It’s hardly a secret that Amazon, Facebook and Google monitor what their users do online and show themtargeted ads based on that data. But many users do not fully appreciate that this is also done by dozens of obscure online advertising networks. These companies place small files known as cookies on the computers and phones of people who visit Web sites that display ads they bought. These cookies allow them to serve up ads for, say, shoes that a consumer looked at on one site even as he moves to other sites. Such tracking is pervasive now, and the data is often put into detailed profiles that can also include information from public records and other sources like cash registers at physical stores.

Privacy advocates and policy makers have long talked about requiring software makers to offer users an easy and effective way to opt outof such stealth monitoring through a setting on their Web browsers. Done right, such a system could be as simple as registering your phone number on the do-not-call list created by the Federal Trade Commission to reduce the scourge of unwanted telemarketing calls.

For the last two years, a group of Internet and advertising businesses and experts has been working on this problem. It is hoping to create a voluntary standard that would be adopted by companies that make Web browsers, the ad networks and Web sites. But advocates for greater privacy and groups representing advertising and marketing companies remain far apart on several important issues, like what constitutes tracking.

One big unresolved issue is what types of information advertising companies would be able to collect under the new standard. Under one proposal, ad networks could still collect data on the kinds of Web sites a user was interested in, but the companies would not be able to easily identify the individual by name and other personal details. Unfortunately, this would create a loophole that could be easily abused, rendering the standard meaningless.

For any do-not-track standard to be effective and credible, it has to be simple and comprehensive. Users who choose not to be tracked should be assured that ad networks are not collecting information about which sites they visit. Online businesses have long argued that do-not-track and other privacy protections would hurt them by reducing advertisers’ ability to target consumers most interested in their products. But there should be ways for companies to advertise their products and services without tracking these people against their will. This month, for example, Twitter said it would send ads to users based on their behavior but would let users opt out of such advertising.

Some makers of Web browsers, like Microsoft, Apple and Mozilla, are responding to consumer demand for greater privacy by building more protections into their software. But ad networks are responding to those protections by finding new ways to monitor people. For example, some networks are using new kinds of tracking cookies that are hard to detect and delete. This arms race benefits no one and leaves consumers more confused and frustrated.

Ultimately, policy makers will have to step in. Voluntary industry standards, if they can be achieved, are a good start, but the best way to ensure privacy is strong federal legislation backed by tough enforcement. European lawmakers are working on a new privacy law with some strong protections and Congress should move in that direction, too.