Online businesses know a lot about their customers—and they can easily learn a lot more. What standards should web sites follow with personally identifiable information that they gather?

As with any business, online service providers know the names, addresses, and frequently the credit card numbers of their subscribers. But records kept by the provider’s computers can also keep track of who their customers exchange email with, when they log in, and when they go on vacation.

Internet service providers can learn even more about their customers, because all information that an Internet user sees must first pass through the provider’s computers. ISPs can also determine the web sites that their users frequent—or even the individual articles that have been viewed. By tracking this information, an Internet provider can tell if its users are interested in boats or cars, whether they care about fashion, or even if they are interested in particular medical diseases.

In January 1997, Congressman Bruce F. Vento introduced the Consumer Internet Privacy Protection Act (HR 98) into the House of Representatives. The act would prohibit online services from releasing any personally identifiable information about their customers unless customers first gave explicit written consent.

Critics of the legislation say that it would put limits on online service providers that are unheard of in other kinds of business. After all, it is common practice for magazines and some stores to sell lists of their customers. Although most online services do not make subscriber information available, many wish to keep this option open for the future.

By forcing online services to obtain subscriber permission before releasing personal information, and by putting the force of law behind that policy, Vento’s bill runs counter to (voluntary) practices that have been established in other U.S. industries. Those practices generally require consumers to “opt-out” before data considered private is released.

Consumer and privacy advocates, meanwhile, have long been pressuring for the abandonment of “opt-out” practices and the institution of some form of mandatory controls. Voluntary controls are always subject to abuse, they say, because the controls are voluntary by their very nature.

Whether or not such legislation passes in the future, web surfers should be aware that information about their activities may be collected by service providers, vendors, site administrators, and others on the electronic superhighway. As such, users should perhaps be cautious about the web pages they visit if the pattern of accesses might be interpreted to the users’ detriment.