The Obama administration raised alarm Wednesday about the state of online privacy and called for new legislation on the issue. Speaking before the Senate Commerce Committee, Assistant Commerce Secretary Lawrence Strickling announced the Obama administration's support for a "consumer privacy bill of rights" and asked Congress to give the Federal Trade Commission new powers to enforce it.

At the same hearing, FTC Chairman Jon Leibowitz reiterated his agency's support for a "Do Not Track" mechanism and urged Congress to mandate its adoption if the industry does not embrace the idea voluntarily. Leibowitz pointed to his agency's recent enforcement action against Chitika as evidence that the FTC was making online privacy a priority, but argued that more action—by industry and possibly from Congress—was needed to fully address the problem.

"I'm agnostic about whether the private sector does Do Not Track or Congress requires it," Leibowitz told the committee. He praised Microsoft and Mozilla for adding anti-tracking features to their browsers and promised that his agency would monitor industry developments closely.

Leibowitz and Strickling's proposals were not meet with universal acclaim from the handful of senators who attended the hearing. Senator Claire McCaskill (D-MO) worried that a Do Not Track rule might cause some companies to charge for services that are currently available for free. And she worried that the legislation would "handcuff the good guys" while doing little to stop bad actors who are likely to simply ignore a Do Not Track flag. "We need to be very careful about unintended consequences." McCaskill warned. "Don't kill the goose that laid the golden egg here."

A second panel at the hearing included representatives from Microsoft, the online ad firm GroupM Interaction, and the ACLU. The ACLU's Christopher Calabrese voiced strong support for the Do Not Track concept. "Self-regulation is a failed approach," he said. "Without change, the Internet will be transformed from a library and a playground to a fishbowl."

Sen John Kerry (D-MA), who is drafting legislation to implement many of Leibowitz and Strickling's recommendations, complained about the shortcomings of current law. "Once a person's information is collected, there are no further legal restrictions on distribution," he said. He floated the idea of establishing a legal safe harbor for companies that agree to adopt privacy practices that are consistent with FTC guidelines.

Microsoft's Erich Andersen touted the anti-tracking feature of Internet Explorer 9 in his testimony. Kerry grilled Anderson about the location of the option, repeatedly asking whether it is presented at browser installation time (it isn't). When Anderson told the senator that users choose Do Not Track from a menu, he pressed him for details, worrying that the option would be buried. "When you really want to get somebody's attention, you guys know how to do it," he said. "How bold is the choice?"

Kerry asked Leibowitz if his agency was opposed to online advertising. Leibowitz responded that the FTC didn't have any objection to advertising—or even to tracking. Indeed, Leibowitz stated that he was unlikely to use the Do Not Track option himself. However, he argued that consumers should have the option to opt out of tracking if they want to.

Online privacy legislation faces an uncertain future in the Congress. Kerry is reportedly working with John McCain (R-AZ) on Senate legislation. Rep. Bobby Rush (D-IL) is drafting companion legislation in the House, and Rep. Jackie Speier (D-CA) has introduced a standalone Do Not Track bill. But with a full legislative calendar and a Republican majority in the House that's likely to be skeptical of any new government regulation of the Internet, the FTC may need to do its best with the regulatory powers it already has.