# FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/agency%3Aftc%3Ad25ee588908386ea

## Record

- **Collection:** Agency decision
- **Document type:** Agency decision

## Text

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
DISSENTING STATEMENT OF COMMISSIONER ORSON SWINDLE
in Privacy Online: Fair Information Practices in the Electronic Marketplace
A Report to Congress
I dissent from this embarrassingly flawed Privacy Report and its conclusory — yet
sweeping — legislative recommendation.1 In an unwarranted reversal of its earlier acceptance
of a self-regulatory approach, a majority of the Commission recommends that Congress require
all consumer-oriented commercial Web sites that collect personal identifying information from
consumers to adopt government-prescribed versions of all four fair information practice
principles (“FIPPs”): Notice, Choice, Access, and Security.2 The majority abandons a selfregulatory approach in favor of extensive government regulation, despite continued progress in
self-regulation.
The majority recommends that Congress give rulemaking authority to an “implementing
agency” (presumably the Commission) to define the proposed legislative requirements “with
greater specificity,” to “expand on what constitutes ‘reasonable access’ and ‘adequate security’”
and to “examine the specific contours of the Choice requirement . . .” (Privacy Report [“PR”]
at 37). In some cases, the Report explains, the agency engaged in rulemaking might determine
that “reasonable access” means “no access” despite the recommended statutory direction to
provide access. (Id.). The Commission owes it to Congress — and the public — to comment
more specifically on what it has in mind before it recommends legislation that requires all
consumer-oriented commercial Web sites to comply with breathtakingly broad laws whose
details will be filled in later during the rulemaking process.
Most disturbing, the Privacy Report is devoid of any consideration of the costs of
legislation in comparison to the asserted benefits of enhancing consumer confidence and
1

To assist readers, a list of the topics I address is appended to my dissenting statement.

While this is a reversal for the Commission, Commissioner Anthony has consistently
preferred a legislative approach. See Statement of Commissioner Sheila F. Anthony, Concurring in Part and Dissenting in Part, Self-Regulation and Privacy Online (July 1999), available
at .
2

1

PRIVACY ONLINE:
allowing electronic commerce to reach its full potential. Instead, it relies on skewed
descriptions of the results of the Commission’s 2000 Survey and studies showing consumer
concern about privacy as the basis for a remarkably broad legislative recommendation. It does
not consider whether legislation will address consumer confidence problems and why legislation
is preferable to alternative approaches that rely on market forces, industry efforts, and
enforcement of existing laws.
In fact, the 2000 Survey demonstrates continued noteworthy growth in the display of
privacy notices and, for the first time, provides a qualitative assessment of the content of
privacy notices. The survey results, despite their flaws, show continued development of selfregulatory privacy policies that are, for the most part, not yet comprehensive when measured
against the 2000 Survey yardstick. Why? As discussed below, the Privacy Report makes no
attempt to answer this vital question, but instead leaps to the conclusion that legislation is
needed.
The majority’s Report concludes that the 2000 Survey numbers “demonstrate” that
industry self-regulatory efforts are insufficient. (PR at 35). It makes no attempt to determine
why the figures warrant changing course to advocate legislation. Instead, the Report concludes
that legislation is needed because self-regulation “cannot ensure that the online marketplace
as a whole will emulate the standards adopted by industry leaders.” (PR Executive
Summary at ii-iii) (emphasis added). When has self-regulation ever ensured that every member
of an industry will adopt industry standards? If this is the Commission’s new standard for
successful self-regulation, then no numbers can ever be high enough to meet it. Using such
logic leads inevitably to government regulation.
To the extent that Access and Security disclosures are less prevalent than expected, the
Survey results are consistent with the implementation difficulties identified by the Advisory

2

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
Committee on Access and Security in that Committee’s report.3 The Choice figures, while
much higher than the Access and Security figures, also are not surprising in light of the
unanticipated complexities of implementing a far more limited version of opt-out Choice
required by the Gramm-Leach-Bliley (“G-L-B”) Act for protecting the privacy of consumers’
financial information.4 Reports that many companies are exiting the business of providing
services to children online to avoid the burdens of complying with regulations issued under the
Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. § 6501 et seq., also should
raise a red flag about the wisdom of proceeding to mandate Choice and Access for all
commercial consumer-oriented Web sites.5
Nor did the 2000 Survey attempt to measure whether sites actually provide Access and
Security; rather, it gauged only whether disclosures addressed these issues. And the 2000
In 1999, the Commission established an Advisory Committee on Online Access and
Security to provide advice and recommendations to the Commission regarding implementation
of reasonable access and adequate security by domestic commercial Web sites. The Committee
provided the final version of its report to the Commission on May 15, 2000, describing options
for implementing reasonable access to, and adequate security for, personal information collected
online and the costs and benefits of each option. The Advisory Committee report is appended
to the Privacy Report.
3

The Commission, along with other agencies involved in implementing the G-L-B Act’s
privacy provisions, has found it necessary to extend the deadline for compliance with the
implementing regulations by more than seven additional months to provide sufficient time for
financial institutions to establish new policies, procedures, and systems for implementing regulatory requirements. Federal Trade Commission, Final Rule, Privacy of Consumer Financial
Information, available at .
4

The COPPA regulations require detailed Notice; Access, including the ability to review,
correct, and delete information maintained by the site; and a form of opt-in mandated Choice
(verifiable parental consent). 16 C.F.R. §§ 312.4, 312.6(a)(1), 312.6(a)(2), 312.5(a), 312.5(b).
The regulations went into effect on April 21, 2000, and already press reports state that some
small online companies have stopped providing services to children because implementation of
COPPA’s requirements is too costly. See, e.g., “New Children’s Privacy Rules Pose Obstacles
for Some Sites,” The Wall Street Journal (April 24, 2000) at B-8 (reporting one attorney’s
estimate that it will cost her clients between $60,000 and $100,000 annually to meet COPPA
standards); “New privacy act spurs Web sites to oust children,” William Glanz, The Washington Times (April 20, 2000), available at .
5

3

PRIVACY ONLINE:
Survey certainly did not give any credit for “No Access,” even though the majority indicates it
might consider no access to be “reasonable Access” in some instances.
Why does the Privacy Report not analyze why the 2000 Survey figures are too low to
avert legislation? Perhaps it is because the 2000 Survey results, like the Advisory Committee’s
report, are not really the basis for the Commission’s startling legislative recommendation. The
Commission has barely had time to review, much less digest, the detailed report issued by the
Advisory Committee earlier this week, including the very illuminating statements of individual
members of the Committee.6 Apparently, the majority views the Committee’s report as
something for an implementing agency to consider later, when it writes regulations detailing
how all commercial, consumer-oriented Web sites are to comply with laws requiring them to
provide “reasonable access” and “reasonable security.” I, on the other hand, think the
Advisory Committee’s report is an incredibly valuable contribution to self-regulation and urge
Congress to consider it fully before enacting legislation — something the Commission has failed
to do before recommending legislation. Notably, the Advisory Committee’s report does not
recommend government action.
Nor do there appear to be independent reasons supporting the majority’s broad legislative
recommendation. Legislation should be reserved for problems that the market cannot fix on its
own and should not be adopted without consideration of the problems legislation may create by,
for example, imposing costs or other unintended consequences that could severely stifle the
thriving New Economy. What is the problem to be solved here? Is it abuse of privacy online
Stewart Baker points out in his concurring statement that the FTC refused to share the
results of the 2000 Survey with the members of the Advisory Committee because the survey
results were too confidential. Nonetheless, details about the survey results and the staff recommendation for legislation leaked to The Wall Street Journal, as reported on Thursday, May 11,
2000, and confirmed by FTC spokesman Eric London, indicated that the Commission’s study of
online privacy ignored the lessons of the Advisory Committee’s report. Concurring Statement
of Stewart Baker, Steptoe & Johnson LLP, Final Report of the Federal Trade Commission
Advisory Committee on Online Access and Security (May 15, 2000). See also Separate Statement of Jerry Cerasale appended to Advisory Committee Report (noting that any recommendation for government access likely was determined before the Committee issued its report).
6

4

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
or unfounded fears of new technology? Is it the online dissemination of personal information or
the offline availability of such information? How is the proposed solution related to the
problem? Why is law enforcement against violations of posted privacy policies inadequate?
Why not encourage consumers to “vote with your mouse”? In light of the widespread
adoption of privacy policies and developments in privacy protection technology, consumers can
choose to make purchases at sites compatible with their privacy preferences and not use sites
that are incompatible with their preferences. Consumers who feel very strongly about privacy
can use technological tools to further enhance their privacy online, such as anonymizer
programs or cookie crumblers, and may simply rely on information available online to make an
offline purchase.
Isn’t the real privacy problem the lack of information and education? This can be
addressed by self-regulation. Legislation is not necessary.
I.

WHAT DO THE SURVEY RESULTS SHOW?

A.

The Survey Shows Continued, Significant Progress in the Frequency of Privacy
Disclosures
It is critical to recognize what the majority’s Report does and does not do. First, it

presents a survey that is a one-time snapshot of the characteristics of privacy disclosures
provided online in late February 2000. The survey results show noteworthy progress on two
measurements that are directly comparable to similar figures from surveys described to
Congress in the Commission’s 1998 and 1999 reports on online privacy: the posting of privacy
disclosures (or information statements) and the posting of privacy policies. The first set of
these comparative figures, displayed in Figure 1 of the Privacy Report, shows that 88% of
Web sites in the Random Sample post at least one privacy disclosure and that 100% of the
Most Popular Web sites post at least one privacy disclosure. (PR at 10, Appendix C, Table
2a). These figures rose to 66% and 93% respectively last year, up from 14% and 71%
respectively in 1998. (PR at 11, Figure 1). The second set of comparative figures shows
that fully 62% of Web sites in the Random Sample and 97% of the Most Popular Web
5

PRIVACY ONLINE:
sites post a privacy policy. (PR at 10). This also shows noteworthy progress from
comparable 1999 figures of 44% and 81%. (Id.).
B.

The Survey Provides a Unique Baseline for Measuring the Quality of Privacy
Disclosures
Next, the 2000 Survey presents a unique and demanding measurement of the quality and

detail of privacy disclosures based on the four FIPPs. When the 2000 Survey gives credit for
“Notice,” it requires a level of notice that satisfies four distinct requirements: (1) the site posts a
privacy policy; (2) it says anything about what specific personal information it collects; (3) it
says anything about how the site may use personal information internally; and (4) it says
anything about whether it discloses personal information to third parties. When the 2000
Survey results refer to “Choice,” it means that the site did two things: (1) it stated that it
provided the consumer an option to authorize or agree to the site’s use of personal information
to send communications back to the consumer (or stated that it did not use personal information
in this way); and (2) it stated that it provided an option to authorize or agree to the disclosure of
personal identifying information to third parties (or stated that it did not disclose personal
identifying information to third parties).
In partial recognition of the complexities of these issues, Access and Security were
measured by simpler standards. When the 2000 Survey concludes that a site provided
“Access,” it means that the site stated that it did at least one of three things: it allowed
consumers to review, delete, or correct at least some personal information. “Security” means
that the site explicitly stated that it takes steps to provide security. As the Privacy Report
acknowledges, providing security is more important than disclosing it.7 The 2000 Survey did
not attempt to measure whether sites actually provide security (or access, for that matter),
but only whether privacy disclosures addressed them in the parameters described above.

7

PR at 19; see also Advisory Committee Report at 19-20.
6

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
C.

Disclosures Addressing Individual Fair Information Practice Principles Are Widespread
NOTICE: The survey results show that 55% of sites in the Random Sample and 89% of

the Most Popular sites meet all four Notice requirements. (PR Appendix C, Table 4).
CHOICE: 82% of the sites in the Random Sample and 98% of the Most Popular sites
provide some form of choice for either sending communications to customers or disclosing
information to third parties. (PR Appendix C, Table 10). 50% of the Random Sample sites
provide both types of choice, as do 67% of the sites in the Most Popular Group. (PR
Appendix C, Table 4).
ACCESS: 43% of the Random Sample sites and 83% of the Most Popular Group sites
provide disclosures indicating that they provide some form of access. (PR Appendix C, Table 4).
SECURITY: 55% of the Random Sample sites and 74% of the Most Popular Group sites
display a statement that the site takes steps to provide security. (PR Appendix C, Table 4).
Thus, when looked at in terms of adherence to individual fair information practice
principles, the Random Sample numbers are fairly high and the Most Popular Group figures are
substantially higher.
D.

Comprehensive Privacy Policies that Provide All Four Elements of FIPPs Are Less
Common
When the Privacy Report combines all four of the 2000 Survey’s Notice, Choice, Access,

and Security measurements to determine what sites have disclosures satisfying all four fair
information practice principles, however, the results are much lower: 20% of the Random
Sample Web sites and 42% of the Most Popular Web sites. (PR Appendix C, Table 4). If the
Access and Security measurements are not considered, then 41% of the sites in the Random
Sample and 60% of the Most Popular sites provide the four-element Notice and both types of
Choice. ( Id). These numbers rise even more when sites are credited for providing choice
either for internal uses or for disclosures to third parties: 54 % of sites in the Random Sample
and 87% in the Most Popular Group. (PR Appendix C, Table 10). Treating Choice in this

7

PRIVACY ONLINE:
manner also increases the number of sites that meet the 2000 Survey’s full FIPPs standard to
27% (Random Sample) and 63% (Most Popular). (Id).
II.

PROBLEMS WITH THE REPORT’S INTERPRETATION OF SURVEY RESULTS

A.

The Report’s Direct Comparisons to Earlier FIPPs Numbers Are Bogus
Regardless of the manner in which the qualitative measures of Notice, Choice, Access, and

Security are combined or separated, the FIPPs figures from the 2000 Survey stand alone and
are beyond the scope of earlier surveys. The Privacy Report’s repeated comparison of full
FIPPs numbers of 20% of the Random Sample and 42% of the Most Popular Group to what it
calls “similar figures” of 10% and 22% from Professor Culnan’s 1999 surveys is a misleading
apples-to-oranges comparison, because the 1999 surveys did not define Notice, Choice, Access,
and Security to include the more demanding elements required by the Privacy 2000 survey.
(PR at 12 nn. 76-77).
As acknowledged in footnotes 79 and 80 of the Privacy Report, the scoring models are not
identical because the surveys asked different questions. Using the most comparable approach
possible in light of this significant limitation, the 2000 Survey’s full FIPPs numbers rise to
25% and 57%. This apples-to-apples comparison shows a dramatic one-year
improvement. Nonetheless, the majority’s Report chooses not to highlight this more direct
comparison, instead measuring the 20% of the Random Sample Web sites that implement all of
the 2000 Survey’s specified elements for Notice, Choice, Access and Security against the
1999 survey that found 10% of sites had posted disclosures addressing at least one element of
Notice, Choice, Access, and Security. (See PR Executive Summary at i).
B.

Measuring Success on the Basis of Full FIPPs Is Irrational
Based on the many difficulties of implementing Access and Security, discussed in detail

below, the Privacy Report’s use of full FIPPs as the yardstick for success is irrational. It
should be noted that even in the sensitive area of protecting personal financial information, the
Congress did not insist on all four FIPPs in the G-L-B Act. Once beyond sensitive financial
and medical information, the importance of Access arguably diminishes. Had the 2000 Survey
8

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
actually given credit for the majority’s concession that in some cases “reasonable Access” might
mean “no Access,” the Access and full FIPPs numbers would be dramatically improved.
Moreover, as discussed below in section III.C.4, Access and Security disclosures do not reflect
whether a Web site actually provides Access and Security.
C.

Equating Self-Regulatory Enforcement with the Prevalence of Seal Programs
Is Misleading
Another striking feature of the Privacy Report is that, without analysis, it equates seal

programs with enforcement and concludes that self-regulation has failed because the results of
this first-time survey of the prevalence of participation in seal programs show that 8% of Web
sites in the Random Sample and 45% in the Most Popular Group display privacy seals. The
weighted analysis figure, which reflects how often consumers surfing the Random Sample Web
sites are likely to encounter a privacy seal, is 36%. (PR Appendix C, Table 14a). Despite the
fact that nearly one-half of the most frequently visited sites use a seal program, the
Report states flatly that “the enforcement mechanism so crucial to the success and
credibility of self-regulation is absent.” (PR at 35) (emphasis added).
Moreover, the FTC already has power to take action against violations of privacy policies.
The Privacy Report does not comment on the FTC’s challenges to privacy policies that violate
Section 5 of the FTC Act and how often such government enforcement actually has been needed.
Once again, the Privacy Report fails to ask “why?” Instead of considering why
participation in seal programs is more than five times higher among the Most Popular Web sites
than among the Random Sample sites, the majority simply concludes that the presence of seal
programs on the Web is “not significant.” (PR at 6). Nowhere does the Report discuss the
costs of participating in a seal program, such as fees charged by the program, the time involved
in applying and being granted approval to use a seal, and the costs of implementing seal
program requirements. Nor does the Report ask whether the prevalence of seal programs may
reflect how frequently consumers seek out and rely on privacy seals before purchasing from an
online retailer, or whether seal programs may have positive effects on online privacy by
9

PRIVACY ONLINE:
indirectly encouraging Web sites not participating in seal programs to adopt privacy policies to
better compete with sites that are. Instead, it leaps to the conclusion that the number of sites
displaying seals means that enforcement is lacking and that government enforcement of new
privacy regulations is the solution.
D.

The Report Confirms the Exponential Growth in Online Commerce, but Misuses
Consumer Confidence Surveys and Lost Sales Projections
The Privacy Report seeks to justify legislation and regulation on the ground that privacy

concerns are limiting the commercial growth of the Internet. It does acknowledge the
exponential growth that has occurred in recent years in the online economy. But it also boldly
asserts that consumer fear about privacy “likely translates into lost online sales due to lack of
confidence in how personal data will be handled” (PR at 2), and concludes that government
intervention will reduce such lost sales. There is little empirical support for these conclusions.
1.

Misuse of Consumer Confidence Surveys
Not surprisingly, the attention paid by the media and government to online privacy

concerns is reflected in consumer surveys showing a general lack of confidence in online
privacy protections. The Privacy Report, however, overstates the extent and significance of
consumer concern about online privacy to support its call for government regulation. (PR at 2).
a.

Odyssey Study Example
For example, the Privacy Report states that there is “consumer unease” about online

privacy based on a “recent study [by Odyssey] in which 92% of respondents from online
households stated that they do not trust online companies to keep their personal information
confidential, and 82% agreed that the government should regulate how online companies use
personal information.” (PR at 2). The Odyssey Study itself states that 47% of online
households strongly agree, 35% somewhat agree, and 18% strongly disagree with the statement
that government regulation is needed.8 The majority has arrived at its 82% figure by adding
Odyssey, Consumers’ Internet Privacy Concerns: Lip Service or Limiting Factor? (2000)
(“Odyssey Study”) at 2.
8

10

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
the percentages of online households that strongly agreed and somewhat agreed, something that
the Odyssey authors themselves did not do.
Moreover, the Odyssey survey’s method of describing consumers’ views is unusual and
somewhat biased in favor of “agree” responses, because it gives two possible answers that use
the word “agree” and only one possible answer to “disagree.” (Odyssey Study at 2, Chart 1).
Typically in a survey the points used in a three-point scale would be labeled something like: (1)
agree; (2) neither agree nor disagree; and (3) disagree. A typical four-point scale would have
labels along the lines of: (1) strongly agree; (2) somewhat agree; (3) somewhat disagree; and
(4) strongly disagree. In the Odyssey survey, only one category — “strongly disagree” — is
available for consumers who have only weak opinions but tend to disagree. Since they do not
“strongly” disagree, such consumers might say they “somewhat agree,” even though that is not
an accurate portrayal of their views. The Odyssey survey method pushes consumers to “agree”
categories and captures consumers in the “somewhat agree” category who may simply tend
more to “somewhat disagree” (a choice not offered by the survey). In these circumstances, the
Privacy Report’s addition of the “strongly agree” and “somewhat agree” responses is very
misleading.
b.

IBM Privacy Survey Example
Regardless of the extent to which consumers are concerned about privacy online, the

available data do not support the conclusion that these concerns are causing any significant lost
online sales. The Report also cites the IBM Privacy Survey as support for the proposition that
“surveys show that those consumers most concerned about threats to their privacy online are
the least likely to engage in online commerce.” (PR at 2 n.14). Specifically, the Report
observes that “57% of Internet users have decided not to use or purchase something from a
retail Web site because they were not sure how the site would use their personal information.”
(PR at 15 n.84).
On its face, the IBM Privacy Survey does not demonstrate that there have been or will
be a significant number of lost sales online because of privacy concerns. The survey treats as a
11

PRIVACY ONLINE:
positive response any consumer who has ever been dissuaded from making any purchase online
from the relevant type of Web site.9 Positive responses therefore include consumers who may
well have simply decided to make their online purchase from some other online retailer, thereby
resulting in no lost online sale at all. Positive responses thus also include consumers who may
well have been dissuaded from making a purchase in the relatively distant past but are now
undeterred from making purchases online, which means that the responses could very well
overstate the risk of current and future lost sales online due to privacy concerns. In fact, these
results suggest that many consumers want information about privacy practices and that
consumers can and do exercise choice based on their privacy preferences.
2.

The Report’s Reliance on Lost Sales Projections Is Misplaced
Nor are the lost sales projections relied upon by the majority valid justifications for

government regulation of privacy. The Report’s sweeping statements about consumer privacy
fears likely resulting in billions of dollars of lost sales are based primarily on two consumer
surveys conducted in mid-1999 or earlier. These surveys were the basis for estimates that sales
lost to lack of consumer confidence in privacy protections were $2.8 billion in 1999 and could
be as much as $18 billion by 2002.
i.

Forrester Privacy Best Practice Report

The Privacy Report obtained the $2.8 billion estimate from a study that Forrester
Research, Inc., released in September 1999. (PR at 2 n.16). The Forrester Report stated
merely that “concerned consumers who do buy spend 21% less online than their more at-ease
counterparts, leaving $2.8 billion on the table in 1999.”10 It did not explain, however, how
The question in the IBM Privacy Survey asked: “When you’ve visited health, financial,
insurance, or retail websites, have you EVER DECIDED NOT TO USE OR PURCHASE
SOMETHING from this type of website because you weren’t sure how they would use your
personal information?” IBM Multi-National Consumer Privacy Survey (Oct. 1999), prepared
by Louis Harris & Associates, Inc. at 96, 99 (Exh. 5.1) (emphasis added) (capitalization in
original).
9

Christopher M. Kelley, et al., The Privacy Best Practice, The Forrester Report (Sept.
1999) at 2.
10

12

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
this estimate was calculated, much less reveal the underlying data on which its estimate was
based. In fact, the 21% figure was based on what this group of consumers reported spending
during the three-month period prior to the survey.11 Forrester has not updated these data for
2000. The Forrester lost sales projection therefore does not reflect changes that have
occurred in online commerce since mid-1999.
ii. Jupiter Proactive Online Privacy Study
Even worse, the Report relies — as a basis for legislation — on a projection of “potential
losses of up to $18 billion by 2002 (as compared to a projected total of $40 billion in online
sales), if nothing is done to allay consumer concerns.” (PR at 2). The Report cites to an
overview of a study that Jupiter Research Services released in June 1999. (PR at 2 n.17).12
The data supporting the statements in the Jupiter Study are at least a year old and, since
industry self-regulation has made significant progress since June 1999, the Jupiter lost
sales projections are clearly not applicable today.13
The overview on which the Privacy Report relies does state that Jupiter projects a “[l]oss
of $18 billion in Commerce Revenue” due to privacy concerns. But the overview also explains
that the forecast is that such revenue losses will be suffered “unless [Web sites] take a more
proactive approach and engage in an informed dialogue to shape and allay consumers’ fears”
(emphasis added) and contains a heading that states “A Do-Nothing Approach Will Lead to
Significant Revenue Loss.”
Here, the Report makes a quantum leap in logic, misleading Congress by going beyond
simply selectively citing the Jupiter Study overview. It fails to consider the complete Jupiter
11

2000).

Conversation between my staff and Christopher M. Kelley, Forrester Research (May 17,

Specifically, the Report cites a press item dated August 17, 1999, which, in turn, quotes
from the Jupiter Study. The Report also cites the overview of the Jupiter Study available at
Jupiter’s Web site to registered users. (PR at 2 n.17).
12

The online overview of the Jupiter Study warns purchasers of its research that “[a]ll
opinions and projections are based on Jupiter’s judgment at the time of the publication and are
subject to change.”
13

13

PRIVACY ONLINE:
Study.14 That study provides the full scenario underlying the $18 billion lost sales projection.
The projection rests on four assumptions: (1) the online “[i]ndustry does nothing”; (2)
“[c]onsumers’ concerns [about Internet privacy] grow” as media attention increases; (3) the
“Government implements legislation” signaling to consumers that their concerns regarding
privacy were justified; and (4) “[c]onsumers’ fear impacts revenue.”15
Thus, the majority is relying on a projection of lost sales that is based on one
assumption already proven wrong by the 2000 Survey — that industry does nothing to
protect privacy — and another assumption — that the government regulates privacy —
that has not yet come to pass. The Privacy Report’s use of Jupiter’s lost sales projection
as the basis for recommending such legislation is indefensible.
In fact, the Jupiter Study appears to have used the projection to encourage self-regulation.16
That Study also concluded that “consumers do not see government regulation as the solution to
the online privacy issue. The vast majority of respondents to a Jupiter Consumer Survey — 86
percent — said that they would not trust a Web site with their privacy even if the government
regulated it.”17

The Jupiter study also found that only 14% of consumers asked to

identify the top two factors that would positively affect their trust in Web sites with
regard to their privacy “indicated that they would more likely trust a Web site on privacy
issues if the site were subject to government regulation.”18 These figures clearly cut against
the Privacy Report’s recommendation for rulemaking.

Michele Slack, Jupiter Communications, Proactive Online Privacy, Scripting an Informed
Dialogue to Allay Consumers’ Fears (June 1999).
14

15

Jupiter Study at 12-13 and Figure 9 (emphasis added).

16

See Jupiter Study at 16.

17

Id. at 19.

18

Id. at 4.
14

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
iii. Legislation Is Not Needed and in Fact May Cause Lost Sales
Assuming for the sake of argument that privacy concerns are causing some lost online
sales, it is far from clear that government intervention is the appropriate response. First, some
of the same consumer surveys that purport to show that privacy concerns are causing lost online
sales also appear to indicate that government intervention is not needed to allay consumers’
privacy concerns.19 Moreover, government regulation of online privacy obviously will impose
substantial costs on online sellers that might very well reduce their online sales or induce firms
to offer fewer products for sale or go out of business entirely — an offsetting reduction in
online commerce that the Report entirely ignores.
iv. “Lost” Sales Are Not Really Lost
Finally, a lost online sale is not a complete loss to the economy. Again, assuming for the
sake of argument that consumers have been dissuaded from making purchases online because of
privacy concerns, the most likely response of these consumers would be to purchase the same
item from an offline retailer. Of course, switching to an offline retailer in this situation may not
be the optimal economic outcome, because transaction costs might be lower if consumers make
the purchase online. Offline retailers might be able to free-ride on the services provided by
online retailers. Nevertheless, the fundamental point remains that overlooking offline sales that
offset a lost online sale overstates the economic effect of the lost online sale.
v.

The Meaning of Surveys Showing Consumer Unease Is Unclear

Consumer surveys often are poor predictors of consumers’ actual behavior. The growth
of online commerce despite growing consumer awareness and concern about online privacy
For example, the Odyssey study reports that “82% of online shoppers say they would be
more likely to shop at an online retailer that promised not to reveal their personal information to
third parties.” Odyssey Study at 3. The study notes that for such privacy promises to be
credible, it is “absolutely essential” that online retailers communicate clearly to consumers what
privacy policies are in place and adhere to those policies. Id. at 3-4. The study concludes that
“it appears that the security and privacy policies of successful online retailers today are adequate
to provide for continued growth in electronic commerce.” Id. at 4. Consequently, the Odyssey
study does not support the majority’s position that more government regulation is needed to
prevent lost sales resulting from online privacy concerns.
19

15

PRIVACY ONLINE:
suggests that many consumers do not act upon their fears or that they have generalized fears
that are overcome by the provision of additional information by the sites with which they
choose to do business. In fact, some of the studies cited by the majority’s Privacy Report
confirm that consumers’ fears about privacy are mingled with fears about the security of their
credit card information. The Jupiter Study, for instance, reports that 78% of consumers
surveyed stated that security of credit card information is the privacy issue that concerns them
the most.20 Current encryption standards provide a lot of protection in this area, and it is
probably less risky to use a credit card online than to use it in a restaurant or over the
telephone. If consumers’ fears about security are exaggerated, then the solution is to find a way
to reassure consumers by notice and education rather than promulgating rules that may restrict
their choices.
III. WHAT DOES THE REPORT FAIL TO DO?
The Privacy Report fails to provide a reasoned basis for its legislative recommendation. As
discussed above, it relies only on a one-sided interpretation of the 2000 Survey results and the
existence of consumer concern about privacy. The Report fails to adequately address the
alternatives to legislation. Its discussion of self-regulation does not give appropriate credit to
self-regulatory efforts other than seal programs, nor does it address the continued development
of privacy-related technology.
Most fundamentally, the Privacy Report fails to pose and to answer basic questions that all
regulators and lawmakers should consider before embarking on extensive regulation that could
severely stifle the New Economy. Shockingly, there is absolutely no consideration of the costs
and benefits of regulation; nor the effects on competition and consumer choice; nor the
experience to date with government regulation of privacy; nor constitutional implications and
concerns; nor how this vague and vast mandate will be enforced.

Respondents were asked to choose the top three factors that most concerned them.
Jupiter Study at 3-4.
20

16

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
A.

The Report Does Not Adequately Credit Self-Regulatory Efforts
The Privacy Report’s emphasis on seal programs overshadows other corporate efforts.

Corporate leaders including IBM, Microsoft, Disney, Intel, Procter and Gamble, Novell, and
Compaq have voluntarily committed to requiring their advertising partners to post high-quality
privacy policies in order to receive advertising monies.
Microsoft has committed to developing business and consumer tools based on the Platform
for Privacy Practices Protocol (“P3P”). The business tool known as the Privacy Statement
Wizard is intended to enhance the ability of Web site operators to present their privacy
statements both as human and as machine-readable documents. A related consumer tool, the
Privacy Manager Wizard, is intended to enhance consumers’ abilities to state their personal
information privacy preferences. An early version of the Privacy Statement Wizard has been
on the market for just over a year and has allowed over 15,000 companies to craft their own
online privacy practices by answering a questionnaire.
Associations also have stepped up to the plate. On May 8, 2000, the CEOs of
theglobe.com, Yahoo!, Inc., America Online, Lycos, Inktomi , Excite@Home, eBay,
DoubleClick, Amazon.com, and EMusic.com, wrote a letter on behalf of NetCoalition.com to
the CEOs of the Top 500 Web sites urging them to take the initiative to ensure that their
companies establish and promote the adoption and implementation of rigorous voluntary privacy
policies. NetCoalition.com led the way during the 1999 holiday shopping season, sponsoring
a “Consumer Privacy Education Campaign” to empower Internet users with practical
information about online privacy. The campaign included over 50 million impressions with
banner ads and site impressions.
The Online Privacy Alliance (“OPA”) continues to play a leading role serving as an
industry coordinator and a general information resource. The OPA has taken significant strides
toward alerting consumers and businesses about the value of privacy protection, as well as how
to provide substantive protective measures. In December 1999, OPA disseminated a video

17

PRIVACY ONLINE:
news release — seen by more than four million Americans — on protecting privacy while
shopping online for Christmas.
The American Electronics Association (“AEA”) sponsored a series of seminars in January
2000, entitled “E-Commerce Privacy: Building Customer Trust.” AEA has established a
significant business relationship with BBBOnline in which a significant discount is offered to its
3,400 member companies who gain certification under BBBOnline’s strenuous online privacy
program.
The Direct Marketing Association (“DMA”) Privacy Promise was successfully launched
on July 1, 1999. Under DMA’s Privacy Promise program, its members commit to provide
customers with notice of their right to opt out of information exchanges, honor opt-out requests,
maintain an in-house file of consumers who have asked not to be recontacted, and use DMA’s
mail and telephone do-not-call lists when prospecting. DMA membership is contingent on
compliance with the Privacy Promise. Fewer than 1% of DMA members refused to comply.
More than 2,000 DMA member companies signed up, making this the largest selfregulatory program based on numbers of participants. DMA has revised its Privacy
Policy Generator to reflect the most current issues, making it easier for companies to explain to
consumers their access policies, their enforcement programs, and their relationship with ad
servers.
In April 2000, the Association for Competitive Technology (“ACT”) unveiled “Net
Privacy: You’ve Got the Power,” a multi-faceted campaign designed to educate consumers on
how to protect their privacy online. The campaign was launched with public service
advertisements educating readers about online privacy and directing them to
www.NetPrivacyPower.org.

In addition to the Web site, the campaign includes print

advertising, online advertising, direct mail and email.
The U.S. Chamber of Commerce continues to reach out through a variety of
communication methods to state and local chambers to educate them about the importance of

18

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
robust online privacy practices. The Chamber has worked closely with OPA and NetCoalition
to educate trade associations not in the information-technology area regarding the need for their
active involvement in educating their own members about the importance of online privacy.
In October and November 1999, the Software & Information Industry Association
(“SIIA”) undertook a comprehensive outreach program in which it contacted all of its member
companies that did not have a privacy policy linked from the company home page. SIIA sent
each company a letter encouraging them to develop fair information practices and to post a
privacy policy online. In addition, SIIA provided each company with resources and
information through an online “toolkit” on its web site and devoted the entire April issue of its
association magazine to the issue of online privacy.
The Electronic Retailing Association (“ERA”) joined 35 associations in March, 2000 to
urge each of their member companies to post a simple, straightforward privacy policy. As a
condition of membership, ERA member companies are required to abide by ERA’s Online
Marketing Guidelines.
Many other associations that have endorsed and promoted self-regulatory solutions to
online privacy including the Information Technology Association of America (“ITAA”),
Information Technology Industry Council (“ITI”), Business Software Alliance (“BSA”),
Computer & Communications Industry Association (“CCIA”), Computer Systems Policy
Project (“CSPP”), Consumer Electronics Association (“CEA”), Electronic Industries Alliance
(“EIA”), Semiconductor Industry Association (“SIA”), and the Telecommunications Industry
Association (“TIA”).
My discussion of these organizations is by no means intended to be comprehensive, but
merely to demonstrate the extent to which the majority’s Privacy Report ignores ongoing,
significant industry self-regulation and promotion of privacy online.
B.

The Report Ignores Developments in Technology
The market for privacy protection is growing and companies are responding with a host of

technological tools. In addition to P3P, which will allow consumers to communicate their
19

PRIVACY ONLINE:
preferences in sharing personally identifiable information with Web sites, there are many other
privacy products.
Those tools can be divided into two types: those that protect or shield a browsing
consumer’s identity, and those that help the consumer negotiate what information her or she
wishes to share. Anonymizer technology like anonymizer.com and Zero Knowledge Systems
give a consumer anonymity on the Web. Infomediaries allow a consumer to exercise choice in
the types of personally identifiable information that is shared each time a Web site is visited. A
consumer can create a personal profile that enables the technology to negotiate the release of
information specified by the consumer.
For example, AllAdvantage.com acts as an agent on behalf of consumers to create a
market for the use of their information without consumers’ losing control over their
information. Digital Me from Novell stores a consumer’s personal information and uses it to
automatically fill out forms at Web sites, allowing the consumer to review what is being
submitted. Persona by Priva Seek allows a consumer to surf anonymously and sell his or her
specified, personally identifiable information in exchange for discounts.
Technology can be one part of the solution to consumers’ online privacy concerns. But
the majority’s Privacy Report does not consider the existence, or the likely impact of, such
technological tools on consumer privacy online before recommending a legislative attempt to
address consumer concerns. The market is working here: consumers are demanding tools to
protect privacy and merchants are competing to provide them.
C.

The Report Fails to Identify and Consider the Costs and Benefits of Proposed
Legislation
The most fundamental flaw in the Privacy Report is its failure to address the costs

and benefits of the legislation it proposes. While I cannot undertake a comprehensive
analysis myself, a few observations are appropriate.

20

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
1.

Notice
Notice seems less likely to impose tremendous costs and may have many benefits. The

2000 Survey results show that Notice already is widely provided, but there appear to be
problems with the clarity and understandability of privacy disclosures. (PR at 24-28). To the
extent that Notice is clearly provided, firms can compete on the basis of their privacy policies,
and the privacy preferences of one group of consumers need not limit the choices of other
groups. Industry adherence to a set of best practice guidelines for Notice should be
attempted and assessed before we resort to legislation. To the extent that online companies
do not provide clear notice, consumers who care about privacy should shop elsewhere. The
workings of the market are preferable to the workings of government.
2.

Choice
As described in the 2000 Survey and the Privacy Report’s legislative recommendation,

Choice is not the free-market version of choice that relies on informing the consumer so that the
consumer can choose not to use a site if he or she dislikes the privacy policy. Rather than
promoting informed comparison shopping for acceptable privacy practices, the Commission
asks Congress to impose a mandated version of Choice that appears to entitle the consumer to
continue to use any site, but gives the consumer control over the site’s internal and external
uses of his or her personal information. (PR at 36).
Like other aspects of the Commission’s recommendation, Mandated Choice raises policy
issues that the Report simply ignores. What are the likely effects on online commerce of
Mandated Choice? Would sites have to extend the same level of services and benefits to all
consumers, regardless of whether some are unwilling to provide information? To the extent
sites rely on the sale or use of information to offset the costs of providing services, would they
discontinue services to all or to some consumers? Would all consumers have to pay more for
services previously offset by the sale or use of information? Could sites shift costs only to those
consumers who demand a higher level of privacy, whether in the form of fees for using the site
or by reducing the level of benefits and services offered to those who choose a higher level of
21

PRIVACY ONLINE:
privacy? Or is privacy an absolute right so that all participants in online commerce — retailers
and consumers — should bear the costs of Mandated Choice exercised by some consumers? If
so, in the name of “Choice,” this legislation may reduce the choices available to consumers in
the online market.
These are fundamental policy decisions, not mere issues of implementation that can be
resolved later when unelected bureaucrats decide how to regulate the online world. Legislation
adopting Mandated Choice will have consequences for online commerce that should be
understood before Mandated Choice is written into law.
3. Access
The majority recommends that Congress enact legislation requiring all commercial,
consumer-oriented Web sites to provide reasonable access to consumers’ personal information.
Again, the majority does not ask why the 2000 Survey’s Access numbers are not as high as the
majority evidently expected them to be. As the Advisory Committee found, sites may actually
provide Access yet not specifically address it in a notice. (Advisory Committee Report at 4).
For example, access may be provided by e-mail to information about what the customer
ordered, its price, and where it is to be delivered. The 2000 Survey did not count this type of
access unless it was described in a privacy disclosure. Nor did the 2000 Survey take account
of the type or sensitivity of information collected by sites that fail to provide Access. To the
extent that the majority may be prepared to treat “reasonable Access” as “no Access”
under some circumstances, it is noteworthy that the 2000 Survey gave no credit for “no
Access.”21
The Advisory Committee’s report discusses the costs and risks of Access, particularly the
problem that “the access principle sometimes pits privacy against privacy. . . . Privacy is lost if
a security failure results in access being granted to the wrong person.” (Advisory Committee
Interestingly, the Advisory Committee “heard estimates from Web companies that less
than one percent of customers who are offered access actually take advantage of the offer.”
Concurring Statement of Stewart Baker, Steptoe & Johnson LLP, appended to Advisory Committee Report.
21

22

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
Report at 15). Indeed, “[g]iving access to the wrong person could turn a privacy policy into an
anti-privacy policy.” (Id. at 4). In light of this, liability concerns may be preventing sites from
providing Access. The Advisory Committee’s report also observes that authentication of a
consumer’s identity before allowing that consumer Access could have considerable costs,
including to the consumer’s ability to remain anonymous. (Id.) Given the complexities and
risks of Access, it is not surprising that Web sites have not implemented Access more broadly.
Unlike the Commission, some may have been waiting to consider the findings of the Advisory
Committee.
4.

Security
As the Advisory Committee observes (and the Commission acknowledges in footnote 192

of the Privacy Report), it is impossible to judge the adequacy of Web site security by
surveying the presence or absence of security notices on Web sites. (Advisory Committee
Report at 15). Many sites may actually provide security, yet not inform consumers that they do
so. The Commission majority’s Report notes that security disclosures can enhance consumer
confidence and are essential to informed consumer choice. (PR at 33 n.192). Indeed, “security
notices are ineffective standing alone.” (Advisory Committee Report at 21). Why, then,
should the Privacy Survey’s results measuring the frequency of security disclosures — not
whether security is actually provided — be given any weight in assessing the progress of selfregulation of privacy online?
Security disclosures, particularly regarding the security of credit card information, might
help increase consumer confidence. Yet this is a far cry from legislatively mandating the
provision of “reasonable security” by Web sites and asking regulators to decide later what
security is and is not “reasonable.” The honest companies will provide security to satisfy their
customers; the dishonest ones will simply not comply. There was no agreement among the

23

PRIVACY ONLINE:
Advisory Committee members that the government should mandate security standards or that
the Commission should be setting security standards.22
5.

Competitive Effects
This Report is from the leading antitrust agency, yet it contains no consideration of the

competitive effects of the remarkably broad legislation it proposes. The Report ignores the
likely result that government-created standards for all consumer-oriented, commercial Web sites
may cause some online companies, particularly smaller ones, to limit their online services or
exit the online marketplace altogether. What are the likely effects of the majority’s proposed
legislation on consumers and competition? Will the advantages of the bigger players be
enhanced, while small entrepreneurs face artificial and costly barriers to entry? How will that
affect the innovation and provision of services that consumers want? What costs will it impose
on consumers who do not care about privacy or are willing to make some tradeoffs?
6.

Constitutional Issues
The Privacy Report does not address the fundamental question whether a statute that

incorporates its recommendations would violate the First Amendment to the United States
Constitution. The majority recommends that the Congress impose broad restrictions on the sale
to a third party of personal information collected online by any consumer-oriented commercial
Web site. (PR at 38). Both the courts and the Commission have recognized that sales of
personal information to third parties are accorded the same level of Constitutional protection as
“commercial speech.” Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., 472 U.S. 749,
758-59 (1985) (plurality opinion); Trans Union Corp., FTC Dkt. No. 9255, slip op. at 33-37
(Feb. 10, 2000). To determine whether a government restriction on commercial speech passes
constitutional muster, a court must examine: (1) whether the expression at issue concerns lawful
activity and is not misleading; (2) whether the asserted governmental interest supporting the
restriction is substantial; (3) whether the regulation directly and materially advances the
Concurring Statement of Stewart Baker, Steptoe & Johnson LLP, appended to Advisory
Committee Report.
22

24

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
governmental interest asserted; and (4) whether the regulation is narrowly drawn to advance the
governmental interest asserted. Central Hudson Gas & Electric Corp. v. Public Serv. Comm’n
of New York, 447 U.S. 557, 561-63 (1980).
The Privacy Report provides no analysis of whether the governmental restrictions that it
recommends would survive judicial scrutiny under the test articulated in Central Hudson and its
progeny. It articulates no reasoned and documented basis for the conclusion that the
recommended restrictions would directly and materially advance the governmental interest in
protecting the privacy of consumers. Moreover, the Privacy Report presents no basis for the
conclusion that the recommended restrictions are narrowly drawn to protect such privacy.
Indeed, the Report does not present any information as to whether alternative legislation — for
example, providing for Notice only — would protect the privacy of consumers yet impose a
lesser burden on the exercise of commercial speech. In my view, we should not recommend
that the Congress impose restrictions on commercial speech without conducting the necessary
legal and factual analysis to state with confidence that the restrictions would survive judicial
review.
7.

Enforcement
It boggles the imagination to think about how the comprehensive regulatory scheme

envisioned by the majority might be enforced. By enacting the broad statutory requirements
recommended by the majority, Congress will create a new universe of law violators, most of
whom are arguably innocent of harming consumers or other wrongdoing. Remember that all
consumer-oriented commercial Web sites would be required to comply with the four FIPPs as
implemented by government regulation.
Although a majority of the Commission suggests that self-regulation will continue to play a
role in enforcement — perhaps through a mechanism like the dispute resolution and referral
process of the National Advertising Division of the Council of Better Business Bureaus (PR at
36 n.202) — what is glaringly absent from the majority’s recommendation is any type of safe

25

PRIVACY ONLINE:
harbor program that relies on the creativity of industry to come up with self-regulatory
guidelines that satisfy the requirements imposed by statute.
8.

Offline Privacy
As Commissioner Leary thoughtfully explains in his concurring and dissenting statement

appended to the Privacy Report, online regulation of privacy has implications for the offline
world. The Privacy Report acknowledges, but does not analyze, the issue in an ominously
vague footnote promising that “significant attention to offline privacy issues is warranted.” (PR
at 3 n.23).
IV. WHERE DO WE GO FROM HERE?
The Privacy Report stands as the majority’s “justification” for the recommendation to
legislate privacy — a dramatic reversal in position for the Commission and a mandate for the
commercial online world to comply with the government’s interpretation of all four fair
information practice principles. Yet the Report is extremely flawed in its presentation of fact,
its analytical logic, and its conclusions. This is no way to create good law.
Everyone recognizes that there are imperfections and deficiencies in the state of privacy on
the Internet, but let us not make the search for the perfect the enemy of the good. The private
sector is continuing to address consumer concerns about privacy, because it is in industry’s
interest to do so. Congress may wish to enact more limited legislation or may continue to rely
on enforcement agencies and corporate leadership. Now is not the time for legislation, but if
legislation cannot be avoided, then a basic standard for a readily understandable, clear and
conspicuous Notice — combined with a campaign by industry and government to continue to
educate consumers about the tools at their disposal — would go a long way to protect consumer
privacy by ensuring that consumers could compare privacy policies and make informed choices
based on their privacy preferences. If there is to be legislation, it should go no further than
Notice. In light of the 2000 Survey’s positive findings about the broad-based implementation of
Notice by Web sites, mandating Notice seems less likely to be fraught with severe, unintended
consequences for online commerce. Notice allows consumers to exercise informed choice to
26

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
use a particular Web site or to seek an alternative.
The current recommendation, however, defies not just logic but also fundamental
principles of governance. In recognition of some of the complexities of regulating privacy —
particularly Access and Security — the Commission asks Congress to require all commercial
consumer-oriented Web sites to comply with extensive, yet vaguely phrased, privacy
requirements and to give the Commission (or some other agency) a blank check to resolve the
difficult policy issues later. This would constitute a troubling devolution of power from our
elected officials to unelected bureaucrats.

I dissent.

27

PRIVACY ONLINE:
LIST OF HEADINGS
I.

WHAT DO THE SURVEY RESULTS SHOW?
A.

The Survey Shows Continued, Significant Progress in the Frequency of Privacy
Disclosures

B.

The Survey Provides a Unique Baseline for Measuring the Quality of Privacy
Disclosures

C.

Disclosures Addressing Individual Fair Information Practice Principles Are
Widespread

D. Comprehensive Privacy Policies that Provide All Four Elements of FIPPs Are
Less Common
II. PROBLEMS WITH THE REPORT’S INTERPRETATION OF SURVEY RESULTS
A.

The Report’s Direct Comparisons to Earlier FIPPs Numbers Are Bogus

B.

Measuring Success on the Basis of Full FIPPs Is Irrational

C.

Equating Self-Regulatory Enforcement with the Prevalence of Seal Programs
Is Misleading

D. The Report Confirms the Exponential Growth in Online Commerce, but Misuses
Consumer Confidence Surveys and Lost Sales Projections
1.

Misuse of Consumer Confidence Surveys
a. Odyssey Study Example
b. IBM Privacy Survey Example

2.

The Report’s Reliance on Lost Sales Projections Is Misplaced
i.
ii.
iii.
iv.
v.

Forrester Privacy Best Practice Report
Jupiter Proactive Online Privacy Study
Legislation Is Not Needed and In Fact May Cause Lost Sales
“Lost” Sales Are Not Really Lost
The Meaning of Surveys Showing Unease is Unclear

28

FAIR INFORMATION PRACTICES IN THE ELECTRONIC MARKETPLACE
III. WHAT DOES THE REPORT FAIL TO DO?
A.

The Report Does Not Adequately Credit Self-Regulatory Efforts

B.

The Report Ignores Developments in Technology

C.

The Report Fails to Identify and Consider the Costs and Benefits of Proposed
Legislation
1.
2.
3.
4.
5.
6.
7.
8.

Notice
Choice
Access
Security
Competitive Effects
Constitutional Issues
Enforcement
Offline Privacy

IV. WHERE DO WE GO FROM HERE?

29

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/agency%3Aftc%3Ad25ee588908386ea. Public record. Not legal advice.