This article describes Representative Boucher’s approach to resolving the opt-in versus opt-out conundrum:
Boucher expects to set different rules for different types of sites. Sites that collect visitor information in order to target advertising on their own pages, for instance, would have to offer consumers a chance to opt out of having their interests tracked. These sites would also be required to prominently disclose what information they collect and provide a detailed description of how that information is used.
Web sites that deal with sensitive personal information, such as medical and financial data, sexual orientation, Social Security numbers and other ID numbers, would have to ask users to opt in to being tracked.
This compromise would probably make most online publisher’s happy, since few of them are focused on the most sensitive categories. For sites and networks focused on sensitive areas like health, it will be a whole new ballgame.
An important detail is whether and how ad networks will need to classify sites to ensure that they avoid any opt-in requirements by excluding sensitively classified sites (and pages). If ad networks happen to collect information from sites or pages in sensitive areas, is it enough that they don’t use sensitive categories to target advertising, or do they need to avoid collection of information altogether if the context is sensitive?
My guess is that the mere collection of information in sensitive contexts strikes at core concerns about profiling, which means ad networks will need to literarally exclude pages from any collection or use based on some kind of contextual screening. Although no solution is perfect, this doesn’t sound like a difficult technical challenge, since most networks already consider page context as part of the package of targeting parameters.