Lawmaker pushes consumer notification bill in wake of Carrier IQ concerns

Computerworld - U.S. Rep. Edward Markey (D-Mass.) has proposed a bill that would require all phone companies to notify consumers of any user tracking and monitoring software in their cell phones.

Markey's proposed Mobile Device Privacy Act is in response to the recent controversy surrounding the use of Carrier IQ's user tracking software in millions of mobile phones from companies such as Sprint, AT&T and T-Mobile.

"Consumers have the right to know and to say no to the presence of software on their mobile devices that can collect and transmit their personal and sensitive information," Markey said in a statement today.

The bill would require phone companies to follow a laundry list of items before they can install and collect data using mobile-tracking tools.

The bill, for instance, would require companies to disclose the presence of tracking software in their handsets at the time of purchase. It would also require them to notify consumers if any tracking software is installed on their phones after sale, via software upgrades or in mobile applications.

The disclosure would need to include details such as the type of information that will be collected, how the information will be used and with whom the data will be shared.

Phone companies would be required to obtain explicit opt-in consent from users before they can collect data from mobile handsets. Third parties that collect or access such tracking data also would be required to have policies for protecting that data. All agreements with third parties would be filed with the Federal Trade Commission and the Federal Communications Commission.

Markey's proposed legislation is still only a discussion draft and there's no telling how far it will go in Congress. Still, it is a reflection of the widespread concerns caused by the discovery last November, that several phone companies had installed Carrier IQ's data collection software on their mobile handsets without notice or user consent.

Carrier IQ and the phone companies have steadfastly maintained that the software was used only to collect network and device-related data and not personal information.

However, their repeated assurances have done little to squelch concerns related to the use of Carrier IQ's software.

Markey, a senior member of the House Energy and Commerce Committee, last month asked the FTC to investigate whether Carrier IQ had violated statutes associated with unfair and deceptive trade practices.

Earlier this month, U.S. Reps. Henry Waxman (D-Calif.), G.K. Butterfield (D-N.C.) and Diana DeGette (D-Colo.) called for a similar investigation of the data collection and transmission capabilities of Carrier IQ's software and similar products from other vendors.

In addition, several companies including Carrier IQ, Sprint, AT&T, Apple and others have been hit with class-action lawsuits over the issue.

Following the outcry, Sprint said it would disable Carrier IQ's software on all 26 million handsets on which it had been installed. Apple said it would do the same on all iPhones in which Carrier IQ's software had been installed.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.

Read more about Privacy in Computerworld's Privacy Topic Center.