As the FTC urges Congress to enact new privacy laws for the Web, industry groups say hold off.
When it comes to privacy and the Internet, everyone has an opinion. According to an FTC report released May 18, some 90 million Americans use the Internet, and roughly 69 percent shop online regularly. Of those Web surfers, 92 percent voice concerns about the possible misuse of personal information they leave in their wake. But when the FTC, in its report to Congress on May 25, recommended enactment of legislation to establish a uniform privacy policy, both cheers and jeers followed.
The report commended the strides online retailers have made in increasing the level of online privacy since the commission's 1998 survey. Those findings showed that 92 percent of sites collected personal information, yet only 14 percent posted information on their privacy policies. Despite improvements found in the 2000 survey, the FTC contends that they're not sufficient. "While the commission applauds the efforts by the private sector to address the issue of online privacy," says FTC chairman Robert Pitofsky, "the survey results show that such efforts have not been enough. As this year's survey makes clear, the number of Web sites meeting basic standards of privacy protection is far too low, endangering consumer confidence in this fast-growing, proconsumer marketplace."
To Legislate or Not to Legislate?
The recommendations came after a two-month survey based on information from the 100 most popular commercial US sites, as well as a random sampling of sites with 39,000 unique visitors a month. The findings showed that only 20 percent of these sites follow all four of the fair-information practices (notice, choice, access, and security). Of the 100 most popular sites, only 42 adhere to those guidelines. Among sites implementing the two most important practices -- notice and choice -- the numbers increase to only 41 percent of the total sample sites and 60 percent of the most popular.
Many individuals and organisations, however, are leery of any sort of government-imposed regulations, fearing that such interference will slow growth and impede the Web's money-making potential. One such organization, the Direct Marketing Association (DMA), conducted its own survey during April and May of the 100 most popular shopping sites (as ranked by 100hot, a Web site). The DMA claims its data shows the FTC erred in making its recommendation. According to the DMA survey, 93 percent of sites post privacy policies. Of those, 95 percent describe the type of data collected and how the data will be used, 91 percent include notification that the data may be sent to a third party, 74 percent offer users the choice to opt out of leaving personal information, and 73 percent include a description of their sites' security measures.
"This survey demonstrates the seriousness with which the industry takes self-regulation," says Patricia Faley, the DMA's vice president of consumer affairs. "Companies know that privacy policies are crucial to earning consumer trust, and that [those policies] are now largely seen as a requirement, not an option, for doing business on the Internet."
Another opponent of the FTC recommendation, the Online Privacy Alliance, a group that includes more than 100 companies such as 3Com, AOL, Apple Computer, AT&T, Compaq, Dell, Microsoft, Real-Networks, and PricewaterhouseCoopers, contends that the FTC misinterpreted the survey findings, saying that for many e-businesses it is simply common sense to include privacy information. "Online businesses know that protecting consumer privacy is good business and the business of privacy is booming," says Christine Varney, an OPA advisor and former FTC commissioner. "Privacy policies are now ubiquitous online, and these policies empower consumers to make informed choices about what personal information to share."
The DMA agrees that some legislation is necessary to protect personal information gathered from children, along with financial and medical data. In 1998, Congress passed the Children's Online Privacy Protection Act (COPPA) in response to the growing number of children -- nearly 10 million in 1997 and 26 million at the end of 1999 -- using the Internet. The first law of its kind, COPPA requires sites catering to the 13-and-under crowd to provide parents with notice of their information practices, obtain verifiable parental consent before collecting data, collect only information necessary for participation in the site, maintain a secure and confidential database of collected information, and give parents access to collected information.
If you're reluctant to leave the issue of your family's personal information in the hands of others, you do have software options. Privada's Message Incognito and Web Incognito let you send e-mail and surf the Web without leaving any personal information in your wake. Both programs are available in the latest version of PrivadaProxy, a client application that lets you choose when and where to leave information. The software -- in conjunction with Privada's network, for which there's a US$5 monthly charge -- gives you control of your information. The Privacy Companion, developed by IDcide, is free software that lets you opt out of leaving personal details behind. And if you want to discover what tidbits of information you're unknowingly sending out, Privacy.net has a link that shows in detail just what your computer sends automatically while you blithely cruise the Web.
