Verifying Privacy on the Internet

Ever given personal information to a Web site in exchange for a cool new browser plug-in? Ever wonder what happened to that information? And then do you ever wonder how all that spam e-mail ends up in your mailbox?

If so, you're not alone--so does Uncle Sam.

Last month, the U.S. Federal Trade Commission announced that the Web hosting company GeoCities had agreed to a settlement under which it would stop promising subscribers that it would not disclose personal information it collected on them. Though GeoCities denied allegations of wrongdoing, it acknowledged that it had entered into a consent order with the FTC on June 11 to protect the privacy of its customers.

The FTC's action sent ripples through the Internet community: it was the first time that the government had enforced online privacy, effectively sending a message that it was impatient with the state of the industry's self-regulation.

Among steps to be taken by GeoCities in the consent order is registration with TrustE, one of several companies that hope to curb further government intervention by independently verifying the privacy statements of Web sites.

Companies like TrustE aren't intended to stop Web sites from collecting personal information, nor is that what the government says it wants. Instead, they're simply meant to make sure that Web sites follow through on the promises they make to users. TrustE allows its client sites--now including GeoCities--to display their "trustmark" logo; in return, if the site's users check a box that says "Don't give my e-mail address to anyone else," it's TrustE's business to make sure that the Web site keeps its word.

TrustE does this through a series of steps, from capturing versions of a site's privacy policy when it changes, to "seeding" the site's database--creating alias e-mail addresses and tracking whether they get spammed. According to Paola Benassi, Product Operations Manager at TrustE, "If a consumer has a concern with a Web site, we suggest they go to the site first and try to resolve it with the company. If they're not satisfied with the result, they can come back to us and we'll work with both parties."

In many cases the issue may be a result of user error--a failure, for example, to check the aforementioned box. In the event that "the licensee swears up and down that [a privacy violation] didn't happen, and a consumer says it did," Benassi explains, TrustE would bring in a CPA firm to perform an audit on the company's privacy practices. In the worst case scenario, if a site were found to be in violation and still wouldn't comply, TrustE would pull their trustmark from the site and, if laws were broken, report them to the appropriate authority.

To date, Benassi says, this hasn't been necessary. TrustE has only been commercially available since June of last year, and although they've received complaints about some of their clients, "so far we've been able to resolve them working directly with the site and with the consumer." Indeed, TrustE began speaking with GeoCities at the end of April, after GeoCities had been contacted by the FTC. Says Benassi, "It seems like they were trying to get their act together."

TrustE, as well as industry groups like the Online Privacy Alliance, was established in the wake of government concerns over privacy in cyberspace. In January the Department of Commerce issued guidelines entitled Elements of Effective Self-Regulation for Protection of Privacy, but in July the FTC released a study showing that while 92 percent of Web sites collected personal information on their users, only 2 percent disclosed their privacy policy. This government scrutiny worries many who believe that governmental regulation would be costlier, and with harsher penalties, than self-regulation.

For her part, Benassi believes that online privacy protection "will continue to be voluntary" in the U.S., and sees real value in giving out personal information in some cases. "It depends on what the user is after. For me, the benefits of a Web site like My Excite outweigh the drawbacks." Indeed, as Web sites become more sophisticated, they often use personal data on their users to tailor content to their preferences.

Benassi suggests users turn the perks of the Web to their advantage.

"If you're not sure about a site, set up a free e-mail account on Yahoo, and give them that address--any unsolicited e-mail that comes to it, disregard it." She also advises users to "look for the site's posted privacy practices and see whether you want to play with that site. Most sites are basically free, but they're free for a reason. Your information is basically money to them. It's the price of admission."

Sean G. Thomas, Sean Thomas, Sean Garrett Thomas