"Even in cases where the law doesn't restrict what a company does with personal data, you can certainly see situations where public outrage over what companies have done...have effectively imposed limits on how they use that data," said Smedinghoff.
If companies fail to impose rules on their own, "A legislative solution will surely be needed if industry doesn't step up to the plate," warned FTC Chairman Jon Leibowitz on a conference call with reporters in December.
Currently, there are several versions of a bill in Congress that would require web companies to provide opt out features for users. Under the plan browsers would have a button that disabled tracking and websites would cooperate with browser companies to restrict tracking when visited.
Sen. John Rockefeller D-W.V., introduced "Do Not Track" legislation in May and a bi-partisan bill released by Rep. Edward Markey D-Mass., and Rep. Joe Barton R-Texas, focuses solely on protecting children's privacy online. Both bills are being held up in the current legislative gridlock but some critics argue that creating a "do not track" list for kids would be counterproductive as it would require them to compile personal data on children.