Web companies must gain explicit permission from consumers to collect their personal data, must honor delete request.

Web businesses must be prohibited from collecting and profiling of individual computer users unless they give their explicit consent as part of policies that allow them to specify what kinds of information could be collected and for what purpose. Businesses must permanently remove and delete personal information upon request, and national regulators should have the ability to fine companies up to 2 percent of their annual sales for not complying.