"Self-Regulation and Privacy Online," FTC Report to Congress

The Federal Trade Commission testified today before Congress on the status of industry efforts to protect consumers' online privacy. Chairman Robert Pitofsky and FTC Commissioners Sheila F. Anthony, Mozelle W. Thompson and Orson Swindle presented the Subcommittee on Telecommunications, Trade, and Consumer Protection of the House Commerce Committee with a report titled, "Self-Regulation and Privacy Online." The report is part of the Commission's four-year effort to encourage widespread implementation of effective protections for consumers' online privacy.

The report describes the growth of electronic commerce, explains how Web sites collect information about consumers, explores consumers' concerns about online privacy, and analyzes the state of online privacy self-regulation. The report states that "the Commission believes that legislation to address online privacy is not appropriate at this time. We also believe that industry faces some substantial challenges. Specifically, the present challenge is to educate those companies which still do not understand the importance of consumer privacy and to create incentives for further progress toward effective, widespread implementation." It goes on to outline an agenda to address online privacy issues that includes a number of public workshops, task forces and an online survey, to reassess progress in Web sites' implementation of fair information practices.

The report discusses the results of two studies of commercial Web sites conducted by Georgetown University Professor Mary Culnan, and the efforts of the Online Privacy Alliance, TRUSTe, BBBOnline, and others. "We continue to believe that effective self-regulation is the best way to protect consumer privacy on the Internet, and I am pleased that there has been real progress on the part of the online industry," Chairman Pitofsky said. "Because of that progress, I do not believe legislation is necessary at this time. But this is not the occasion to declare victory. There is more to protecting consumer privacy than simply publishing notices on Web sites. We intend to monitor what we hope and expect will be continuing progress in development of privacy protection programs, as well as efforts to develop effective enforcement mechanisms. Responsible elements in the online business community have accomplished a great deal in a short time, but there is a considerable distance to go before consumers can feel secure from privacy invasions in their dealings on the Internet."

In analyzing the state of online privacy self-regulation, the report emphasizes that "self-regulation is the least intrusive and most efficient means to ensure fair information practices, given the rapidly evolving nature of the Internet and computer technology." Professor Culnan's studies, the report points out, "suggest that the majority of the more frequently-visited Web sites are implementing the basic Notice principle by disclosing at least some of their information practices." The report notes, however, that only a relatively small percentage of these sites are disclosing information practices that address all four substantive fair information practice principles: Notice, Choice, Access and Security. It also states that the privacy seal programs underway encompass only a small minority of all Web sites. "The self-regulatory programs described ... reflect industry leaders' substantial effort and commitment to fair information practices," the report states.

The report outlines a Commission agenda that includes:

• A public workshop on "online profiling," the practice of aggregating information about consumers' preferences and interests gathered primarily by tracking their movements online. The workshop will be jointly sponsored by the U.S. Department of Commerce.
• A public workshop on the privacy implications of electronic identifiers that enhance Web sites' ability to track consumers' online behavior.
• Two task forces of industry representatives and privacy and consumer advocates:
  • (1) To understand the costs and benefits of implementing fair information practices; and
  • (2) To address how to create incentives to encourage the development of privacy-enhancing technologies, such as the World Wide Web Consortium's Platform for Privacy Preferences (P3P).
• Joint efforts with the U.S. Department of Commerce to promote private sector business education initiatives that encourage new online entrepreneurs to adopt fair information practices.

"Finally," the report concludes, "the Commission believes it is important to continue to monitor the progress of self-regulation, to determine whether the self-regulatory programs discussed in this report fulfill their promise. To that end, the Commission will conduct an online survey to reassess progress in Web sites' implementation of fair information practices, and will report its findings to Congress."

The Commission vote to authorize the release of the report and the Commission testimony was 3-1 with Commissioner Anthony concurring in part and dissenting in part.

Commissioner Thompson said, "During the past year, industry leaders have expended substantial effort to build self-regulatory programs. However, I believe that we will not progress further unless industry acts on the specific shortcomings that our report documents. Congress and the Administration should not foreclose the possibility of legislative and regulatory action if we cannot make swift and significant additional progress."

Commissioner Swindle issued a concurring statement in which he explains that the Privacy Report does not accurately reflect the reality of current Internet privacy because it greatly understates the substantial progress that has been achieved in the past year through self-regulation. Nevertheless, he voted to submit the report "because it ultimately reaches the correct and obvious conclusion: no legislative action is necessary at this time." Commissioner Swindle emphasized that new laws and regulations are not needed "if industry, privacy and consumer advocates and the Commission continue to work hard and work together." Finally, he encouraged industry to continue its efforts because "there are many [who are] eager and willing to regulate."

Commissioner Anthony said in her statement, "I support the Commission's 1999 Report to Congress on Self-Regulation and Privacy ... . The report commends the seal programs and the few responsible industry leaders that have undertaken significant efforts to protect online privacy by adopting fair information practices in their online dealings with consumers. ... I believe that the time may be right for federal legislation to establish at least baseline minimum standards. I note that bipartisan bills are pending in both the House and the Senate and could provide a good starting point for crafting balanced protective legislation. I am concerned that the absence of effective privacy protections will undermine consumer confidence and hinder the advancement of electronic commerce and trade."

Copies of the report titled, "Self-Regulation and Privacy Online: A Report to Congress" and the Commission testimony are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580; 202-FTC-HELP (202-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.