Gerry Tschopp, the senior vice president for public affairs at Experian North America, said Experian was still reviewing the report but said "we do provide consumers with choices, we comply with all applicable laws, follow established industry self-regulatory guidelines and use a variety of processes and procedures to safeguard consumer data.”

Michael Zaneis, senior vice president and general counsel of the Interactive Advertising Bureau, an industry trade group, said it was important that any data broker legislation not be so broad in scope that it would include "virtually every publisher site, advertiser, ad network, or analytics firm” that collects or shares data with other parties. This interconnection, he said, "makes the digital economy work. We would not want to see legislation introduced that would harm the most fundamental operations of the Internet.”

Consumer privacy advocates mostly favored the commission’s final report. "Data brokers buy, compile and sell a wealth of highly personal information about you, but there’s no way to find out what they have or if it’s correct,” said John M. Simpson, the head of Consumer Watchdog, which advocates for digital privacy. "That’s why the F.T.C.’s call for legislation in this area is so important.”

Jeffrey Chester, the head of the Center for Digital Democracy, said, "In its call for Congress to enact legislation to rein in the data broker industry, the F.T.C. has opened up an important new ‘front’ in the battle to protect consumer privacy.”

In its report on online privacy last month, the White House recommended that Internet companies that collect personal data and then sell or lease it to third-party brokers should "prominently and explicitly” tell consumers they do so and "provide consumers with meaningful opportunities to prevent these disclosures.”

The F.T.C. suggested that the guidelines should not affect small businesses that collect online data from fewer than 5,000 people and do not sell that data to third parties. It would also loosen the guidelines for companies that collect data for the purposes consistent with the context of a user’s visit to a particular Web site. For example, if a user buys something on a Web site, the company would be able to collect data on that user and would not be required to offer consumers the option to opt out of data collection.