FTC Begins Survey of Commercial Websites to Determine Industry's Implementation of Consumer Privacy Policies

The U.S. Federal Trade Commission ("FTC") announced last month that it will begin conducting a review of 1,200 commercial websites to determine how these sites disclose policies regarding consumer privacy. The FTC is concerned that consumers are unaware and not adequately warned about how companies that operate websites are collecting and using personal information provided online by consumers.

The FTC has indicated that it will choose the 1,200 websites to be reviewed on the following basis:

• Two hundred websites selected from "Yahooligan's!" (the children's section of Yahoo located at "www.yahooligans.com");

• The 100 most frequently visited sites (selected from sites listed at "www.hot100.com"); and

• Nine hundred other sites chosen across a broad spectrum of industries, but more heavily weighted toward websites offering information on financial services and travel.

Based upon its survey, the FTC intends to report to Congress, in June, with conclusions on what steps website providers have taken to inform consumers about privacy issues. The FTC will then make recommendations, that could include specific regulations relating to commerce on the Internet, and on whether the FTC needs to become more directly involved to ensure that consumers' interests are protected. We note that some foreign governments -- in Europe in particular -- have already taken steps to protect consumer privacy interests on the Internet.

Prior FTC Action Regarding the Internet and Privacy Issues

The FTC has authority under the FTC Act to take action against unfair or deceptive acts affecting commerce. According to FTC Chairman Robert Pitofsky, "commerce on the Internet falls within the broad sweep of this statutory authority." Pitofsky describes the FTC's Internet mission as "promoting the efficient functioning of the marketplace by seeking to protect consumers from unfair or deceptive acts or practices and to promote vigorous competition." (See Footnote 1.)

The FTC is concerned about the following scenario. A consumer goes onto the web seeking information about services and products on a commercial website or potentially making an online purchase from a website operator. The consumer is then instructed by the website to provide personal information (address, income, etc.) in order to receive the information sought. After receiving this information, the website operator sells this information or provides it to other commercial interests for targeted mailings or similar forms of solicitation.

In carrying out the mission envisioned by Chairman Pitofsky, the FTC has held a series of public workshops over the past three years to identify and examine personal privacy and consumer protection issues arising from the collection of information from consumers using the Internet. These FTC workshops have brought private industry together with the federal regulators to determine the "state of the industry" regarding privacy practices on the Internet.

The online industry has strongly pushed for self-regulation, and trade associations representing online interests have promised to create model privacy policies for their members to adopt. Based upon these initiatives by private industry, the FTC has chosen to refrain from adopting any immediate measures to regulate commerce on the Internet.

Focus of Current Survey of Websites

The FTC's current review of websites, which begins this month, primarily will focus on whether industry has lived up to its promises of self-regulation. In particular, the FTC will look at specific websites to determine whether these sites adequately provide:

• notice regarding privacy issues; and

• choice on how personal information is used.

Although the recent FTC announcement of this survey does not provide guidance on how website operators should provide consumers "notice" and "choice" regarding use of personal information, the prior FTC workshops informally gave the following advice.

• Notice to consumers should include identifying the collector of information, the intended uses of the information, and means by which consumers may limit the disclosure of personal information. Such notice can be accomplished through a formal "privacy policy" statement posted clearly on the website.

• Choice to consumers regarding how personal information is used can be accomplished through "opt out" options that allow the consumer to block use of personal information being provided to third parties.

• As a final issue, websites collecting personal information should take steps to protect such information from loss or misuse.

We note that the guidance above is only informal, and at this time has not been officially promulgated by the FTC. It is likely, however, that should the FTC determine that industry self-regulation has failed to adequately address privacy issues, it will come forward in the near future with regulations similar to the guidance above. It is also possible that if certain website operators commit egregious abuses of personal information, the FTC may take individual action against such companies under its broad statutory authority.

Such efforts by the FTC would be in line with government regulation of privacy in electronic commerce in many foreign countries, notably in western Europe. Thus, the FTC would have a wide range of examples on which to draw should it decide to regulate this area in the United States.

How the FTC Review Affects Your Company

Because the FTC has not yet issued any regulations regarding Internet commerce, private industry is not required to adopt the informal measures. As Internet commerce expands, however, both the FTC and industry need to take steps to ensure that consumer perception of the Internet -- while still in its infancy -- as an efficient and safe vehicle for commerce is not harmed.

Failure by website operators to protect consumer privacy not only will damage consumer confidence, it also may invite government regulation that to date the online industry successfully has resisted.

How Can PHJ&W Help?

As part of its report to Congress, the FTC is requesting the industry to provide it with any existing guidelines or principles regarding online collection of personal information. We can assist in developing such guidelines for interested companies or associations. The FTC has requested that all submissions be provided to the agency by March 31 of this year.

In addition, individual companies that are possible targets of review during the current FTC survey of websites may want to modify or improve their current privacy policies. We already conducted an informal review of some websites of PHJ&W clients and have found that privacy policies vary greatly.

PHJ&W has been involved for several years in advising clients on consumer privacy issues relating to electronic commerce. Robert L. Sherman, a partner in our New York office, serves as general counsel to the Direct Marketing Association, the largest and oldest trade association representing direct marketers. Mr. Sherman is called regularly by industry, lobbyists and legislators to help develop laws and FTC rules that have potential impact on direct marketers, and by clients to advise and represent them regarding those laws and rules.

With regard to online privacy issues, Mr. Sherman was invited by the Special Adviser to the President for consumer Affairs to participate in a series of White House meetings on the issue of consumer privacy as it is affected by advanced technology. He has also met regularly with FTC officials at the most senior level to discuss the outlines of the FTC's current review of websites.

We also possess experience in dealing with European privacy policies. U.S. companies with websites that can be accessed internationally need to be aware of these policies and what they can and should do to limit their exposure to foreign enforcement activity.

Based upon this experience, we can assist in determining whether your current privacy policies are in line with the informal guidance from the FTC or have substantial problems under the privacy laws of other markets in which you conduct electronic commerce, and suggest steps to assure that consumer interests are fully protected on your sites.

---

1/ Statement by FTC Chairman Robert Pitofsky before the Senate Government Affairs Committee on February 10, 1998. return