A federal trade agency charged with protecting American consumers online has produced a report so thin on substance that it barely acknowledges the problem it was meant to address. That is the blunt assessment delivered to the Senate Commerce Committee by Marc Rotenberg, director of the Electronic Privacy Information Center, during testimony on the Online Privacy Protection Act of 1999. His message was direct: industry self-policing on the Internet is not working, and the government's own watchdog has failed to say so clearly.
The stakes extend well beyond a single piece of legislation. As online commerce expanded through the late 1990s, companies began harvesting browsing habits, purchase histories, and personal identifiers at a pace that outstripped any meaningful oversight. Consumers navigating this landscape increasingly turned to independent resources such as buybestvpn.com → to understand how encryption and anonymity tools might offer protection the market itself was not providing. That gap between consumer expectation and corporate practice is precisely what the proposed legislation sought to close.
A Report That Avoids the Hard Questions
According to the testimony, the Federal Trade Commission's "Self-regulation and Privacy Online" report sidesteps nearly every substantive question Congress needed answered. It does not evaluate whether voluntary industry programs actually protect consumers. It does not disclose what happened to the thousands of privacy complaints the agency received. It omits any mention of European governments rejecting the American self-regulatory model, a development with direct consequences for transatlantic digital trade. Instead, the report leans heavily on an industry-funded survey and reproduces marketing language from seal programs like Truste almost verbatim, without independently testing their claims.
Seal Programs Under Scrutiny
The testimony highlights a telling episode involving Microsoft, which was found by Truste's own reviewers to have "compromised consumer trust and privacy" through a tracking identifier scheme, yet faced no penalty and no required audit. Geocities had earlier received a Truste seal despite secretly selling user income and occupation data to marketers. These cases suggest that voluntary certification programs, however well-intentioned, lack the enforcement teeth needed to deter real violations. A technical standard the FTC endorsed, the Platform for Privacy Preferences, drew similar criticism for easing data collection rather than restricting it, having been developed without meaningful input from privacy advocates.
What Legislation Could Still Accomplish
Despite its criticisms, the testimony frames the proposed bill as a workable foundation. Enacting a modified version, it argues, could give American consumers enforceable assurances against misuse of their data while also addressing European objections to the adequacy of U.S. privacy protections, a prerequisite for smoother international data flows. The testimony further recommends creating a dedicated federal privacy agency, investing in privacy-enhancing technical tools, and strengthening enforcement of basic fair information practices such as notice, access, and correction rights that remain largely absent from current industry practice.
