E tail d E tails Primer on Privacy Dana B. Rosenfeld Bureau of Consumer Protection Federal Trade Commission

E tail d E tails Overview u Background u Privacy disclosures u Third-party data collection u Section 5 enforcement u Relevant privacy statutes u Tips and resources

E tail d E tails FTC’s Privacy Initiative u Public workshops u Fair Information Practice Principles u Notice, Choice, Access, & Security u Surveys of commercial Web sites u Annual reports to Congress since 1998 u Enforcement actions u Consumer and business education

E tail d E tails Audience Poll Do you post a privacy policy? A.Yes B.No

E tail d E tails Audience Poll Where is your privacy policy? A. Hyperlink from home page B. Hyperlink where information is collected C. A and B D. None of the above

E tail d E tails Privacy Disclosures: Placement on Your Web Site u Clear and conspicuous u Hyperlink from home page to the complete privacy policy u Post disclosures or hyperlink again at the point of information collection

E tail d E tails Privacy Disclosures: You Should Disclose... u What information is collected u How information is collected u How information is used u Whether information is disclosed to others u How Choice, Access and Security are provided to consumers u Whether other entities are collecting information through the site

E tail d E tails Privacy Disclosures: What to Avoid u Contradictory statements u Ambiguous language regarding choice u Applying new, inconsistent policies to previously-collected information

E tail d E tails Avoid Contradictory Statements u Example 1: “This site does not sell or rent user information to any third parties.” Followed 2 pages later by: “Information you disclose may be shared with our business partners and sponsors.” u Example 2: “Your privacy is important to us, so we don’t share information about our customers with others, except in the following limited circumstances.” Followed by: a long list of exceptions, including business partners, sponsors, and other third parties u Solution: clarity, brevity, consistency

E tail d E tails Avoid Ambiguous Language Yes, make information that I supply available to selected companies, which may contact me regarding products or services I may find of interest. All of the information you provide will be kept completely confidential unless you indicate otherwise.

E tail d E tails Avoid Ambiguous Language u Example: Privacy Policy: “Personal information will not be used to contact you without your consent.” Bottom of Registration form: Yes! Send me information about other products I might like! u Solution: be clear about how consumers can exercise choice

E tail d E tails Avoid Material Changes Without Providing Notice or Choice u Example: “We will never share customer information with third parties.” But: “Our business changes constantly, so check back here frequently to learn of changes to our privacy policy.” u Solution: provide consumers notice and choice about whether changes shall apply to previously-collected information

E tail d E tails Audience Poll Does a third party serve ads on your site? A.Yes B.No C.Don’t know

E tail d E tails Third-Party Profiling: What it is and How it Affects You u Third party’s use of cookies, Web bugs, etc., to track consumers across Web sites and develop extensive profiles to help deliver targeted ads u Invisible to consumers u No direct consumer relationship u FTC & Department of Commerce held public workshop in November 1999 u Network Advertising Initiative (“NAI”) announced u 90% of network advertising industry (about 10 members) u Developed self-regulatory principles

E tail d E tails NAI Self-Regulatory Principles u Include Notice, Choice, Access, Security and Use Restriction for sensitive information u NAI members will require their clients to provide Notice and opportunity to exercise Choice

E tail d E tails Sample Notice: Sharing PII With Third Party

E tail d E tails More on Third-Party Data Collection u For more information about the NAI Principles, including sample notices: u NAI Web site u FTC Report to Congress: Online Profiling

E tail d E tails Say What You Do... And Do What You Say u Section 5 prohibits deceptive practices u Deceptive practices include privacy statements that are misleading because u They state or imply something that is not true about what information is collected or how it is used u They omit information that is material in light of the statements made u FTC enforcement

E tail d E tails FTC v. Liberty Financial u In connection with a survey about finances, Web site expressly stated that: “All of your answers will be totally anonymous.” u In fact, Web site could identify individuals with their responses to the survey u FTC alleged these were deceptive practices under Section 5

E tail d E tails FTC v. Toysmart u Privacy Policy: “When you register with toysmart.com, you can rest assured that your information will never be shared with a third party.” u Conduct: Facing financial difficulties,Toysmart tried to auction off its customer database u Legal consequence: FTC filed lawsuit to block the sale; 40+ states filed objections

E tail d E tails Relevant Statutes: Children’s Online Privacy Protection Act u Who is covered by COPPA? u Sites (or portions of sites) directed to children under 13 u Sites that knowingly collect personal information from children under 13 u Collection of anonymous information does not trigger the Act u What does COPPA require? u Posted privacy policy and direct notice to parents u “Opt-in” parental consent prior to collection of personal information u Parental access to information u

E tail d E tails Relevant Statutes: Gramm-Leach-Bliley Act u Who is covered by GLB? u Financial institutions u Entities “significantly involved in financial activities” (e.g., real estate appraisers, insurance companies, automobile leasing, companies that operate travel agencies in connection with financial services, retailers that offer credit cards directly to consumers) u What does GLB require? u Notice u Opt-out before information is shared with non-affiliated third parties u When must companies comply? u Law went into effect November 13, 2000 u Full compliance required by July 1, 2001

E tail d E tails Tips for Writing (and Following) Your Privacy Policy u Make sure you know what information your company collects, how it is stored, and how it is used, and write your policy accordingly u Use a team approach, including representatives from legal, marketing, customer support, IT, and Web design to u Determine current information practices u Assess what laws may apply u Develop and draft a clear privacy policy u Educate your employees, develop training materials

E tail d E tails Privacy Policy Generators Can Help u DMA’s Privacy Policy Generator u Microsoft bCentral Privacy Wizard privacy.linkexchange.com u OECD Privacy Policy Generator u Secure Assure Privacy Profile Wizard u TRUSTe Privacy Statement Wizard

E tail d E tails Other Resources u BBBOnline Privacy Seal Program u BetterWeb Seal Program u CPA WebTrust Seal u TRUSTe Seal Program u Platform for Privacy Preferences (P3P) Project u YOUpowered, Inc. u Online Privacy Alliance Guidelines u NAI Self-Regulatory Principles

E tail d E tails FTC Privacy Resources u u u u FTC Report to Congress: Fair Information Practices in the Electronic Marketplace (May 2000) u Advisory Committee on Online Access and Security – Final Report (May 2000) u FTC Report to Congress: Online Profiling, Parts 1 & 2 (June & July 2000)

E tail d E tails Primer on Privacy Dana B. Rosenfeld January 30, 2001

E tail d E tails More about the NAI Principles

E tail d E tails Collection of Non-PII u Network advertisers shall require that their clients: u (1) post a privacy policy that clearly and conspicuously discloses (a) the customer's use of the network advertiser services for profiling; (b) the type of information that may be collected by the network advertiser; and (c) the consumer's ability to choose not to participate; and u (2) provide a clear and conspicuous link to the Opt-Out Page of the NAI gateway educational site or to the network advertiser’s own opt out page

E tail d E tails Sample Non-PII Notice Language “ We use third-party advertising companies to serve ads when you visit our Web site. These companies may place cookies on your machine and may collect certain anonymous information (not including your name, address, address, or telephone number) about your visits to this and other Web sites in order to provide advertisements about goods and services of interest to you. Below we’ve provided links to these companies’ privacy policies where you can learn about their practices and the choices you may have to opt-out of having information used or collected by these companies.” CompanyPrivacy Policy Adcompany 1www.adcompany1.com/privacywww.adcompany1.com/privacy Adcompany 2www.adcompany2.com/privacywww.adcompany2.com/privacy

E tail d E tails Collection of PII u Network advertisers will provide, through contractual arrangements with their clients, “robust notice” and choice before collecting PII or merging PII with non-PII u Choice varies: u Opt-out for collection of PII u Opt-out for merger of PII and non-PII prospectively u Opt-in for merger of PII and previously-collected non-PII u Opt-in for material change in how previously- collected PII or non-PII is used

E tail d E tails “Robust Notice” u At the time and place information is collected (e.g., registration page) u Must disclose u that the PII is shared with a network advertiser for purposes of profiling u the type of information that may be collected and linked by the network advertiser u the consequent loss of anonymity u the consumer’s choices with respect to the data collection or merger of PII and non-PII