Representative Melvin Watt, a North Carolina Democrat, questioned Babel about TRUSTe's Web privacy certification. If a company falls out of compliance with the program, TRUSTe warns the company and works with the company to get it back into compliance, Babel said.

If the company still doesn't comply, TRUSTe pulls its certification. "My data is already out there at that point," Watt said. "How do I get a remedy?"

For "egregious" behavior, TRUSTe will refer a case to the U.S. Federal Trade Commission, Babel said. TRUSTe has referred one offending company to the FTC, in 2008, Babel said when pressed on numbers. Last year, 11 companies violated TRUSTe's privacy standards, he said.

Representative Ted Deutch, a Florida Democrat, asked whether Facebook and Google, two companies that have generated major privacy complaints, are part of the TRUSTe program. They are not, although TRUSTe works on privacy issues with both companies, Babel said.

Despite calls for a new online and mobile privacy law from some lawmakers, others raised concerns that a new law could hurt the growing e-commerce and mobile app industries. "As we think about how best to protect the interests of consumers and the Internet user community, we continue to encourage, and not stifle, innovation," said Representative Bob Goodlatte, a Virginia Republican.