US proposes anti-tracking legislation

A US congressman has proposed legislation that would force operators disclose to whether the handsets they sell contain tracking software to consumers upon purchase.

Under the proposals from Congressman Edward J. Markey, operators would also have to notify consumers of whether monitoring software might be installed at a later date by the carrier, manufacturer or OS provider.

Markey, co-chair of the Bi-Partisan Congressional Privacy Caucus, proposed the legislation after it emerged late last year that mobile software provider Carrier IQ was found to be logging information in its software, such as location data, without notifying users or allowing them to opt-out. The information tracked included detailed keystroke logs, which potentially violates US federal law.

“Consumers have the right to know and to say no to the presence of software on their mobile devices that can collect and transmit their personal and sensitive information,” said Markey.

“While consumers rely on their phones, their phones relay all sorts of information about them, often without their knowledge or consent. I am concerned about the threat to consumers’ privacy posed by electronic monitoring software on mobile phones, such as the software developed by Carrier IQ.”

He added that the draft legislation aims to provide greater transparency into the transmission of consumers’ personal information and empower consumers to opt-out of such transmission.

The “Mobile Device Privacy Act” would protect consumers by requiring:

– Disclosure of mobile telephone monitoring software, when a consumer buys a new handset, if the carrier, manufacturer, or operating system later installs monitoring software; or if a consumer downloads an app and that app contains monitoring software.

– Disclosure to include the fact that the monitoring software has been installed on the phone, the types of information that are collected, the identity of the third party to which the information is transmitted, and how such information will be used.

– Consumer consent is obtained before monitoring software begins collecting and transmitting information.

– The third parties that receive the personal information must have policies in place to secure the information.

– Agreements on transmission to third parties must be filed at the Federal Trade Commission (FTC) and Federal Communications Commission (FCC).

– Outline an enforcement regime for the FTC and FCC, along with State Attorney General enforcement and a private right of action.