own agendas.

The point for Microsoft, Mr Davis, PIRG, and everyone else is that somewhere, there has to be a middle ground between privacy and commercial sophistication. The problem is that the perfect balance simply may not exist.

Keith Rodgers is a technology writer based in Silicon Valley