	Introduction

Internet privacy issues encompass several concerns. One is the collection of personallyidentifiable information (PII) by website operators from visitors to government and commercialwebsites, or by software that is surreptitiously installed on a user's computer ("spyware") andtransmits the information to someone else. Another is the monitoring of electronic mail and Webusage by the government or law enforcement officials, employers, or e-mail service providers. Another issue, identity theft, is not an Internet privacy issue per se, but is often debated in the contextof whether the Internet makes identity theft more prevalent. For example, Internet-based practicescalled "phishing" and "pharming" may contribute to identity theft. This report provides an overview of Internet privacy-related issues and related laws passedin previous Congresses, and discusses legislative activity in the first session of the 109th Congress. Background information on Internet privacy issues is available in an archived CRS Report RL30784, Internet Privacy: An Analysis of Technology and Policy Issues , by Marcia Smith(available from author); and CRS Report RL31289 , The Internet and the USA PATRIOT Act:Potential Implications for Electronic Privacy, Security, Commerce, and Government , by MarciaSmith, et al. Although many in Congress and the Clinton Administration preferred industry self regulation, the105th Congress passed legislation (COPPA, see below) to protect the privacy of children under 13as they use commercial websites. Many bills have been introduced since that time regardingprotection of those not covered by COPPA, but the only legislation that has passed concerns federalgovernment, not commercial, websites. Children's Online Privacy Protection Act (COPPA), P.L. 105-277 . Some include enforcement as a fifth fair information practice. The E-Government Act ( P.L. In the wake of theSeptember 11 terrorist attacks, the debate over law enforcement monitoring has intensified. 107-56 , which expands lawenforcement's ability to monitor Internet activities. Sections 212 and 217 are not, andtherefore will expire on December 31, 2005. The Cyber Security Enhancement Act, section 225 of the 2002 Homeland Security Act ( P.L.107-296 ), amends section 212 of the USA PATRIOT Act. It lowers the threshold for when ISPsmay voluntarily divulge the content of communications. Debate may be influenced by revelations in December 2005 that President George W. Bush directedthe National Security Agency to monitor phone calls and e-mails in the United States withoutwarrants. Spyware

Spyware is discussed in more detail in CRS Report RL32706 , Spyware: Background andPolicy Issues for Congress , by Marcia Smith. FTC representatives and others caution that new legislation couldhave unintended consequences, barring current or future technologies that might, in fact, havebeneficial uses. The FACT Act ( P.L. Among its identity theft-related provisions, the law:
requires consumer reporting agencies (CRAs) to follow certain proceduresconcerning when to place, and what to do in response to, fraud alerts on consumers' creditfiles;
allows consumers one free copy of their consumer report each year fromnationwide CRAs as long as the consumer requests it through a centralized source under rules to beestablished by the FTC; (38)
allows consumers one free copy of their consumer report each year fromnationwide specialty CRAs (medical records or payments, residential or tenant history, check writinghistory, employment history, and insurance claims) upon request pursuant to regulations to beestablished by the FTC; 
requires credit card issuers to follow certain procedures if additional cards arerequested within 30 days of a change of address notification for the sameaccount;
requires the truncation of credit card numbers on electronically printedreceipts;
requires business entities to provide records evidencing transactions allegedto be the result of identity theft to the victim and to law enforcement agencies authorized by thevictim to take receipt of the records in question;
requires CRAs to block the reporting of information in a consumer's file thatresulted from identity theft and to notify the furnisher of the information in question that it may bethe result of identity theft;
requires federal banking agencies, the FTC, and the National Credit UnionAdministration to jointly develop guidelines for use by financial institutions, creditors and otherusers of consumer reports regarding identity theft; and
extends the statute of limitations for when identity theft cases can bebrought.
Internet privacy issues encompass several types of concerns. One is the collection ofpersonally identifiable information (PII) by website operators from visitors to government andcommercial websites, or by software that is surreptitiously installed on a user's computer ("spyware")and transmits the information to someone else. Another is the monitoring of electronic mail andWeb usage by the government or law enforcement officials, employers, or email service providers.
The September 11, 2001 terrorist attacks intensified debate over the issue of monitoring bythe government and law enforcement officials, with some advocating increased tools to help themtrack down terrorists, and others cautioning that fundamental tenets of democracy, such as privacy,not be endangered in that pursuit. Congress passed the 2001 USA PATRIOT Act ( P.L. 107-56 ) that, inter alia , makes it easier for law enforcement officials to monitor Internet activities. That act wasamended by the Homeland Security Act ( P.L. 107-296 ), loosening restrictions as to when, and towhom, Internet Service Providers may voluntarily release the content of communications if theybelieve there is a danger of death or injury. Some provisions of the USA PATRIOT Act, includingtwo that relate to Internet use, would have expired on December 31, 2005. Congress passed a briefextension (to February 3, 2006) in P.L. 109-160 . Debate over whether civil liberties protectionsneed to be added if the provisions are to be made permanent is expected to continue in the secondsession of the 109th Congress. Revelations that President Bush directed the National SecurityAgency to monitor some communications, including e-mails, in the United States without warrantsmay affect those deliberations.
The debate over website information policies concerns whether industry self regulation orlegislation is the best approach to protecting consumer privacy. Congress has considered legislationthat would require commercial website operators to follow certain fair information practices, but theonly law that has been enacted (COPPA, P.L. 105-277 ) concerns the privacy of children under 13,not the general public. Legislation has passed regarding information practices for federalgovernment websites, including the E-Government Act ( P.L. 107-347 ).
The growing controversy about how to protect computer users from "spyware" withoutcreating unintended consequences is discussed briefly in this report, but in more detail in CRS Report RL32706 . Another issue, identity theft, is not an Internet privacy issue per se, but is oftendebated in the context of whether the Internet makes identity theft more prevalent. For example,Internet-based practices called "phishing" and "pharming" may contribute to identity theft. Identitytheft is briefly discussed in this report; more information is available in CRS Report RS22082 , CRS Report RL31919 , and CRS Report RL32535 . Wireless privacy issues are discussed in CRS Report RL31636 .
This is the final edition of this report. It provides an overview of Internet privacy issues andrelated laws passed in previous Congresses, and discusses legislative activity in the first session ofthe 109th Congress.