I have seen a couple of articles recently on the third attempt by Congress to pass an anti-spyware bill (this time H.R.964 aka "The Spy Act"). False Sense Of Security? Even if the law is needed to intervene, it is unlikely to impact a significant fraction of the offenders, who are operating in countries and jurisdictions that are uncooperative with US law enforcement. Foreign criminal elements will laugh at these laws, and there may be a danger if the passage of a law lulls people into a sense of false security, causing them to lower their guard.

It is interesting to see the Direct Marketing Association (DMA) fighting this legislation so aggressively. The plea for self regulation clearly indicates a desire to continue using these kinds of tactics. Specifically, Dave Morgan of the Interactive Advertising Bureau (IAB) described "consent" and "prescriptive notice" as "extreme measures." while to me these seem the least requirement for "informed consent" and should form the baseline of privacy policy.

The core principle is that people need to have the ability to know when their information is being captured, know how it will be used, and have some ability to avoid this if they so choose. Legislation that effectively embodies this will be robust against the fast changing technological background, while narrowly tailored laws are likely to be easily bypassed by new technical tricks.