Federal agencies cannot make use of data tracking software, known as "cookies", on any federal Web sites under a new policy announced last week by the Office of Management and Budget.
OMB director Jacob Lew issued a memo to agency heads Thursday, informing them of the new policy. OMB's action came just one day after the White House's Office of National Drug Control Policy was ordered to stop using cookies to track Web users who clicked on its anti-drug advertising.
"Because of the unique laws and traditions about government access to citizens' personal information, the presumption should be that "cookies" will not be used at federal Web sites," Lew wrote.
A cookie is a small piece of information written to the hard drive of the computer of a Web surfer visiting a Web site. The files can extract a variety of information, including where on the site the user visited.
Under the new policy, federal Web sites, including sites operated by contractors on behalf of agencies, cannot use cookies unless certain conditions are met. The conditions are:
- A compelling need to gather the data on the site.
- Publicly disclosed privacy safeguards for handling the information collected.
- Personal approval by the head of the agency.
Lew also reminded agencies of their responsibility to post clear privacy policies on their Web sites, and to stick to those policies.
"If an agency Web site states that the information provided will not be available to any other entities, it is the responsibility of the agency to assure that no such sharing takes place," the memo stated.
Agencies must submit descriptions of their privacy policies and steps taken to comply with the new no-cookies rule as part of their annual budget submissions this fall, Lew said.
The drug policy office came under fire for using New York-based online advertising company Doubleclick to track the effectiveness of its anti-drug Web banner ads on a Web site called freevibe.com. Online privacy advocates say government collection of data from private citizens may be illegal under the Privacy Act of 1974.
NEXT STORY: Employees win $232 million pay settlement