|
Rapidly
growing Web businesses aren't always aware of privacy breaches
Stephanie
Stoughton
Boston Globe
By
now, Dani Leto figures Web sites know more about her than
she knows herself.
At first, she didn't mind sharing information, believing
Internet companies could make better recommendations if
they were given insight into her shopping habits. So she
has told them what music, books and software she prefers,
as well as her credit-card numbers, home address and e-mail
address.
But two online experiences made Leto uncomfortable with
the notion that Internet companies are taking snapshots
of her every mouse click.
Youknowbest.com, which provides consumer information about
products, accidentally revealed another customer's account
information to her.
She learned his name, address and possibly other information.
And nothing more than a typo entered on BMG Entertainment's
music site revealed that the company had been selling her
information to a host of marketers.
At BMGmusicservice.com, she had accidentally written "Letro."
"Next thing I knew, I had all this mail in my e-mail box
for Dani Letro," said Leto, an account executive in New
York.
Like Leto, millions of consumers have invited Internet companies
into their lives, sharing personal details that allow Amazon.com,
SmarterKids.com and other firms to suggest suitable products
and fine-tune their marketing pitches. The practice is known
as "personalization."
But privacy advocates say consumers should be more concerned
with how their information is used. There is little regulation
of the Internet. And while policymakers debate how to protect
consumers without slowing down the new marketplace or efforts
to offer personalized customer service online, many sites
continue to violate their own privacy policies.
A survey by PricewaterhouseCoopers found that 76 percent
of Internet companies were not in compliance with the privacy
statements made on their Web sites.
Rapidly growing Web businesses often aren't aware of the
breaches, privacy experts say. Others know but don't care.
"They figure as long as they don't get caught, it's OK,"
said Larry Ponemon, a PricewaterhouseCoopers partner who
specializes in privacy issues.
Reading the fine print helps, too.
BMGmusicservice.com, for example, said it will occasionally
provide e-mail and postal addresses to selected companies
- though shopper Leto complained that the policy is tucked
away in the company's Web site.
Youknowbest.com has a more stringent privacy statement,
though the policy had little to do with Leto's experience.
Leto managed to access another customer's information during
a test of the site because both consumers had used the same
network password. The problem has been fixed, a company
official said.
In some cases, Internet companies that hoped to avoid scrutiny
have found themselves wrestling with regulators.
Living.com, a online furniture retailer that recently filed
for bankrtupcy protection, received a stern warning from
Texas Attorney General John Cornyn. If the company sells
customer data, Cornyn said, it risks violating state laws.
The Federal Trade Commission has stepped into the privacy
debate, too. The agency now is charged with protecting the
privacy of youths under age 13, under the Children's Online
Privacy Protection Act of 1998.
The FTC also filed suit against Toysmart.com, an Internet
toy seller based in Waltham, Mass., after the company collapsed
in May and tried to auction off its customer database.
On its Web site, Toysmart.com had promised never to sell
personal information, which included customers' shopping
preferences and children's birth dates.
Both state and federal regulators have been watching DoubleClick
Inc., which tracks Internet users on an anonymous basis
to help companies target their marketing.
DoubleClick ignited controversy when it announced plans
to merge its anonymous information with personally identifiable
consumer data collected by off-line companies that are members
of Abacus Direct.
Some Internet companies argue that consumers should be more
worried about a cyber-world in which there is no personalized
marketing.
They point to catalog retailers and other off-line companies
that have long swapped and sold lists of suitable shoppers,
in effect decreasing the number of mass mailings. Imagine
what would happen to your mailbox before the holiday season
if companies could only guess what you liked, they say.
Web retailers also argue that their personalization efforts
make them better merchants. And the more information that
you provide, they say, the better they can serve you.
Citigroup Inc. and other companies, for instance, can offer
personalized financial Web sites that combine large quantities
of sensitive information, including a person's assets, net
worth, and airline mileage awards.
Travel sites - Travelocity.com and Expedia.com are two examples
- say that they can help you find bargains on air fares,
car rentals, and hotels if you tell them where you like
to vacation. CDnow.com will suggest Ella Fitzgerald or Louis
Armstrong if it knows you like jazz.
At SmarterKids.com, parents can build profiles by entering
their children's ages, educational levels, and interests.
The Needham, Mass. online retailer uses that information
to suggest appropriate educational toys and games.
Parents also can get extensive information on how their
infants should be developing and what their children should
be learning at various grade levels. The site then offers
various test-preparation tools.
Customer profiles also help SmarterKids.com turn more repeat
buyers into loyal shoppers. A frequent buyer, for example,
receives marketing pitches. On the other hand, those consumers
who return items or seek only marked-down merchandise might
find themselves deleted from the company's marketing list.
Amazon.com - with more than 23 million customers, it's the
Web's largest retailer - has become one of the leaders in
personalization. Watch the bottom left corner as you click
on items. As you browse, Amazon.com begins updating that
space to reflect your preferences.
Amazon.com shoppers can receive recommendations based on
what they like, what their friends like, what their colleagues
like, and even what people in Boston like ("All Souls: A
Family Story From Southie" in books, "The Usual Suspects"
in video).
But such extensive feedback comes only if customers open
up - which they do. "We have all these customers who are
passionable about sharing information about the things they
love or don't like," said J.J. Jacobi, Amazon.com's director
of community.
Although many consumers readily hand over details of their
lives, regulators and policy makers say the need for stronger
enforcement of online privacy will grow as more Web sites
begin to collect and analyze consumer data.
More than 60 bills now in Congress would address online
privacy. The FTC is backing legislation that would force
Internet companies to tell consumers whether their information
is being collected, how it will be used, and what kind of
security measures will protect their data from prying eyes.
Web sites also would have to include an opt-in provision,
meaning consumers would have to grant permission before
their personal data could be collected.
The Internet industry is preparing its own solution. The
World Wide Web Consortium has been planning a system that
would allow Internet users to define the information they
are willing to share. When a Web site does not meet the
Internet surfer's standards, a warning would appear on the
screen.
"A lot of this debate is healthy," said Matt Cutler, cofounder
of NetGenesis, a Cambridge, Mass. maker of software that
helps Web sites analyze visitors' behavior. "There will
be a period of adjustment to decide what is appropriate
and what is not appropriate."
Officials at Amazon.com apparently decided that what they
were doing did not pass the test.
Last month, the Seattle-based online retailer revamped its
privacy statement, spelling out exactly how it has used
- and could use - customer data. The Web giant now says
it will pass along customer data if it is sold to another
company. It also acknowledged that it has been sending e-mail
marketing pitches on behalf of other companies.
Analysts said the company's actions were designed to prevent
future controversy over its privacy policy, which had been
criticized as vague.
Whether many customers really stop to peruse privacy policies
is another question. Ponemon, of PricewaterhouseCoopers,
estimated that 2 to 3 percent of consumers read privacy
statements.
But he doesn't blame the busy consumer. Internet companies
often bury their privacy statements on their Web pages.
And even if customers find the policies, they often must
read pages and pages of confusing text written by lawyers.
"What (Web sites) don't realize," Ponemon said, "is that
some of these policies say, 'We don't respect your privacy.
Don't trust us.' "
|
