FTC Releases Report on Consumers' Online Privacy

Consumers have little privacy protection on the Internet, the Federal Trade Commission said today as it released its "Report to Congress on Privacy Online." The report, a comprehensive analysis of the effectiveness of self-regulation as a means of protecting consumer privacy on the World Wide Web, is the result of the Commission's three-year privacy initiative. It concludes that "industry's efforts to encourage voluntary adoption of the most basic fair information practices have fallen short of what is needed to protect consumers."

The Commission's survey of over 1,400 Web sites was broken down into six samples and also revealed that only 14 percent of the sample (674) reflecting all U.S. commercial web sites provide any notice of their information collection practices. Fewer still -- approximately two percent -- provide a comprehensive privacy policy. Eighty-nine percent of the 212 children's sites surveyed collect personally identifiable information directly from children; only 54 percent of the children's sites disclose their information collection practices. Even more troubling, the Commission said, is that fewer than 10 percent of the sites directed to children provide for some form of parental control over the collection of information from their kids.

"The Commission's survey of Web sites tells us that industry efforts to encourage voluntary adoption of these principles have not met with great success," FTC Chairman Robert Pitofsky said. "More incentives are necessary to encourage self-regulation and to ensure consumers that their personal information will be protected online. In fact, the online marketplace is unlikely to reach its full potential until consumers are confident that adequate protections are in place to protect their personal information."

As noted in the report, the FTC "has been involved in addressing online privacy issues for almost as long as there has been an online marketplace and has held a series of workshops and hearings on such issues."

According to the report, studies have concluded that there are four information practice principles that "are widely accepted as essential to ensuring that the collection, use, and dissemination of personal information are conducted fairly and in a manner consistent with consumer privacy interests." These principles are notice, choice, access and security.

In order to evaluate industries' compliance with these core principles, the Commission, in addition to conducting the Web site survey, solicited the industries' self-regulatory guidelines.

The Commission concluded that these guidelines generally encourage "members to provide notice of their information practices and some choice ... but fail to provide for access and security or for enforcement mechanisms."

"Consumer surveys tell us that Americans have serious concerns about the way online marketers protect personal information in general, and the privacy of children's personal information in particular," said Pitofsky. "The FTC's survey shows that many Web sites collect a variety of information from children, but that few take steps to provide for meaningful involvement from parents in the process. That's why the Commission is recommending legislation that will put parents in control of information that is collected from their kids.

We expect to announce recommendations about possible courses of action for online privacy protection for adults this summer."

Web Site Survey

The Commission staff surveyed over 1,400 web sites, including 212 sites directed to children. The survey shows that the vast majority of these sites -- some 85 percent -- collect personal information from consumers. In addition to the children's sites, the survey sample was drawn from commercial U.S. sites "likely to be of interest to consumers; "health, retail, and financial sites; and the most popular U.S. commercial sites. For a two-week period in March, 40 agency staff members searched the sites to determine whether a given site collects personal information from online consumers and, if so, to ascertain the kinds of information it collects and whether it discloses its information practices to consumers using the site. According to the report, the staff looked for disclosures that might be found in a "Privacy Policy Notice," or in an "Information Practice Statement."

Commercial Web Sites (674 sites)

• Ninety-two percent of these sites collect personal information. Only 14 percent provide any notice with respect to their information practices and only two percent have a comprehensive privacy policy.
  
  

Children's Sites (212 sites)

• Eighty-nine percent of the children's sites in the survey collect personal information from children. Fifty-four of those sites provide some form of disclosure of their information practices. But only 23 percent of those sites tell children to seek parental permission before they provide information to the site. Fewer than eight percent of the sites say they will notify parents of their information practices. Fewer than 10 percent provide for some form of parental control over the collection and/or use of information from children.

Health, Retail and Financial Sites (404 sites)

• Health -- Eighty-eight percent of the sites collect personal information while only 14 percent disclose their information practices.
• 
  Retail -- Eighty-seven percent of the sites collect personal information while only 13 percent disclose their information practices.
• 
  Financial -- Ninety-seven percent of the sites collect personal information while only 16 percent disclose their information practices.

Most Popular Sites (111 sites)

• Ninety-seven percent of these sites collect personal information and 71 percent have information practice disclosures.

Recommendations for Protecting Children's Privacy Online

"In the area of children's online privacy, the Commission recommends legislation that would place parents in control of the online collection and use of personal identifying information from their children," Pitofsky said. "This legislation would require Web sites that collect this information from kids to provide actual notice to the parent and to obtain parental consent. The legislation would ensure that parents know about and control the online collection of information from their children."

The report outlines the Commission's legislative recommendations that would require Web sites that are directed to children and that collect personal identifying information from children 12 and under to provide actual notice to the parent and to obtain parental consent in the following ways:

• Where the personal identifying information would enable someone to contact the child offline, the site must obtain the parent's consent before the information is collected, i.e. opt-in;

• Where any personal identifying information is publicly posted or disclosed to third parties, the site must obtain the parent's consent before the information is collected, i.e. opt-in;

• Where a site collects an e-mail address for a child's participation, such as to enter a contest, the site must notify parents and give them the opportunity to remove the e- mail address from the site's database, i.e., opt-out.

Where the information is collected from children over 12:

• Web sites must tell parents they are collecting information and give them the opportunity to remove the information from the site's database (opt-out).

"The enactment of legislation embodying these principles will go a long way toward protecting children's online privacy," Pitofksy said. "Protecting the privacy of all online consumers continues to be a high priority for the Commission. To date we are not satisfied with the implementation of fair information practices by the online industry. Recommendations for further protections will be forthcoming."

New Commission Privacy Web Page

The Federal Trade Commission has developed an Internet Web site to show consumers how to protect their personal information from public access. The "About Privacy" page at http://www.ftc.gov is a one-stop shop where consumers can get information about how to protect their privacy, online and off, and access FTC reports, letters, congressional testimony, and press releases. The section of the page called "Sharing Your Personal Information: It's Your Choice" offers information on how to contact credit bureaus, state motor vehicle offices and marketing organizations via the Web, telephone or mail. Direct links to each of the three major credit reporting bureaus and the Direct Marketing Association (DMA) are available on the site. Consumers who don't want their personal information to be sold, shared with third parties, or used for marketing purposes can use the sample letters found at the site to exercise their "opt-out" option.

The Commission vote to release the report was 5-0.

Photos from News Conference

Copies of "Privacy Online: A Report to Congress," the FTC's new consumer publication "Site Seeing on the Internet: A Consumer's Guide to Travel in Cyberspace" and the online "About Privacy" page are available at the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 6th Street and Pennsylvania Avenue, N.W., Washington, D.C. 20580; 202-FTC-HELP (202-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.

(FTC File No. 954 4807)