Technology stokes new privacy fears

Consumers worry about their Internet privacy. Politicians vow to investigate. And two of the nation's biggest tech companies, Google Inc. and Microsoft Corp., support federal legislation for data collection.

So why isn't much happening?

One reason is that legislators find the subject kind of confusing.

At the end of a two-hour Senate committee hearing Tuesday on Internet advertising and privacy, Sen. Byron L. Dorgan (D-N.D.), who led the panel, said the affair had chiefly served to emphasize "how little we do understand."

Sen. Thomas R. Carper (D-Del.) remarked wryly that because of all the talk about "cookies" and other Web terms, he was going to have to "update my dictionary."

And Sen. Bill Nelson (D-Fla.) asked a question about Internet connections so muddled that apparently no one understood it.

"I think I'm not entirely sure of what you are suggesting, senator," the witness answered.

"Nor am I," he said.

The Senate hearing had been called amid fears that the massive volumes of information about users that Internet companies are collecting is violating their privacy.

For years, websites have assembled profiles of users consisting of personal preferences and activities.

But as websites have increasingly been united in vast ad networks, the various profiles maintained by separate sites have combined to create more detailed and far-ranging portraits of users.

Over the last year, moreover, some Internet service providers have begun experimenting with a practice that would offer even more detailed portraits of individuals. The technology, known as "deep packet inspection," allows ISPs to peer into the stream of data coming from a person's Internet line, a practice critics liken to wiretapping.

Assembled before the Senate committee were representatives of Google, Microsoft, Facebook and NebuAd, one of the companies that provide deep packet inspection technology to Internet service providers.

All of them assured the panel that they were doing their best to protect privacy.

To pass any kind of law on the subject, Congress is expected to have to wrestle with thorny technical and philosophical questions.

If "personally identifiable information" is to be guarded by the law, what constitutes personally identifiable information? Should a person's numerical Internet address be considered private?