**Consumer Privacy on the Internet:**

# Its \"Surfer Beware\"

[Major R. Ken Pippin\*]{.smallcaps}

> *The Federal Government should recognize the unique qualities of the
> Internet including its decentralized nature and its tradition of
> bottom-up governance. Existing laws and regulations that may hinder
> electronic commerce should be revised or eliminated consistent with
> the unique nature of the Internet.*[^1]
>
> *\[S\]elf-regulation is the least intrusive and most efficient means
> to ensure fair information practices, given the rapidly evolving
> nature of the Internet and computer technology.*[^2]
>
> *We only need to look at several privacy fiascoes of late to realize
> that the presence of privacy policy statements does little to
> safeguard Internet user's privacy.*[^3]

**I.** **Introduction**

One of the driving forces behind the exponential growth of the
Internet[^4] is its popularity as a consumer marketplace. The United
States Department of Commerce recently reported that on-line sales have
tripled from approximately \$3 billion in 1997 to approximately \$9
billion in 1998.[^5] On-line revenues of North American retailers in the
first half of 1998 were approximately \$4.4 billion.[^6] On-line
advertising revenues have grown from \$906.5 million in 1996 to \$1.92
billion in 1998.[^7] The Internet, and specifically the World Wide
Web,[^8] has become a primary source for obtaining goods, services, and
information by a large number of people in a very short period of time.

Many do not realize that this exploitation has indirectly resulted in
the Internet becoming a vast storage area for personal information on
consumers, including information about children.[^9] Growth of the
Internet and the popularity of that technology has combined to create a
perception that Internet has out-paced oversight and control.[^10] This
has led to concerns as to whether sufficient mechanisms exist to protect
consumers, including the protection of consumers' personal
information*,* against unwanted disclosure of that information.[^11] The
hesitation of consumers to conduct on-line purchasing can be traced, to
some degree, to uncertainties over how laws and regulations in existence
before the emergence of the Internet actually apply to Internet
commerce, if at all.[^12]

> This article is intended to provide the legal assistance attorney a
> solid foundation of information on which to build expertise in this
> area of consumer protection law. Hopefully, that will translate into
> more knowledgeable advice being passed along to the consumer, rather
> than quick referrals to the state attorney general's office that send
> the client away with little more than a toll-free phone number and a
> prayer that somebody can explain if and how information privacy rules
> apply on the Web.
>
> This article will be broken down by first introducing the main actors
> involved in Internet privacy issues, followed by a review of the
> primary laws and regulations touching on Internet privacy, as well as
> pending legislation, and the self-regulatory effort of the private
> sector. This article will conclude with suggestions to help the
> consumer make intelligent choices on information disclosure and reduce
> the potential for unwanted disclosure of their personal information.
>
> **II. The Main Players in Consumer Privacy**
>
> Consumer privacy is a complicated issue made even more difficult by
> the advent of the Internet. The shear volume of people, institutions,
> organizations, and companies using the Internet contributes
> immeasurably to the complexity of this issue. However, there is a core
> group that actually has the greatest potential for affecting long-term
> change in the area of on-line privacy.
>
> **A. Industry**
>
> Entities that comprise the Internet industry group are often referred
> to, as they will be throughout this article, as \"Internet marketers\"
> and \"web sites.\" A web site, in reality, is an Internet destination
> where you can look at and retrieve data. All web sites in the world,
> linked together, make up the World Wide Web.[^13] An Internet service
> provider is a service that allows consumers to connect to the
> Internet. When a person signs up (it requires special software and a
> modem), she will be asked to enter a screen name, a secret password,
> and probably a credit card number. On-line charges are usually billed
> to a credit card. Some of the most well known Internet service
> providers include the Microsoft Network, America On-Line, Compuserve,
> and Prodigy.[^14] An on-line service is an Internet service provider
> with added services and information, such as entertainment and
> shopping features.[^15]
>
> Commercial web sites collect tremendous amounts of personal
> information, also known as *individually identifiable information*,
> about consumers.[^16] Individually identifiable information is
> information that can be used to identify an individual, that is
> elicited from the individual by the company\'s web site though active
> or passive means, and that is retrievable by the company in the
> ordinary course of business.[^17] Personal information usually refers
> to specific items such as name, social security number, address, and
> phone number. In the context of discussing Internet privacy, its
> meaning is broader. It commonly encompasses *personally identifiable
> information*, which is information that can be used to identify,
> contact, or locate an individual.[^18] The FTC divides personal
> information into two categories. The first is personal identifying
> information such as name and e-mail address. The second category
> includes demographic or preference information that is used in
> conjunction with personal identifying information for market research
> and the creation of consumer profiles.[^19] The manner in which these
> companies or other entities collect and use this personal information
> is generally known as *information practices*.[^20] *Fair information
> practices* are generally those information practices used by Internet
> marketers, that adhere to a set of five widely accepted core
> principles, both procedural and substantive in nature, which form the
> basis of privacy protection. These principles constitute safeguards
> required to assure information practices are fair and provide adequate
> privacy protection.[^21] These principles, which are discussed below,
> are access/participation, choice/consent, integrity/security,
> notice/awareness, and enforcement/redress.
>
> Information is collected through a variety of means, including
> registration pages, user surveys, on-line contests, application forms,
> and order forms. What many consumers are unaware of is that web sites
> also collect personal information through *cookies*, or *cookie
> files*. Cookie technology refers to a file left on a computer\'s hard
> drive to track the user's travels around a particular web site. This
> file is deposited when the person initially visits a site. This
> technology allows a web site\'s server to place information about the
> consumer\'s visits to the site on the consumer\'s computer in a text
> file that only the web site\'s server can read.[^22] Using a cookie,
> the web site assigns each consumer a unique identifier so that the
> consumer may be recognized in subsequent visits to the site. When the
> consumer revisits the web site, the site opens the cookie file and
> accesses the stored information to help identify the consumer as a
> return guest. When that person lingers over products or services on a
> site, that will be noted and deposited to the cookie file, allowing
> businesses on-line to target their advertising efforts.[^23]
>
> Web sites can also collect information about consumers through hidden
> electronic navigational software that capture information about site
> visits, including web pages visited and information downloaded, the
> types of browser used, and the referring web site's Internet
> address.[^24] These types of cookie files are also deposited on a
> computer when a consumer visits the web site. The files enable a web
> site to recognize a repeat customer and offer products tailored to the
> consumers interests. This practice, known as on-line profiling, is
> best described as aggregating information about consumers\'
> preferences and interests gathered primarily by tracking their
> movements on-line and, in some cases, combining this information with
> personal information collected directly from consumers or contained in
> other databases.[^25]
>
> Due to the large increase in the number of children on-line, this
> segment of the public has established itself as a rich profit source
> for commercial web sites. More and more web sites are targeting
> children and are, therefore, using cookie technology and other means
> to collect personal information on them. While vast amounts of
> personal information are being collected by web sites on consumers,
> both adult and children, the rules governing the use of that
> information has not kept up with emerging technologies that provide
> new ways of collecting and using that information.
>
> Given the speed at which on-line technology and commerce is growing,
> the Internet remains a relatively uncharted frontier in terms of
> general oversight and control by federal, state, and local
> authorities. As a result, the Internet has become a new fertile ground
> for consumer scams. While the criminal element is a concern, consumers
> are more likely to encounter legitimate Internet marketers that have
> simply failed to address the collection and use of information on its
> customers. The industry has focused on obtaining information on
> customers, but has not, in many cases, defined the limits on how they
> obtain or use the data. As a result, unauthorized disclosure of a
> consumer's personal information is a possible consequence. As a whole,
> commercial web sites provide valuable new information and new
> resources for the consumer, but consumers must understand that this
> largely unregulated \"superhighway\" must be traveled carefully to
> avoid becoming a victim.
>
> The Computer Security Institute recently released a study showing that
> losses due to Internet security breaches, including identity theft and
> theft of proprietary information, exceeded \$100 million in 1998.[^26]
> Con-artists and criminals have become opportunistic by capitalizing on
> the technology available and the somewhat unregulated nature of the
> Internet. What raises additional concern is the more common likelihood
> that a legitimate Internet marketer will take advantage of an
> information over-disclosure[^27] without the consumer's knowledge. An
> Internet marketer can gain the full benefit of the information it
> collects by selling the information to third parties. The marketer,
> however, does not suffer the potential negative consequences of
> over-disclosure or unauthorized disclosure,[^28] because customers
> will often never learn of the over-disclosure. Consumers are,
> therefore, unable to pursue redress. From an economic standpoint, the
> Internet marketer has either internalized its gains and externalized
> its losses creating an incentive to overuse the personal
> information,[^29] or in its zeal to make a profit, overlooked the
> consumer privacy protection.
>
> According to an Internet privacy survey conducted by Professor Mary
> Culnan, professor at the McDonough School of Business at Georgetown
> University, 92.8 percent of web sites in the survey collected at least
> one type of personal or individually identifiable information.[^30]
> However, only 65.9 percent of the web sites posted at least one type
> of privacy disclosure (privacy policy notice or information practices
> statement) and 34.1 percent did not post either type.[^31] Only 9.5
> percent of the web sites that collected one type of personal
> information contained at least one survey item for all five core
> principles of fair information practices.[^32] While this could raise
> consumer concerns, it actually represents an improvement over a
> Federal Trade Commission survey conducted a year earlier in which only
> 14 percent of web sites notified consumers of their privacy
> policies.[^33]
>
> Commercial web sites are generally responsible now for voluntary
> compliance or self-regulation concerning consumer privacy and fair
> information practices on-line. While many have raised concerns that
> this is akin to \"the fox watching the hen house,\" the contrary
> argument maintains that the local, state, and federal government are
> all incapable of implementing effective rules and enforcement
> mechanisms, due partially to the speed at which technology is
> advancing.[^34] Indeed, the concern is that such legislation will
> hinder the growth of on-line commerce or that such laws and
> regulations will quickly become obsolete as a result of emerging
> technology. In light of these concerns and in order to realize the
> vision of a flourishing on-line marketplace set forth in President
> Clinton\'s July 1, 1997, presidential directive,[^35] the on-line
> industry has set into motion a number of self-regulatory measures to
> improve the confidence of the consumer and fend off attempts at
> governmental involvement.
>
> In 1998, the Online Privacy Alliance (OPA), a coalition of more than
> eighty on-line companies and trade associations specifically formed to
> encourage self-regulation in the area of privacy on-line, announced
> its Online Privacy Guidelines.[^36] Under those guidelines, which
> apply to individually identifiable information collected on-line from
> consumers, members of the OPA agreed to adopt and implement a posted
> privacy policy that provides comprehensive notice of their information
> practices.[^37] A privacy policy is a statement on a web site
> describing how that site collects and uses information about the
> consumer. Ideally, the policy should be prominently posted and offer
> options about the use of a consumer's personal information.[^38] These
> options, called \"Opt-in\" and \"Opt-out\" provisions give the
> consumer the ability to choose how their personal information is to be
> used.[^39] An opt-in provision, means the web site will not use the
> information unless the consumer specifically says it is permissible to
> do so. An opt-out provision means the web site can use the information
> collected unless the consumer specifically directs the site no to do
> so.[^40]
>
> Other industry-supporting organizations have attempted to promote
> self-regulation through the development of seal programs. A seal
> program requires the licensees to abide by codes of on-line
> information practices and to submit to various types of compliance
> monitoring in order to display a program\'s privacy seal on their web
> site. This allows consumers to identify web sites that follow
> specified information practice principles.[^41] Programs such as
> Truste, BBBOnline, and WebTrust, have been developed in an effort to
> support the industry by promoting the concept of self-regulation.
>
> In 1997, the CommerceNet Consortium and the Electronic Frontier
> Foundation founded Truste, an independent, non-profit
> organization.[^42] Truste currently has a license agreement which
> governs the licensee\'s collection and use of personally identifiable
> information[^43] and has required licensees to adhere to standards for
> notice, choice, access, and security, based on the OPA guidelines
> previously discussed. The Trustee program includes third party
> monitoring and periodic review of licensee information practices.[^44]
>
> BBBOnline, a subsidiary of the Council of Better Business Bureaus,
> began a seal program early in 1999.[^45] The Council of Better
> Business Bureaus is the umbrella organization of the well-known local
> Better Business Bureaus that promote ethical business practices
> through a variety of consumer service and programs.[^46] BBBOnline
> requires applicants to post a privacy policy that meets the program\'s
> information practice principles, complete a Compliance Assessment
> Questionnaire, and agree to participate in an appropriate dispute
> resolution system and to submit to monitoring by BBBOnline.[^47]
>
> WebTrust, created by the American Institute of Certified Public
> Accountants and the Canadian Institute of Chartered Accountants, began
> in 1997.[^48] The WebTrust program, which licenses the WebTrust seal
> to qualifying certified public accountants, requires participating web
> sites to disclose and adhere to stated business practices, maintain
> effective controls over the security and integrity of transactions,
> and to maintain effective controls to protect customer information.
> Seals are awarded after quarterly audits are conducted to ensure
> compliance with the program\'s privacy standards. The WebTrust program
> also has a privacy component, introduced in May 1999, that requires
> members to conform to OPA guidelines.[^49]
>
> In addition to these self-regulatory efforts, many sector-specific
> programs are beginning to emerge with on-line privacy programs
> tailored to the business conducted by a particular industry.[^50] For
> example, in 1998, the Interactive Digital Software Association (IDSA)
> adopted its own set of fair information practice guidelines for member
> web sites. On June 1, 1999, the Entertainment Software Rating Board
> (ESRB), an independent rating system for entertainment software and
> interactive games, introduced ESRB Privacy Online. ESRB Privacy Online
> requires participants to follow information practice standards that
> are similar to IDSA guidelines, uses a consumer hotline on-line for
> reporting violations, and uses an ADR program for disputes.[^51] The
> existence of industry-wide information protection programs and
> sector-specific efforts raises the issues of the existence of
> uniformity among the different programs, what standards each program
> will apply, and whether the consumer will be able to understand the
> differences between each program\'s standards. With so many different
> approaches to the problem of Internet privacy, self-regulation as not
> yet proven to be the best possible solution.
>
> **B. The Federal Trade Commission**
>
> The Federal Trade Commission (Commission) enforces consumer protection
> law through both administrative and judicial processes. In addition to
> the specific consumer protection statutes such as the Fair Credit
> Reporting Act,[^52] the Commission is also responsible for enforcement
> of the basic consumer protection statute, the Federal Trade Commission
> Act (FTCA).[^53] The FTCA provides that \"unfair or deceptive acts or
> practices in or affecting commerce, are hereby declared
> unlawful.\"[^54] The Commission makes the initial determination as to
> violations of consumer protection laws in either an adjudicative or
> rulemaking proceeding. However, even where the Commission determines
> that a practice is unfair or deceptive under the FTCA, the Commission
> must still seek either the aid of a court to obtain civil penalties or
> consumer redress for violations of its orders or trade regulation
> rules.[^55] The FTCA authorizes the Commission to seek injunctive
> relief and other equitable relief, including redress, for violations
> of the FTCA, and provides a basis for governmental enforcement of
> certain fair information practices. However, the federal government as
> a whole currently has limited authority over the collection and
> dissemination of personal data collected on-line; a specific example
> being the Commission\'s general lack of authority to require
> businesses to adopt information practice policies.[^56]
>
> The issue of on-line privacy is nothing new for the Commission. In
> 1995, the Commission held its first public workshop on Internet
> privacy[^57] and has since attempted to address new and unresolved
> privacy concerns in the on-line marketplace. The Commission defined
> its goals in this regard to include identifying potential consumer
> protection issues related to on-line marketing and commercial
> transactions, providing a public forum for the exchange of ideas and
> the presentation of research and technology, and encouraging effective
> self-regulation.[^58] In short, the Commission should generally be
> viewed as the primary agency responsible for consumer protection on
> the Internet and, specifically, for protecting Internet consumer
> privacy.
>
> The Commission produced two major Congressional reports in the last
> two years regarding Internet privacy,[^59] establishing for itself a
> leadership role regarding on-line consumer protection. These reports
> have been part of a four year effort by the Commission to encourage
> widespread implementation of effective protections for consumer
> on-line privacy based on the five fair information practice
> principles.[^60] The notice/awareness principle, which is the core
> principle, states that consumers must be given notice of a company\'s
> information practices before personal information is collected from
> them.[^61] The access/participation principle holds that consumers
> must be given reasonable access to information collected about them
> and the ability to contest that data\'s accuracy and
> completeness.[^62] The choice/consent principle requires that
> consumers be given options with respect to whether and how personal
> information collected from them may be used.[^63] The fourth
> principle, integrity/security principle requires that companies take
> reasonable steps to assure that information collected from consumers
> is accurate and secure from unauthorized use.[^64] Finally, the
> enforcement/redress principle mandates that governmental and
> self-regulatory mechanisms impose sanctions for noncompliance with
> fair information practices.[^65]
>
> Despite the Commission\'s leadership role, its conclusions and
> especially its recommendations on addressing on-line privacy concerns
> have met with mixed reviews and dissent from consumer privacy
> organizations, Congress, and from within the Commission itself. The
> Commission currently endorses self-regulation as the best option
> available, citing both improved self-regulation efforts on the part of
> the private sector and the difficulties for the federal government in
> responding quickly to technological advancements, as well as the fear
> of hindering electronic commerce. Notwithstanding its overall
> recommendations, the Commission has endorsed legislative efforts
> specific to the area of on-line privacy for children, recognizing the
> heightened vulnerability of children exploring the Internet.
>
> **C. Congress**
>
> The overall self-regulation endorsement by the Commission has
> generally staved off most Congressional action so far, but the
> potential exists for significant change. Indeed, that change has
> already begun, at least concerning the privacy interests of children
> using the Internet. Agreeing with the Commission concerning privacy
> for children, Congress passed the Child Online Privacy Protection Act
> (COPPA)[^66] in October 1998. This legislation requires web site
> operators and on-line services that operate web sites directed at
> children to obtain parental consent before collecting information from
> children under the age of thirteen.[^67] COPPA has four primary goals:
> to enhance parental involvement in a child\'s on-line activities in
> order to protect the privacy of children in the on-line environment;
> to help protect the safety of children in on-line forums such as chat
> rooms, home pages, and pen-pal services in which children may make
> public postings of identifying information; to maintain the security
> of children\'s personal information collected on-line; and to limit
> the collection of personal information from children without parental
> consent.[^68] A review of the history of congressional action on
> privacy law reveals a piece-meal approach, targeting specific sectors
> of the industry without the comprehensive and uniform approach found,
> for example, in Western Europe.[^69] While COPPA might not be
> considered part of the targeting-by-industry approach used in the
> past, one could nevertheless conclude this is simply more of the
> piecemeal approach as it applies to only a small portion of the entire
> Internet-using population.
>
> Numerous Internet privacy bills are currently awaiting action by
> Congress, most notably, the Online Privacy Protection Act of 1999[^70]
> and the Consumer Internet Privacy Protection Act of 1999.[^71]
> However, Congress is divided on the issue. Those supporting
> legislation cite consumer protection as the overriding
> consideration.[^72] By contrast, those in support of self-regulation
> agree with the Commission, arguing that the speed of change on the
> Internet effectively minimizes any legislative efforts to protect
> consumer privacy and that legislation will simply impede electronic
> commerce.[^73]
>
> **D. Watchdog Organizations**
>
> Not surprisingly, watchdog organizations, mainly comprising consumer
> advocate groups, generally favor legislation that addresses Internet
> privacy. These groups use a variety of forums to advocate for the
> consumer. Their efforts show up on-line, in the newspaper, and in
> every other available media outlet. Some of these groups are actively
> involved in litigation and lobbying efforts in Washington. Their
> activities can shape the way the consumer and any given member of
> congress feels about Internet privacy, ultimately influencing the way
> the Internet develops in the future. Organizations such as,
> Junkbusters, The Center for Democracy and Technology (CDT), The
> Electronic Privacy Information Center (EPIC), and Privacy Rights
> Clearinghouse (PRC), are just some of the organizations that have been
> consistent promoters of consumer rights and privacy. As a group, they
> have been highly critical of self-regulation, the Commission's
> position on Internet privacy, and the lack of affirmative steps taken
> by the federal government to increase privacy protection on-line.[^74]
>
> Junkbusters, a for-profit organization whose mission is \"to free the
> world from junk communications," provides services to both consumers
> and direct marketers, including tools and information to improve the
> security of private information transferred on-line.[^75] Junkbusters
> even offers a \"Junkbusters Declaration,\" which a consumer can send
> electronically to marketers to limit the sale and transfer of private
> information collected on them.[^76] Junkbusters also has software
> available which can eliminate the deposit of cookies on a computer
> while browsing the Internet.[^77]
>
> The CDT states on its web page that it \"works to promote democratic
> values and constitutional liberties in the digital age.\"[^78] CDT\'s
> web site contains a comprehensive guide to on-line privacy, with a
> \"mini-course\" discussing the Fourth Amendment to the Constitution,
> developments in privacy law issues, and recent Supreme Court rulings
> on privacy issues.[^79]
>
> Two additional organizations are focused almost exclusively on the
> issue of privacy. EPIC, a public interest research center, was
> established in 1994 to focus public attention on emerging privacy
> issues related to the National Information Infrastructure.[^80] EPIC
> conducts litigation, sponsors conferences, produces reports, publishes
> a periodical, and campaigns on privacy issues. EPIC works in
> association with Privacy International, an international human rights
> group based in England.[^81] PRC, a California based non-profit
> consumer organization founded in 1992, provides consumers with a
> number of educational resources on privacy, including publications
> focusing on safeguarding personal privacy. In addition, PRC actively
> advocates concerning consumer privacy issues.[^82]
>
> Many, if not all, of these organizations remain skeptical about
> industry self-regulation efforts, including the seal programs. They
> argue that these efforts fail to fully address fair information
> practices and, therefore, do little to safeguard consumers. These
> organizations perform watchdog duty over consumer electronic media
> issues and are certainly capable of influencing industry practices on
> the Internet.
>
> An example of the influence wielded by these watchdog organizations
> involves industry powerhouse, Intel Corporation. Intel, which unveiled
> its powerful new Pentium III chip in January 1999, agreed, in response
> to a firestorm of protest launched by consumer privacy and advocacy
> groups, to make it possible for computer manufacturers to set the new
> processor so that a serial number (known as a processor serial number)
> on the chip would not be recorded by web sites without the user's
> permission.[^83] Intel's original plan was to embed this unique
> security technology in the Pentium III processor with a hardware code
> that could potentially identify users to Internet companies. Critics
> argued that such a device could be used by Internet marketers to track
> user movements on the Internet.[^84] Intel responded to the threats of
> boycotts and a public affairs blitz by consumer groups with the
> announcement that the identifying system would be modified so that it
> would be automatically disabled unless the consumer used a software
> utility switch to turn it on.[^85]
>
> Another recent target of criticism has been seal program operator
> BBBOnline, which recently gave its "seal of approval" to Equifax, a
> credit-rating firm that has had its share of trouble with the
> Commission.[^86] Consumer privacy groups cited a 1995 Commission
> report claiming Equifax had an established record of privacy
> violations.[^87] The Commission reached an agreement with Equifax in
> 1995 as part of an enforcement action where the Commission accused
> Equifax of systematically violating the Fair Credit Reporting
> Act.[^88] The agreement required Equifax to take numerous steps in
> order to guard the privacy and accuracy of credit reports.[^89] These
> protective measures will face an important test in the future, though
> any failure may be felt most keenly by the consumer. In the wake of
> its agreement with the Commission, Equifax has begun the practice of
> selling credit reports over the Internet to consumers and businesses
> who want to check personal and customer credit status.[^90] The credit
> reporting company is also working on a system to permit on-line
> retailers to check the credit ratings of Internet customers while the
> transaction is taking place.[^91] Unless COPPA applies or until a more
> comprehensive Internet privacy law is passed, consumers will have to
> continue to rely on legislation such as the FCRA to address,
> indirectly, problems arising out of the unauthorized disclosure of
> information.
>
> **E. The Consumer**
>
> The consumer remains the most important player on the issue of
> Internet privacy. As stated in the introduction, a growing number of
> consumers are making the Internet part of their routine in shopping
> for products and services. It is now estimated that almost eighty
> million adults in the United States are using the Internet.[^92]
> Analysts estimate that Internet advertising will grow to almost \$4.5
> billion as we enter the year 2000.[^93] Even though the Internet
> marketplace is growing quickly, some of the emphasis behind
> self-regulation is industry's recognition that many consumers still
> have a serious trust deficit when it comes to providing information
> on-line. The majority of Internet users are not comfortable providing
> credit card (73 percent), financial (73 percent), or personal
> information (70 percent) to businesses on-line.[^94] However, it is
> worth emphasizing that in the world of on-line privacy, one does not
> have to buy something to have personal information collected on
> them---simply visiting a web site is enough.
>
> Eighty-seven percent of respondents in a recent national survey of
> experienced Internet users stated that they were somewhat or very
> concerned about threats to their privacy on-line.[^95] Seventy percent
> of the respondents in a different survey conducted for the National
> Consumers League reported that they were uncomfortable providing
> personal information to businesses on-line.[^96] Consumers are
> specifically concerned about potential transfers to third parties of
> the personal information they have given to on-line businesses.[^97]
> Only about twenty-eight percent of Internet users go beyond merely
> browsing for information to actually purchasing goods and services
> on-line.[^98] In a March 1998 *Business Week* survey, consumers not
> currently using the Internet ranked concerns about privacy and
> communications as the biggest reasons they do not use the
> Internet.[^99]
>
> Many consumers using the Internet are not experienced users, many are
> minors, and many, while experienced, do not understand who is
> collecting information on them, how it is collected, what protections
> exist, and how to respond to the discovery that they have been the
> victim of unauthorized privacy disclosure. For instance, in a 1998
> survey conducted by the Georgia Institute of Technology, 74.3 percent
> of the Internet users polled thought that web sites were prohibited
> from reselling personal information collected on them to third
> parties.[^100] Contrast this with the fact that of the 53 percent of
> the highly trafficked web sites that share or sell information, less
> than 50 percent allow consumers to opt-out of this practice.[^101] The
> consumer may be surprised to discover that no law or regulation
> prohibits this practice. The sole avenue of relief is contingent upon
> the entity violating a general consumer law or an industry specific
> law concerning unfair or deceptive commercial practices.
>
> **III. Protection Mechanisms for On-line Privacy**
>
> Privacy law in the United States is mainly comprised of a collection
> of statutes targeting specific industries that collect personal
> data.[^102] As yet, no law specifically covers all consumers in the
> collection of personal data on-line. There also appears to be little
> in the way of constitutional protection.[^103] As a result, the
> protection of personal information must be established by
> legislation.[^104]
>
> **A. Current Internet Privacy Legislation**
>
> One such piece of legislation is the Children\'s Online Privacy
> Protection Act of 1998 (COPPA),[^105] which limits the ability of web
> sites to collect personal information from persons under the age of
> thirteen.[^106] It also gives the Commission enforcement authority,
> and it allows states to bring actions to enforce the provisions of
> COPPA.[^107] The key provision of the Act provides:
>
> Not later than 1 year after the date of enactment of this Act, the
> Commission shall promulgate . . . regulations that . . . require that
> the operator of any web site or on-line service that collects personal
> information from children or the operator of a web site or on-line
> service that has actual knowledge that it is collecting personal
> information from a child \-\-- (I) provide notice on the web site of
> what information is collected from children by the operator, how the
> operator uses such information, and the operator's disclosure practice
> for such information; and (II) to obtain verifiable parental consent
> for the collection, use, or disclosure of personal information from
> children.[^108]
>
> On April 20, 1999, the Commission issued a proposed rule, consisting
> of regulations implementing COPPA. The rulemaking effort on this
> matter was then presented for public comment through the Federal
> Register.[^109] On October 20, 1999, the Commission issued its final
> rule pursuant to COPPA[^110] by releasing the Children\'s Online
> Privacy Protection Rule that will become effective April 21,
> 2000.[^111]
>
> **B. The Application of Traditional Consumer**
>
> **Privacy Laws to the Internet**
>
> In the absence of this type of legislation, it becomes necessary to
> apply traditional consumer laws, regulations, and other existing rules
> to consumer transactions on the Internet. Any confusion as to whether
> these laws and rules apply to the Internet is due to a number of
> factors, including the difficulty associated with applying traditional
> terminology to modern Internet practice and, for that matter, the
> absence of any reference to the Internet within the legislation.
>
> Following its 1998 Federal Register Notice on Interpretation of Rules
> and Guides for Electronic Media,[^112] the Commission conducted a
> series of public workshops in an effort to generate comment on a
> proposed policy statement. The statement concerned the applicability
> of its existing consumer protection rules and guidelines to newer
> forms of electronic media and the interpretations of certain terms in
> light of the unique character of the electronic media.[^113] One
> purpose of the notice was to eliminate the uncertainty regarding the
> application of the Commission's rules and guidelines to activities on
> the Internet.[^114] Other purposes were to clarify how terms such as
> *writing*, *written*, and *printed* apply when using the Internet for
> transacting electronic commerce and how to determine whether a
> required disclosure statement on a web advertisement is "clear and
> conspicuous."[^115] Traditionally, writing, written, and printed were
> associated only with communications on paper, but with the advent of
> new technology, now includes information that is capable of being
> preserved in a tangible form (such as printing on paper or saving to
> computer disk) and read.[^116] Clear and conspicuous disclosure
> describes a type of information disclosure performance standard. It is
> a disclosure of material information, which must be effectively
> communicated to consumers.[^117] More specifically, it concerns a
> disclosure of material information to consumers in order to prevent
> deception and to ensure consumers receive complete information
> regarding the terms of a transaction, or to further public policy
> goals.[^118] The determination of whether the disclosure is
> effectively communicated is based upon Commission standards involving
> traditional media criteria and an additional set of factors for
> addressing the special attributes of electronic media.[^119]
>
> *1. The Federal Trade Commission Act*
>
> The first example of the application of traditional consumer laws to
> the activities on the Internet concerns the Federal Trade Commission
> Act (FTCA),[^120] which prohibits unfair and deceptive practices in
> and affecting commerce. The FTCA authorizes the Commission to seek
> injunctive and other equitable relief, including redress, for
> violations of the FTCA and provides a basis for government enforcement
> for certain fair information practices.[^121] Failure to comply with
> stated information practices could constitute a deceptive practice in
> some cases. Under the FTCA, the Commission has the authority to pursue
> the remedies addressed under the FTCA for those types of
> violations.[^122] The FTCA also extends to information practices that
> are inherently deceptive or unfair, regardless of whether the entity
> has publicly adopted fair information practices.[^123]
>
> Two recent cases illustrate the Commission's efforts to enforce the
> FTCA. In 1998, the Commission's first Internet privacy case addressed
> deceptive on-line information practices alleged against the web site
> operator GeoCities, which ran one of the most popular sites on the
> Internet.[^124] GeoCities agreed to settle charges that it had
> misrepresented the purposes for which it was collecting personal
> identifying information from children and adults using its on-line
> membership application form and its registration forms for children's
> activities on the GeoCities site.[^125] The settlement, made final in
> February 1999, required GeoCities to post a prominent privacy notice
> on its site, to establish a system to obtain parental consent before
> collecting personal information on children, and to offer consumers it
> had previously collected information on the opportunity to have that
> information deleted.[^126] In a second similar case, the Commission
> reached a proposed settlement with Liberty Financial Companies, Inc.,
> operator of the Young Investor web site.[^127] Turning again to the
> FTCA, the Commission alleged the web site falsely represented that
> personal information collected from children, including information
> about family finances, would be maintained anonymously.[^128] In
> contravention to the web site's representations, the information was
> maintained in a format that allowed individuals to be
> identified.[^129]
>
> In addition to the FTCA, other statutes have potential impact on
> Internet consumer privacy because the institutions to which these laws
> apply have moved onto the Internet along with the consumer. While
> these statutes do not specifically address Internet privacy, they can
> be an effective means of protecting the consumers who use the Internet
> to transact business. Knowledge of these laws is essential especially
> since the only law specifically designed to enforce fair information
> practices, COPPA, was designed to protect children and not adult
> consumers.
>
> *2. Credit Reporting Legislation*
>
> One piece of legislation that could provide some assistance with the
> problem of Internet privacy is the Fair Credit Reporting Act
> (FCRA),[^130] which establishes important privacy protections for
> consumers' sensitive financial information by governing all
> transactions relating to consumer credit reports. Under the FCRA, a
> consumer report is defined as:
>
> Any written, oral, or other communication of any information by a
> consumer reporting agency bearing on a consumer's credit worthiness,
> credit standing, credit capacity, character, general reputation,
> personal characteristics, or mode of living, which is used or expected
> to be used or collected in whole or in part for the purpose of serving
> as a factor in establishing the consumer's eligibility for (A) credit
> or insurance to be used primarily for personal, family, or household
> purposes; (B) employment purposes; or (C) any other purpose authorized
> under section 604 \[of the Act\].[^131]
>
> This has importance for the consumer because credit report information
> is becoming more accessible on the Internet as credit reporting
> agencies take advantage of this growing business medium. Although a
> credit report is only supposed to be available to authorized
> customers, over-disclosure and unauthorized disclosure are certainly
> possible, if not more likely, on the Internet.[^132] The FCRA limits
> the disclosure of consumer credit reports and other personal financial
> information to entities with specific \"permissible purposes,\" such
> as credit evaluation, insurance, employment, or similar
> purposes.[^133] Notwithstanding the use of the Internet to procure
> protected information from or furnish such information to consumer
> credit reporting agencies, the FCRA is no less applicable since the
> Internet is simply a means of obtaining or disclosing the information.
> Indeed, the FCRA should apply whether the information is disclosed
> through the act of mailing, hand delivery, or through cyberspace.
> Willful or negligent noncompliance with FCRA in obtaining or
> disclosing consumer credit information can result in civil and or
> criminal liability, and it would appear that such a violation could
> just as easily occur via the Internet as by other, more traditional
> means of information disclosure. For violations of the FCRA, the
> Commission has enforcement authority, or a state attorney general may
> bring an action for a violation of statute if, after serving notice on
> the Commission, the Commission chooses not to intervene or remove the
> case to federal court.[^134]
>
> A second piece of legislation, which helps to fill loopholes in FCRA,
> is the Consumer Credit Reporting Reform Act (CCRRA).[^135] The CCRRA
> narrows the legitimate need purpose for which credit reports can be
> disseminated by credit reporting agencies.[^136] Under the CCRRA,
> consumer credit reports may be furnished for employment purposes only
> if the consumer has consented in writing.[^137] Again, since the
> Internet is no more than a means of collection/dissemination, the
> CCRRA should clearly be applicable to entities providing credit
> information via the Internet. As a result, the CCRRA would still
> require written consent by the consumer before credit reports could be
> furnished to third parties for employment purposes. Based upon the
> Federal Trade Commission\'s own proposed policy statement on the
> applicability of its own rules and guides to electronic media which
> implement consumer statutes, such consent could be given by
> electronic-mail.[^138]
>
> *3. The Electronic Communications Privacy Act*
>
> The Electronic Communications Privacy Act of 1986 (ECPA)[^139] amends
> Title III of the Omnibus Crime Control and Safe Street Act, commonly
> known as the Wiretap Act.[^140] The ECPA applies to both government
> and private entities, but appears to be more restrictive concerning
> government interception and access. The ECPA prohibits, among other
> things, intentional interception of electronic communications and the
> intentional access of stored electronic communications.[^141] With
> regard to *interception,* the definition is very narrow. The
> acquisition of the communication must be contemporaneous with its
> transmission,[^142] and the statutory definition limits the term
> *intercept* to include only acquisition of the contents of a
> communication.[^143] The ECPA specifically authorizes a provider of
> electronic communication services to record context information of a
> communication.[^144] With regard to stored communications, there is no
> prohibition against a person or entity providing the service
> intentionally accessing stored communications,[^145] there are
> specific restrictions on government access into and disclosure of the
> contents of a stored communication.[^146] This strict application is
> based partly upon the original purpose of the Wiretap Act, which was
> to prevent excessive governmental intrusions into the privacy of
> others.[^147] In addition, the growth of the Internet, which permits
> consumer activities beyond the bounds of the protections established
> the law, seems to have provided a basis for this application of the
> ECPA.
>
> As mentioned previously, the ECPA specifically permits a provider of
> an electronic communications service to record information about the
> context of a communication.[^148] This includes information on the
> duration of the communication and confirmation the communication
> occurred.[^149] A service provider is, however, prohibited from
> knowingly divulging the contents of the communication to any person or
> entity.[^150] There are exceptions that permit interception or access
> based upon consent, the needs of the service provider, or when
> necessary in the ordinary course of business.[^151]
>
> Of particular interest to judge advocates is the case of Senior Chief
> Petty Officer Timothy R. McVeigh.[^152] An alleged ECPA violation was
> one aspect of his 1998 suit against the United States Navy, in
> response to the Navy\'s attempts to discharge him for a violation of
> the homosexual conduct policy.[^153] In that case, Senior Chief
> McVeigh[^154] was the subject of an involuntary administrative
> discharge action by the Navy based upon information that McVeigh had
> allegedly used the word "gay" to describe his marital status in an
> anonymous America Online (AOL) user profile.[^155]
>
> The events began when a civilian Navy volunteer received an
> electronic-mail message through the AOL service regarding a charity
> event. The message box indicated it came from the alias "boysrch," but
> the text of the electronic-mail was signed by someone named
> "Tim."[^156] Through an option available to AOL subscribers, the
> volunteer searched a directory of member profiles to find the profile
> for the person who sent the message. The directory indicated that
> "boysrch" was an AOL member named Tim who lived in Hawaii, worked in
> the military, and whose marital status was listed as gay.[^157] The
> volunteer forwarded the electronic-mail to her husband, a
> noncommissioned officer in the Navy, and ultimately, the message found
> its way to McVeigh\'s commander.
>
> Under the ECPA, the government could obtain information from the
> on-line service provider, but only if it obtained a valid warrant or
> gave prior notice to the on-line subscriber and then issued a subpoena
> or received a court order authorizing disclosure of the information in
> question.[^158] The Navy, after obtaining the initial information from
> McVeigh\'s commander, solicited and obtained personal information from
> AOL to secure the identity of the AOL subscriber who sent the message
> to the volunteer.[^159] That information was obtained from AOL without
> a valid warrant or any advance notice with subpoena or court
> order.[^160] It was this information McVeigh claimed made the
> connection between him and the user profile which formed the basis for
> discharge.[^161]
>
> On January 26, 1998, the federal district court issued a permanent
> injunction preventing the Navy from involuntarily discharging Senior
> Chief McVeigh.[^162] The court stated that \"\[t\]he subsequent steps
> taken by the Navy in its 'pursuit' of \[McVeigh\] were not only
> unauthorized under its policy, but likely illegal under the Electronic
> Communications Privacy Act of 1986.\"[^163] As for AOL, it admitted to
> violating its own privacy policy,[^164] but it appears that disputed
> facts and timely public relations work on the part of AOL, insulated
> AOL, to some extent, from being pursued for an ECPA violation.[^165]
>
> As discussed earlier, the ECPA prohibits an on-line service such as
> AOL from knowingly divulging the contents of an electronic
> communication to any person or entity while in electronic storage by
> that service.[^166] The ECPA penalizes only knowing or intentional
> violations,[^167] and it was not clear from the facts whether the AOL
> representative knowingly disclosed the information to the Navy or
> whether the investigator requesting the information had misled the AOL
> representative. AOL did ultimately enter into an undisclosed
> settlement with McVeigh and implemented new safeguards with respect to
> its own information practices.[^168]
>
> The primary importance of this case for consumers is that their
> personal information is susceptible to disclosure---despite privacy
> policies established by service providers who collect the
> information---and current regulatory efforts are not comprehensive
> enough to cover all unique aspects of electronic media. The ECPA,
> which is legislation specifically designed to address electronic
> communication, seems to address only knowing and intentional
> violations. There is no source of relief to the consumer for
> accidental or negligent acts by a service provider resulting in
> disclosure. Indeed, the analysis in *United States v. Hambrick*[^169]
> suggests that service providers can turn over any stored data to
> nongovernmental entities, not just context information without
> consequence. The court stated it did
>
> not find that the ECPA has legislatively determined that an individual
> has a reasonable expectation of privacy in his name, address, social
> security number, credit card number, and proof of Internet connection.
> The fact that the ECPA does not proscribe turning over such
> information to private entities buttresses the conclusion that the
> ECPA does not create a reasonable expectation of privacy in that
> information.[^170]
>
> Without legal force, the ECPA provides a relatively low incentive for
> service providers to aggressively protect consumer privacy.
>
> *4. Other Privacy Legislation*
>
> The Cable Communications Policy Act of 1984 (CCPA)[^171] governs cable
> television subscriber information. The Act contains consumer
> provisions restricting the collection, storage, and disclosure of
> personally identifiable information without the subscriber's
> consent.[^172] It requires further that service providers inform the
> customer at least once a year of the information it collects; the
> nature, frequency, and purpose of any disclosure; and the consumer's
> right to access that information.[^173] Many cable service providers
> now have web sites that permit consumers to subscribe, pay bills, and
> transact other business with the service. Since cable companies with
> web sites now have the capability to collect and disclose subscriber
> information on-line, the CCPA may provide some protection to
> subscribers.
>
> The Right to Financial Privacy Act of 1978 (RFPA)[^174] pertains to
> individual bank records. This Act provides some confidentiality
> concerning the financial records of depositors by governing the
> transfer of financial records. The RFPA attempts to strike a balance
> between the privacy interests of consumers and the interest of law
> enforcement. Generally, banks are prohibited from disclosing client
> payment information to the government without a court order, although
> a number of exceptions exist.[^175] Under the consumer provisions,
> nearly all federal investigators must provide formal written requests
> to inspect the financial records of an individual kept by a financial
> institution.[^176] The agent must give simultaneous notice to the
> individual who has an opportunity to challenge the attempt to access
> their records.[^177] Many financial institutions now permit consumers
> to bank on-line, giving them the ability to access to their accounts
> and conduct their financial business over the Internet. As a result,
> information provided to a financial institution in this manner may
> become the object of a government request for information. The
> language and intent of the RFPA suggest its application is appropriate
> in these cases.
>
> A closely related piece of legislation is the Electronic Funds
> Transfer Act (EFTA)[^178] which establishes mandatory guidelines for
> the relationship between consumers and financial institutions in
> connection with electronic fund transfers. The EFTA requires
> institutions operating electronic banking services to inform customers
> of the circumstances under which automated banking account information
> will be disclosed to third parties in the ordinary course of
> business.[^179] However, the EFTA does not place restrictions on
> gathering personal information or limit the storage duration of
> transaction records.[^180]
>
> The Video Privacy Protection Act of 1988 (VPPA)[^181] was originally
> designed to govern video rental records. The VPPA, interestingly
> enough, arose out of Judge Robert Bork's Supreme Court confirmation
> hearings during which reporters gained access to the Bork family video
> rental records.[^182] The consumer provisions of the VPPA prohibit
> video stores from disclosing their customers' names and addresses and
> the titles of the videos rented or bought.[^183] Further, rental
> operators are required to destroy rental or sales information after
> one year.[^184] There is, however, an exemption that permits any
> disclosures made incident to the \"ordinary course of business\" of
> the videotape store.[^185] The application of the VPPA to on-line
> retailers that sell videotapes and videodiscs was not part of the
> original legislation because the Internet's commercial viability had
> not yet evolved.
>
> The final piece of traditional legislation likely to have some
> applicability to Internet commerce is the Driver's Privacy Protection
> Act (DPPA).[^186] This statute was passed in 1994 arising in part from
> the aftermath of the stalking/murder of actress Rebecca
> Schaefer.[^187] The murderer allegedly obtained her name and address
> from a motor vehicle department and used the information to locate and
> then stalk her.[^188] The DPPA prohibits state motor vehicle
> departments and their employees from releasing personal information
> from a driver's record unless the request fits within one of several
> exemptions.[^189] It further requires the motor vehicle departments to
> provide a means for a citizen to prevent disclosure of name, address,
> social security number, medical information, or photograph on lists
> that are rented out for marketing or provided to other
> individuals.[^190] As the various state motor vehicle departments
> continue to upgrade services and increase efficiency, this kind of
> personal information on operators licensed in those states will be
> accessible on the Internet to authorized and unauthorized individuals.
> Computer hacking and inadvertent mistakes will likely make licensed
> drivers susceptible to unwanted disclosure of personal information.
>
> One recent development regarding the DPPA and motor vehicle
> information concerned the Aware Woman Center for Choice, in West Palm
> Beach, Florida. Anti-abortion protesters heavily targeted this
> abortion clinic. This past August, the clinic filed a lawsuit against,
> among others, CompuServe alleging a violation of the DPPA by the
> on-line service. The clinic claimed the on-line service provided
> access to personal information that allowed anti-abortionists to trace
> the names and addresses of persons who parked at the clinic.[^191]
> Protesters allegedly recorded license plate numbers of vehicles
> visiting the clinic and used CompuServe to obtain information from
> state motor vehicle offices concerning the names and addresses of the
> owners of those vehicles.[^192] The clinic went on to state that
> protesters then used the information to send harassing letters and
> graphic photographs and, in one case, located and followed a woman who
> had visited the clinic to a hospital and department store.[^193] This
> case may help define the applicability of the DPPA to Internet
> transactions and may provide significant guidance concerning the
> application of other traditional privacy laws to such
> transactions.[^194]
>
> **C. Future Internet Privacy Legislation**
>
> The imperfect application of these statutes to modern Internet
> commerce necessitated congressional action. A host of new legislation
> pending action in Congress could fill the gaps left by COPPA and by
> the application of laws drafted before today's Internet was conceived.
> These bills specifically address the collection and use of personal
> information on the Internet for all consumers.[^195]
>
> The Online Privacy Protection Act of 1999,[^196] sponsored by Senator
> Conrad Burns and Senator Roy Wyden, requires web sites and on-line
> services to post notices about their information collection and use
> policies and allow individuals to prevent disclosure of personal
> information through an opt-out provision.[^197] The bill would
> regulate the activities of web sites and on-line services concerning
> the collection, use, and disclosure of personal information.[^198]
> Personal information as defined in the bill includes name, address,
> electronic-mail address, social security number, telephone number, and
> "information collected on-line from an individual."[^199] A similar
> bill, the Consumer Internet Privacy Protection Act of 1999,[^200]
> sponsored by Representative Bruce Vento, contains three basic
> provisions. First, the interactive computer services would be
> prohibited from disclosing personally identifiable information without
> written consent.[^201] Second, if a service attempts to disclose any
> personal information, it cannot provide false data.[^202] Finally,
> individuals have the right to learn what personal information is being
> maintained by the service.[^203] The primary impact of both Senate
> Bill 809 and house Bill 313 would be very simple and straightforward.
> Consumers not falling under the small umbrella of protection provided
> by COPPA would finally have specific protections concerning the
> collection, use, and disclosure of personal information furnished
> on-line. In other words, the on-line privacy gap mentioned earlier
> would cease to exist.
>
> A third consumer Internet privacy initiative is the Social Security
> On-line Privacy Protection Act,[^204] and it is sponsored by
> Representative Bob Franks. This legislation, known as House Bill 367,
> provides that,
>
> \[a\]n interactive computer service shall not, by means of a reference
> service or otherwise, disclose to a third party (1) an individual's
> Social Security account number, or (2) personally identifiable
> information which is identifiable to an individual by means of the
> individual's Social Security account number, without the individual's
> prior informed written consent.[^205]
>
> The Bill also gives authority to the Federal Trade Commission to
> investigate an interactive computer service to determine whether the
> service is or has been engaged in any act or practice prohibited by
> the Act.[^206]
>
> The last piece of legislation is the Personal Data Privacy Act of
> 1999,[^207] sponsored by Representatives Maurice Hinchey, Gerald
> Kleczka, and George Brown. The bill, which is not limited to Internet
> transactions, would prohibit disclosure of personal data without the
> express consent of the individual.[^208] It requires entities that
> collect the data, including federal, state, and local government, to
> provide access to individuals within five days.[^209] Individuals must
> receive a report once a year on their personal data, whether or not
> they specifically request this report.[^210] The bill would also
> create a private right of action in federal court, with a small set of
> exemptions that apply to governmental entities.[^211]
>
> Although, most of these bills were referred to committee, critics of
> new legislation governing the Internet may prevent these bills from
> reaching the floors of either house. They base their objections on
> evidence suggesting that self-regulatory programs are becoming more
> effective.[^212] The latest Commission report to Congress,
> *Self-Regulation and Privacy Online,*[^213] has garnered enough
> support for self-regulatory efforts that many members of Congress are
> opposing legislation targeting consumer on-line privacy.[^214] In
> fact, there appears to be some bipartisan agreement in Congress that
> Internet commerce should not be impeded by such legislation. Their
> arguments in this regard are buttressed by the very situation that
> proponents of the bill use to support their argument for such
> legislation---technological advancements on the Internet. Opponents
> claim that the legislation could not effectively keep pace with
> technological advancements and would ultimately hinder electronic
> commerce, while those advancing the new legislation worry that without
> laws specifically directed at Internet commerce, consumer privacy
> problems will spin out of control.[^215]
>
> **D. The Private Sector's Approach**
>
> The private sector recently launched an effort to address consumer
> concerns, by promoting self-regulation through the use of seal
> programs. Generally, the programs emphasize providing consumers with
> notice of a company's information practices, the ability to opt-out of
> information sharing, and assurance that appropriate security is used
> to protect personal information.[^216] The programs center on a
> contract between the seal program and the seal holder it licenses. The
> seal is issued in exchange for the Internet marketer's agreement to
> abide by a specific set of standards for handling personal information
> and to permit some form of oversight of the agreement.[^217] All
> licensors use the threat of seal revocation and referral to
> appropriate authorities to assure compliance.[^218]
>
> It is important for consumers to understand that seal programs are
> generally limited to web sites and Internet activity and do not take
> into consideration a company's other information practices. For
> example, GeoCities has been a member of the privacy seal program
> Truste, yet it was required to negotiate a settlement with the
> Commission last year based on allegations of misrepresentation
> concerning the purposes for which personal identifying information was
> being collected.[^219] In March 1999, another Truste seal program
> member, Microsoft, was found to have skirted licensor information
> practices requirements using a "bug" that transferred computer
> hardware identification information to the Microsoft secure server
> without customer consent.[^220] The software module that enables
> customers to register their copies of the *Windows 98* operating
> system for support and updates, contained a number known as a Globally
> Unique Identifier. That identifier was being transmitted to Microsoft
> as part of a list of registration information that generally included
> the owner's name, address, phone number, and other demographic
> information.[^221] Surprisingly, Truste found that Microsoft did not
> violate the license agreement terms of the seal program.[^222] The
> seal program only covered the Microsoft web site and, therefore, did
> not apply to privacy breaches involving its software.[^223] Microsoft
> admitted using the *Windows* data-collection technique, but denied it
> was using the information to track web visitors.[^224] Microsoft
> stated it would discontinue the practice.[^225]
>
> **IV. Helping Consumers Protect**
>
> **Themselves On-line**
>
> The Internet is growing so fast in terms of technology and the amount
> of commerce being conducted, that oversight and control over the
> medium is lagging. This under-regulated commercial tool is also a
> medium where a huge volume of personal information is stored and can
> be accessed by practically anyone. Moreover, Internet marketers
> collecting and using the personal information are in a race to seize
> the potential profits of the Internet. As a result, marketers are
> probably focusing less on the potential adverse impact of disclosing
> private consumer information and more on the potential benefit of
> using the information. This is compounded by the fact that most
> consumers are unaware of how their personal information is collected,
> how much is collected, who is collecting it, who is getting it, and
> for what purpose. On-line marketers become opportunistic beneficiaries
> of the unauthorized disclosure of personal information, yet are
> relatively insulated from accountability since the consumer is largely
> unaware of the practice and unable to stop it.[^226]
>
> Overall, legislation has been less than comprehensive. The privacy
> laws in existence target specific industries, and no Internet privacy
> law currently exists that offers protection for persons over twelve
> years of age. Consumers are left to use other consumer laws to provide
> indirect and imperfect privacy protection. The protection only covers
> the industry targeted by the legislation and only if the information
> that may have been obtained without consent is used in violation of
> the statute. The Federal Trade Commission Act[^227] and some of the
> regulations in existence extend a measure of protection but still do
> not specifically address consumer Internet privacy. Finally,
> constitutionally based privacy protection appears, for the most part,
> non-existent for the Internet consumer, with case law indicating that
> the consumer assumes the risk of voluntarily providing an on-line
> marketer personal information.[^228]
>
> WebTrust, Truste, BBBOnLine, and other industry-supporting
> organizations have all launched seal programs. While the seal program
> standards are higher than current practices of most web sites, these
> standards generally fall short of meeting the fair information
> practices principles.[^229] Since the seal programs generally do not
> require licensees to meet all fair information practices, licensees
> can engage in some questionable information practices without
> technically violating the seal program license agreement.
>
> Simple advice can be powerful advice for consumers. They need to be
> encouraged to protect themselves on-line through education. While most
> experienced users of the Internet can simply be given electronic-mail
> addresses or a search term to educate themselves, web neophytes may
> need more assistance. With a five minute demonstration a judge
> advocate can introduce the client to an almost limitless number of
> resources on the web that contain timely information addressing
> consumer privacy issues. Despite the advice and the helpful resources,
> consumers can find themselves dazzled by Internet's offerings.
> Following a few simple rules to improve personal information security
> on the Internet can help avoid being victimized by companies more
> interested in profits than protecting consumer privacy.
>
> First, always use a secure browser*.* A browser is simply the
> software---usually already installed on the newer computers---used to
> navigate the Internet. The browser should comply with industry
> security standards, such as Secure Sockets Layer (SSL) or Secure
> Electronic Transaction (SET).[^230] These programs encrypt or scramble
> the purchase information sent over the Internet, ensuring the security
> of your transaction. Browsers with these standards can be found and
> downloaded for free over the Internet.[^231] Also, consider buying a
> filter, which is software that allows individuals to block access to
> web sites and content that may be unsuitable.[^232] Finally, any
> advice that can be passed along concerning cookies and cookie
> technology would also be quite helpful.[^233]
>
> Second, make it a habit of shopping with companies they know or have
> investigated. This can be done by reviewing pamphlets, catalogs,[^234]
> or reviews by other consumers.[^235]
>
> Third, keep passwords private. This point cannot be over-emphasized.
> Consumers should also use combinations of numbers, letters, and
> symbols for passwords.[^236]
>
> Fourth, be advised that consumer laws and rules that do not
> specifically address privacy do apply on-line. Knowledge of these laws
> can be helpful when information collected on the consumer is used in
> violation of such a law or rule. Parents with children should be
> informed of the Children's On-line Privacy Protection Act.[^237]
>
> Fifth, always review how the company secures financial records and
> personal information if a consumer intends to pay bills or check their
> account status on-line.[^238]
>
> Sixth, consumers should minimize the amount of personal information
> they provide on-line. It may be unrealistic to expect those who use
> computers to stop providing personal information on-line. However,
> consumers should be made aware that something as harmless as a contest
> or "prize give-away" on the Internet provides yet another opportunity
> for the consumer to dump more and more personal information on the
> Internet, to be sold, transferred, and used in a variety of ways.
>
> Seventh, consumers should read and understand a company's privacy
> policy. If the web site fails to provide a privacy policy, consumers
> should be sensitive to the increased risks associated with transacting
> business on that site. Consumers should look for opt-in and opt-out
> provisions in a privacy policy.[^239] This will provide them with
> greater control over their personal information.
>
> Eighth, consumers should not let down their guard just because there
> is some sort of seal of approval. Seal programs do not assure privacy
> protection.[^240] Consumers need to know about the benefits and the
> limits of seal programs and how easy it is to be misled about the
> scope and type of protection offered by the site with a privacy seal.
>
> Finally, advise consumers to "bookmark" the Federal Trade Commission
> web site.[^241] In fact, every legal assistance attorney should do the
> same. The Commission web page is an open door to a wealth of
> information on consumer privacy and even includes the latest version
> of the *Consumer Resource Handbook*.[^242]
>
> **V. Conclusion**
>
> This article only scratches the surface concerning what judge
> advocates and consumers need to know about consumer internet privacy,
> privacy law, exploring the Internet, and preserving the privacy of an
> individual's personal information. Indeed, it is possible that by the
> time this article is published, significant changes in the law and
> advancements in technology could cause some portions of this article
> to become outdated. Considering that, judge advocates must be
> sensitive to maintaining their expertise by reading the new
> developments in case law, and technology news from the various
> information sources, including, of course, the Internet.
>
> Information overload from the enormous advancement of technology, and
> constantly evolving issues surrounding privacy on the Internet, as
> well as the practical problem of pulling one's self away from daily
> responsibilities of justice, claims, or contracts, can make it
> difficult to stay on top of legal issues concerning the Internet. In
> that regard, this article can be used as an overview or \"stepping
> off\" point for learning more about Internet privacy. However, the
> hope is that the legal assistance attorney will gain a better
> understanding of the resources, the current attitudes and
> developments, and the issues involved. With this knowledge, judge
> advocates will be in a better position to advise the client who surfs
> the web.

[^1]: \* *Major Pippin (B.S., Arkansas Tech University; J.D., University
    of Arkansas School of Law) is currently the Chief of Cadet
    Disenrollments at HQ USAFA/JA, United States Air Force Academy,
    Colorado. He is a member of the Bar of the State of Arkansas.*

    ^?^ William J. Clinton, Presidential Directive, Memorandum for the
    Heads of Executive Departments and Agencies (July 1, 1997)
    \<available at http://www.whitehouse.gov/WH/New/
    Commerce/directive.html\>.

[^2]: Federal Trade Commission, *Self-Regulation and Online Privacy: A
    Report to Congress*, at 6 (July 1, 1999)
    \<http://www.ftc.gov/opa/1999/9907/report1999.htm\> \[hereinafter
    Federal Trade Commission, *Self-Regulation and Online Privacy*\].
    This report examined the new developments in the on-line marketplace
    and industry progress in self-regulation programs. The FTC vote to
    issue this report was three to one with Commissioner Anthony
    concurring in part and dissenting in part.

[^3]: Mary J. Culnan, *Georgetown Internet Privacy Policy Survey: Report
    to the Federal Trade Commission*, app. E, at 91 (1999) \[hereinafter
    Culnan, *GIPPS Report*\] (comment of Beth Givens of the Privacy
    Rights Clearinghouse) (also available at http://www.msb.edu/faculty/
    culnanm/gippshome.html). Professor Culnan was the study director for
    the GIPPS Report. The report resulted from a survey conducted to
    provide a progress report to the FTC on the extent to which
    commercial web sites have posted privacy disclosures based on fair
    information practices. The Privacy Rights Clearinghouse participated
    as part of an advisory group for this survey. Ms. Givens submitted a
    written response to the GIPPS Report on behalf of the Privacy Rights
    Clearinghouse. The response is at Appendix E of the GIPPS Report as
    an advisory group comment.

[^4]: The Internet is the universal network that allows information in
    the form of words, text, graphics, and sound, to be transferred
    between computers anywhere in the world. Federal Trade Commission,
    *Sight Seeing on the Internet* (1999)
    \<http://www.ftc.gov/bcp/conline/pubs/ online/sitesee/index.html\>
    \[hereinafter Federal Trade Commission, *Sight Seeing on the
    Internet\]*

[^5]: *See* William M. Daley, Secretary of Commerce, Remarks at United
    States Department of Commerce Press Conference on E-Commerce, Feb.
    5, 1999 (available at http://204.193.246.62
    /public.nsf'docs/commerce-ftc-online-shopping-briefing).

[^6]: *See* [The Boston Consulting Group, The State of Online
    Retailing]{.smallcaps} 7 & app. A (Nov. 1998). In July 1999, the
    Boston Consulting Group released results of a second volume in this
    study, which revealed that on-line revenues in North America totaled
    14.9 billion in 1998, and it was estimated that revenues would top
    \$36 billion in 1999. The Boston Consulting Group, *BCG on
    E-Commerce* (last visited Nov. 30, 1999)
    http://www.bcg.com/features/shop/main\_ shop.html.

[^7]: *See* Internet Advertising Bureau, *Advertising Revenue Report*
    (May 1999) \<http://www.iab. net/news/content/1998results.html\>.

[^8]: The World Wide Web refers to the worldwide network or linkages of
    Internet destinations called web sites that can be used to view and
    retrieve all types of data. The Internet encompasses the World Wide
    Web, as well as other electronic information exchanging features,
    such as Telnet, File Transfer Protocol, and USENET newsgroups.
    Interpretation of Rules and Guides for Electronic Media: Request for
    Comment, 63 Fed. Reg. 24996, 24997 (1998) (to be codified at 16 CFR
    ch.1). Federal Trade Commission, *Sight Seeing on the Internet,
    supra* note 4.

[^9]: *See* Federal Trade Commission, *Privacy Online: A Report to
    Congress*, at 3-4 (June 1998)
    \<http://www.ftc.gov/reports/privacy3/index.htm\> \[hereinafter
    Federal Trade Commission, *Privacy Online*\]. This report to
    Congress examined the information practices of commercial web sites
    on the World Wide Web and industry attempts at self-regulation.

[^10]: *See* Interpretation of Rules and Guides for Electronic Media:
    Request for Comment, 63 Fed. Reg. at 24997.

[^11]: *See* Lorrie Faith Cranor et al., *Beyond Concern: Understanding
    Net Users' Attitudes About Online Privacy*, at 2, 5, 10 (1999)
    \[hereinafter Cranor, *Understanding Net Users' Attitudes*\]
    (available at http://www.research.att.com/projects/privacystudy).
    *See also* Federal Trade Commission*, Privacy Online*, *supra* note
    9, at 46.

[^12]: *See* Federal Trade Commission, *Commission Announces Proposal to
    Clarify How the Law Will Apply to Advertising and Commercial
    Transactions on the Internet* (May 1998) \<http://
    www.ftc.gov/opa/1998/9805/interbus.htm\>.

[^13]: *See* Federal Trade Commission, *Sight Seeing on the Internet,
    supra* note 4.

[^14]: *See id*.

[^15]: *See id*.

[^16]: *See id.*

[^17]: *See* Federal Trade Commission, *Self-Regulation and* *Privacy
    Online,* *supra* note 2, at 20.

[^18]: *See id.* at 10-11, 19-20.

[^19]: *See* Federal Trade Commission, *Privacy Online*, *supra* note 9,
    at 4-5, 12-13; Federal Trade Commission, *Self-Regulation and*
    *Privacy Online,* *supra* note 2, at 19-20. The Federal Trade
    Commission has attempted, in both its 1998 and 1999 Commission
    Reports, to explain personal information, personally identifiable
    information, and individually identifiable information. Despite this
    effort, it remains unclear whether the industry and other
    organizations are using the same terms in the same manner. The
    Commission has made further attempts to establish the meaning of
    personal information in the context of on-line privacy by defining
    the term in the new Children's Online Privacy Protection Rule, 16
    C.F.R. pt. 312 (1999), implementing the Children's Online Privacy
    Protection Act, 15 U.S.C. § 6501 (1999).

[^20]: *See* Federal Trade Commission, *Privacy Online*, *supra* note 9,
    at 7, 48-49.

[^21]: *See id*.

[^22]: *See* *id*. at 45-46; Federal Trade Commission, *Sight Seeing on
    the Internet, supra* note 4.

[^23]: *See* Federal Trade Commission, *Privacy Online*, *supra* note 9,
    at 45-46.

[^24]: *See id*. at 46. When an individual on the Internet uses an
    advertising banner on one web site to move to a different web site,
    the web site displaying the advertising banner is called the
    referring web site.

[^25]: *See* Federal Trade Commission, *Self-Regulation and* *Privacy
    Online,* *supra* note 2, at 2, 13.

[^26]: *See* Peter McGrath, *Knowing You All Too Well*, [Newsweek,
    Science and Technology]{.smallcaps}, Mar. 29, 1999, at 113 (also
    available at http://newsweek.com/nw-srv/issue/13_99a/printed/us/
    st/ty0113_1.htm). The Computer Security Institute (CSI) is a
    membership organization providing information security education to
    information, computer and network security professionals. CSI
    provides education to its members through training seminars on
    Internet security, network security, risk analysis, and awareness.

[^27]: The term *over-disclosure* refers to more uses of the information
    than those to which the customer has agreed.

[^28]: The term *unauthorized disclosure* refers to any information
    disclosed that the customer did not consent to. Over-disclosure is
    distinguished from unauthorized disclosure in that over-disclosure
    suggests some information disclosed on the customer was based upon
    customer consent.

[^29]: *See* Peter Swire, *None of Your Business: World Data Flows,
    Electronic Commerce, and the European Privacy Directive*, ch. 1, at
    4 (1999) \<http://www.acs.ohio-state.edu/units/law/
    swire1/Julychapter1.htm\>.

[^30]: *See* Culnan, *GIPPS Report, supra* note 3.

[^31]: *See id*. at 6.

[^32]: *See id*.

[^33]: *See* Federal Trade Commission, *Self-Regulation and Privacy*
    *Online, supra* note 2, at 4.

[^34]: *See* *id.* at 4, 12; Culnan, *GIPPS Report*, *supra* note 3, at
    app. E; David W. Carney, *Online Privacy Bill Runs Aground,* [Tech
    L. J.]{.smallcaps} (July 27, 1999) \<http://www.techlawjournal.com/
    privacy/19990727.htm\>.

[^35]: *See* William J. Clinton, Presidential Directive, Memorandum for
    the Heads of Executive Departments and Agencies (July 1, 1997)
    \<http://www.whitehouse.gov/WH/New/Commerce/ directive.html\>.

[^36]: *See* Federal Trade Commission, *Self-Regulation and* *Privacy
    Online,* *supra* note 2, at 7-9.

[^37]: *See id*.

[^38]: *See* Federal Trade Commission, *Sight Seeing on the Internet,
    supra* note 4; Federal Trade Commission, *Privacy Online*, *supra*
    note 9, at 7; Culnan, *GIPPS Report, supra* note 3*,* at 13*.*

[^39]: *See* Federal Trade Commission, *Sight Seeing on the Internet,
    supra* note 4; Federal Trade Commission, *Privacy Online*, *supra*
    note 9, *at 9.*

[^40]: *See* Federal Trade Commission, *Sight Seeing on the Internet,
    supra* note 4; Federal Trade Commission, *Privacy Online*, *supra*
    note 9, *at 9.*

[^41]: *See* Federal Trade Commission, *Self-Regulation and* *Privacy
    Online,* *supra* note 2, at 9-12.

[^42]: *See id*. at 9.

[^43]: *See id*. at 10. Individually identifiable information and
    personally identifiable information generally have the same meaning.
    However, there does not yet appear to be a universally accepted
    definition for either term, therefore, the type of information
    comprising the term may vary among the entities using a particular
    term.

[^44]: *See id.* at 9.

[^45]: *See id.* at 10-11.

[^46]: *See* [United States Office of Consumer Affairs, 1997 Consumer
    Resource Handbook]{.smallcaps} 34 (1996) \[hereinafter [Consumer
    Resource Handbook]{.smallcaps}\].

[^47]: *See* Federal Trade Commission, *Self-Regulation and* *Privacy
    Online,* *supra* note 2, at 10.

[^48]: *See id*. at 11.

[^49]: *See id*.

[^50]: *See id*. at 11-12.

[^51]: *See id*.

[^52]: 15 U.S.C. § 1681 (1998).

[^53]: 15 U.S.C. § 41.

[^54]: 15 U.S.C. § 45(a)(1).

[^55]: *See* Federal Trade Commission, *A Brief Overview of the Federal
    Trade Commission\'s Investigative and Law Enforcement Authority*
    (Apr. 1998) \<http://www.ftc.gov/ogc/brfovrvw. htm\> \[hereinafter
    Federal Trade Commission, *Overview*\].

[^56]: *See id*.

[^57]: *See* Federal Trade Commission, *Privacy Online*, *supra* note 9,
    at 2.

[^58]: *See id*.

[^59]: *See generally* Federal Trade Commission, *Self-Regulation and*
    *Privacy Online,* *supra* note 2; Federal Trade Commission, *Privacy
    Online*, *supra* note 9.

[^60]: *See generally* Federal Trade Commission, *Self-Regulation and*
    *Privacy Online,* *supra* note 2.

[^61]: *See id.* at 3.

[^62]: *See id*.

[^63]: *See id*.

[^64]: *See id.* at 3-4.

[^65]: *See id.* at 3.

[^66]: 15 U.S.C. § 6501 (1999).

[^67]: *See* 15 U.S.C. §§ 6501, 6502(a).

[^68]: *See* 144 Cong. Rec. S12,789 (daily ed. Oct. 21, 1998) (statement
    of Sen. Bryan).

[^69]: *See* Swire, *supra* note 29, at 1-2. Unlike the United States,
    Western Europe has passed a comprehensive law addressing privacy
    that treats privacy as a basic human right for individuals. *See*
    European Union Directive on Data Protection, Council Directive
    95/46, 1995 O.J. (L 281) 31.

[^70]: S. 809, 106th Cong. (1999).

[^71]: H.R. 313, 106th Cong. (1999).

[^72]: *See* Carney, *supra* note 34, at 2.

[^73]: *See id.* at 2.

[^74]: *See* Culnan, *GIPPS Report, supra* note 3, at 67-71, 91-94; Jeri
    Clausing, *After Intel Chip\'s Debut, Critics Step Up Attack*, [N.Y.
    Times On The Web]{.smallcaps} (Feb. 19, 1999) \<http://www.
    nytimes.com/library/tech/99/02/cyber/articles/19intel.htm\>. *See
    also* John Markoff, *Microsoft to Alter Software in Response to
    Privacy Concerns*, [N.Y. Times On The Web]{.smallcaps} (Mar. 7,
    1999)
    \<http://www.nytimes.com/library/tech/99/03/biztech/articles/07soft.
    html\>.

[^75]: Junkbusters, *The Mission of Junkbusters* (visited Sep. 6, 1999)
    \<http://www.junkbusters. com\> \[hereinafter Junkbusters,
    *Mission*\].

[^76]: Junkbusters, *How to Protect Your Privacy from Commercial
    Invasions* (visited Sep. 6, 1999) \<http://www.junkbusters.com\>.

[^77]: *See* Junkbusters, *Mission*, *supra* note 75. *See also*
    Junkbusters, *Internet Junkbuster Headlines* (visited Sep. 6, 1999)
    \<http://www.junkbusters.com\>.

[^78]: Center for Democracy and Technology, *CDT\'s Mission* (visited
    Sep. 6, 1999) \<http://www. cdt.org/mission.shtml\>.

[^79]: *See* Center for Democracy and Technology*, Guide to Online
    Privacy* (visited Sep. 6, 1999)
    \<http://www.cdt.org/privacy/guide/basic/index.html\>.

[^80]: The National Information Infrastructure (NII) is also known as
    the \"information superhighway.\" The NII is the interconnection of
    computers and telecommunication networks, services, and
    applications. It includes an expansive range of physical facilities
    and equipment used to transmit, store, process, and display voice,
    data, and images.

[^81]: *See* Electronic Privacy Information Center, *Latest News*
    (visited Sep. 6, 1999) \<http://www.epic. org\>; Electronic Privacy
    Information Center, *EPIC Online Guide to Privacy Resources*
    (visited Sep. 6, 1999)
    \<http://cpsr.org/cpsr/privacy/epic/privacy_resources_faq. html\>
    \[hereinafter EPIC, *Privacy Resources*\].

[^82]: *See* Privacy Rights Clearinghouse, *More About Us* (visited Sep.
    6, 1999) \<http://www. privacyrights.org\>. EPIC, *Privacy
    Resources, supra* note 81.

[^83]: *See* Clausing, *supra* note 74.

[^84]: *See id*.

[^85]: *See id.*

[^86]: *See* Tim Clark, *BBBOnline Takes Flak for Equifax Approval,*
    [CNET News.com]{.smallcaps} (Apr. 21, 1999)
    \<http://www.news.com/News/Item/0,4,35487,00.html\>.

[^87]: *See id. See also* Equifax Credit Information Services, Inc., 60
    Fed. Reg. 9842 (Federal Trade Commission 1995) (proposed consent
    order).

[^88]: 15 U.S.C. § 1681 (1998). The Commission charged that Equifax
    violated the FCRA by failing to assure the accuracy of the consumer
    credit information it complies and sells to credit grantors,
    employers, and others organizations. *See* Equifax Credit
    Information Services, Inc., 60 Fed. Reg. 9842 (Federal Trade
    Commission 1995) (proposed consent order).

[^89]: The Commission's consent agreement with Equifax Credit
    Information Services, Inc., a subsidiary of Equifax Inc., requires
    Equifax to accept the consumer's version in disputes when
    documentation provided by the consumer supports the consumer, unless
    there is a legitimate reason to doubt the authenticity of the
    documentation. Equifax is also required to reinvestigate, within
    thirty days, information disputed by a consumer in his or her credit
    report. If Equifax does not verify the information within that time,
    Equifax is required to delete the information until it can be
    verified. Any derogatory information, which is verified after being
    deleted, cannot be reinserted without providing written notice to
    the consumer. Furthermore, Equifax is required to furnish consumer
    reports only for the permissible purposes set forth in the FCRA. The
    Commission also required Equifax to file a report within 180 days
    after the order became final, detailing how Equifax had complied
    with the settlement provisions, submit for approval a methodology
    for tracking changes on its computer system, and maintain additional
    record keeping requirements to permit the Commission to monitor
    Equifax for compliance with the order. Equifax Credit Information
    Services, Inc., 60 Fed. Reg. 9842 (Federal Trade Commission 1995)
    (proposed consent order).

[^90]: *See* Equifax Consumer Services, Inc., *Credit Profile Product
    Page* (last visited Nov. 7, 1999)
    \<http://www.eqifax.com/econsumer/pgCreditProfile.html\>

[^91]: *See* Clark, *supra* note 86.

[^92]: *See* Intelliquest, Inc., *Worldwide Internet/Online Tracking
    Service, 4th Quarter 1998 Report* (Nov. 1998)
    \<http://www.intelliquest.com\>.

[^93]: *See* Federal Trade Commission, *Privacy Online, supra* note 9,
    at 3.

[^94]: *See* Center for Democracy and Technology, *Behind the Numbers:
    Privacy Practices on the Web* (July 28, 1999)
    \<http://www.privacyexchange.org\> \[hereinafter CDT, *Behind the
    Numbers*\].

[^95]: *See* Cranor, *Understanding Net Users' Attitudes, supra* note
    11, at 5.

[^96]: *See* [Louis Harris & Associates, Inc*.,* National Consumers
    League: Consumers and the 21st Century]{.smallcaps} 4 (1999). The
    National Consumers League (NCL) is a private, nonprofit consumer
    organization that represents the interests of consumers in the
    workplace and marketplace through education, research, and advocacy.

[^97]: *See* Cranor, *Understanding Net Users' Attitudes, supra* note
    11, at 2, 10.

[^98]: *See* Intelliquest, Inc., *Worldwide Internet/Online Tracking
    Service, 1st Quarter 1999 Report* (Apr. 19, 1999)
    \<http://www.intelliquest.com/press/release78.asp\>.

[^99]: *See Business Week/Harris Poll: Online Insecurity*, [Bus.
    Wk]{.smallcaps}., Mar. 16, 1998, at 102.

[^100]: *See* Georgia Institute of Technology, *Graphic, Visualization,
    & Usability Center 10th WWW User Survey, 1998*, *Online Privacy &
    Security* (last visited Nov. 7, 1999) \<http://www.
    cc.gatech.edu/gvu/user_surveys/survey-1998-10/\>.

[^101]: *See* Culnan, *GIPPS Report, supra* note 3, at 24-25.

[^102]: *See* Federal Trade Commission, *Privacy Online*, *supra* note
    9, at 40, 62.

[^103]: The constitutional implications of this issue are beyond the
    scope of this article. In *United States v. Katz*, 389 U.S. 347
    (1967), the Supreme Court stated \"\[w\]hat a person knowingly
    exposes to the public . . . is not a subject of Fourth Amendment
    protection.\" *Id.* at 351. *See also* Rakas v. Illinois, 439 U.S.
    128 (1978) (reiterating that one who voluntarily discloses something
    to another assumes the risk of losing Fourth Amendment protection).
    In *United States v. Miller*, 425 U.S. 435 (1976), the Supreme Court
    commented on the privacy of bank records and private financial
    documents. Holding that there was no legitimate expectation of
    privacy in original financial records, the Court concluded that the
    Fourth Amendment did not protect information "revealed to a third
    party . . . even if \[it\] is revealed on the assumption that it
    will be used only for a limited purpose and that the confidence
    placed in a third party will not be betrayed." *Id.* at 443. Thus,
    it appears there may not be a constitutional right to privacy
    concerning personal information relayed to an entity on-line. For a
    general discussion of this issue, including the Supreme Court\'s
    risk analysis approach in applying Fourth Amendment protection, see
    Randolph S. Sergent, *Note: A Fourth Amendment Model for Computer
    Networks and Data Privacy*, 81 [Va. L. Rev]{.smallcaps}. 1181
    (1995). For an excellent case discussion on constitutional privacy
    issues and how it applies in conjunction with privacy legislation,
    see *United States v. Hambrick*, 55 F. Supp. 2d 504 (1999).

[^104]: *See* Federal Trade Commission, *Privacy Online*, *supra* note
    9, at 62.

[^105]: 15 U.S.C. § 6501 (1999).

[^106]: *See id.* §§ 6501(1), 6502(b).

[^107]: *See id*. §§ 6502(c), 6504. Section 6502(c) of COPPA provides
    that the Children\'s Online Privacy Protection Rule shall be treated
    as a rule issued under Section 18(a)(1)(B) of the FTCA, 15 U.S.C.
    57a(a)(1)(B), which is the provision providing enforcement authority
    for unfair or deceptive acts or practices under section 5 of the
    FTCA.

[^108]: 15 U.S.C. § 6501.

[^109]: Children\'s Online Privacy Protection Rule, 64 Fed. Reg. 22750
    (1999) (to be codified at 16 C.F.R. pt. 312).

[^110]: 15 U.S.C. § 6502.

[^111]: *See* Children\'s Online Privacy Protection Rule, 64 Fed. Reg.
    22750. The Children\'s Online Privacy Protection Rule, which
    implements COPPA, imposes several requirements on operators of web
    sites and on-line services directed to children or who have actual
    knowledge that the person from whom they seek information is a
    child. First, these service providers must post, on their web sites,
    links to a notice that explains their collection, use, and disclose
    practices for personal information from children. Second, with some
    exceptions, the service provider must obtain parental consent prior
    to collection, use, or disclosure of information gathered from a
    child. Third, these providers may not condition a child\'s
    participation in on-line activities on the provision of more
    personal information than is reasonably necessary to participate in
    the activity. Fourth, parents must be given the opportunity to
    review their children\'s information and have it deleted from the
    operator\'s database. Finally, service providers are required to
    establish procedures to protect the confidentiality, security, and
    integrity of personal information collected from children. *See* 16
    C.F.R. § 312.8 (1999). The Rule also contains a safe harbor
    provision for service providers following Commission-approved
    self-regulatory guidelines. Such providers will be deemed to be in
    compliance with the requirements of the Children\'s Online Privacy
    Protection Rule if the operator complies with self-regulatory
    guidelines that are approved by the Federal Trade Commission. *See
    id.* § 312.10.

[^112]: Interpretation of Rules and Guides for Electronic Media, Request
    for Comment, 63 Fed. Reg. 24996, 25000 (1998) (to be codified at 16
    CFR ch.1). In a May 6, 1998, Federal Register Notice, the Commission
    submitted a proposed policy statement regarding the applicability of
    its consumer protection rules and guides to the new forms of
    electronic media, such as email, CD-ROMs, and the Internet. As of
    the writing of this article, the comment period had not ended and
    the Commission had not issued any policy guidelines on this issue.

[^113]: *See id.* A Commission workshop was held May 14, 1999, to
    further review the proposed policy statement published in the
    Federal Register Notice. The Commission examined a number of factors
    to determine whether disclosures in traditional media (e.g., print,
    television, and radio) met the clear and conspicuous performance
    standard. The Commission may consider a disclosure\'s type size,
    placement, color contrast to background, duration, and timing. The
    existence of any images that detract from the effectiveness of the
    message is also taken into consideration. *Id*. at 25002. In audio
    messages, such as those delivered over the radio, the Commission may
    examine the volume, cadence, and placement of a disclosure, as well
    as the existence of any sounds that detract from the effectiveness
    of the message. *Id*. In all media, the Commission examines the
    language and syntax of the disclosure to determine whether it is
    likely to be understood by the relevant audience. *Id*. The special
    attributes of electronic media may call for additional guidance.
    There are several factors the Commission proposes to use to evaluate
    the clear and conspicuous standard as applied to electronic media:
    (1) whether the disclosure is unavoidable by the consumer; (2) the
    proximity of disclosure to the representation they qualify and its
    location on the web page; (3) whether, regardless of the size of a
    disclosure, other elements of an advertisement may distract
    consumers and cause them to fail to notice, read, or listen to the
    disclosure; (4) whether the disclosure is appropriately repetitive;
    and (5) whether the audio and visual presentation enhance the
    effectiveness of the disclosure. *See* Transcript of Public
    Workshop*, Rules and Guides for Electronic Media Issues* (May 14,
    1999) \<http://www.ftc.gov/bcp/rulemaking/elecmedia/ index.htm\>. As
    of the writing of this article, the comment period had ended, though
    the Commission had not yet issued any policy guidelines on this
    issue.

[^114]: *See* Federal Trade Commission, *Announcement of Date of Public
    Workshop*, at 2 (Mar. 1999)
    \<http://ftc.gov/os/1999/9903/rules&guidesworkshopfrn.htm\>.

[^115]: Interpretation of Rules and Guides for Electronic Media, Request
    for Comment, 63 Fed. Reg. at 25002.

[^116]: *See id*. at 25000.

[^117]: *See id*. at 25001-02.

[^118]: *See id*.

[^119]: *See id*. at 24996, 25001-02.

[^120]: 15 U.S.C. § 41 (1997).

[^121]: *See id*. § 45.

[^122]: *See id*.

[^123]: *See id*. § 45(a), (b).

[^124]: *See* Federal Trade Commission, *Internet Site Agrees to Settle
    FTC Charges of Deceptively Collecting Personal Information in
    Agency's First Internet Privacy Case* (Aug. 13, 1998)
    \<http://www.ftc.gov/opa/1998/9808/geocitie.htm\> \[hereinafter
    Federal Trade Commission, *First Internet Privacy Case*\].

[^125]: *See* GeoCites, 63 Fed. Reg. 44624 (Federal Trade Commission
    1998) (proposed consent order). The final decision and order are
    available at http://www.ftc.gov/os/1999/9902/ 9823015d&o.htm.

[^126]: *See id.*

[^127]: *See* Liberty Financial Companies, Inc., 64 Fed. Reg. 29031
    (Federal Trade Commission 1999) (proposed consent order). The
    proposed settlement was submitted for public comment in May 1999.
    The comment period has not yet expired.

[^128]: *See id*. (complaint is available at
    http://www.ftc.gov/os/1999/9905/lbrtycmp.htm.).

[^129]: *See id*.

[^130]: 15 U.S.C. § 1681 (1998). For a comprehensive look at the Fair
    Credit Reporting Act, see Captain Julie J.R. Huygen, *After the Deal
    is Done: Debt Collection and Credit Reporting*, 47 A.F. L. Rev. 89
    (1999).

[^131]: 15 U.S.C. § 1681(a)(d).

[^132]: In August 1997, the giant credit bureau Experian (formerly TRW)
    began offering on-line delivery of credit reports, but shut down the
    service two days later after a problem with the software was
    discovered. Seven of the first-day applicants received somebody
    else's report. Cyrus Afzali, *Web Credit Reports Pulled*, [CNN
    Financial Network]{.smallcaps} (Aug. 15, 1997) \<http://
    www.cnnfn.com/digitaljam/9708/15/experian\>. *See* McGrath, *supra*
    note 27, at 113. Experian presently does not offer reports on-line.

[^133]: 15 U.S.C. § 1681b.

[^134]: *See* Federal Trade Commission, *Overview*, *supra* note 55.
    *See* *also* Federal Trade Commission, *First Internet Privacy Case,
    supra* note 124.

[^135]: 15 U.S.C. §§ 1681-1681t.

[^136]: *See id*. *See also* Privacy Exchange, *National Sector Laws*
    (visited Aug. 31, 1999) \<http://
    www.privacyexchange.org/legal/nat/sect/natsector.html\>.

[^137]: *See* 15 U.S.C. 1681b(b).

[^138]: *See* Interpretation of Rules and Guides for Electronic Media;
    Request for Comment, 63 Fed. Reg. at 25000 (1998).

[^139]: 18 U.S.C. §§ 2510-2520, 2701-2709 (1999).

[^140]: *Id.* § 2510.

[^141]: *See id.* §§ 2510, 2701. While the term \"access\" is not
    specifically defined in the ECPA, section 2701(a)(1) generally
    prohibits intentional access without authorization, a facility
    through which an electronic communication service is provided; or
    intentionally exceeding an authorization to access that facility,
    and thereby obtaining, altering, or preventing authorized access to
    a wire or electronic communication while it is in electronic storage
    in such a system. For a more in-depth discussion of the ECPA, see
    Lieutenant Colonel LeEllen Coacher, *Permitting System Protection
    Monitoring: When the Government Can Look and What It Can See*, 46
    A.F. L. Rev. 155 (1999).

[^142]: *See* Steve Jackson Games Inc. v. United States, 36 F.3d 457
    (5th Cir. 1994); United States v. Moriarty, 962 F. Supp. 217 (D.
    Mass. 1997).

[^143]: *See* 18 U.S.C. §§ 2510(4), 2711. The term *contents* is defined
    under section 2510(8). \"\[W\]hen used with respect to any wire,
    oral, or electronic communication, \[contents\] includes any
    information concerning the substance, purport, or meaning of that
    communication.\" *Id.* § 2510(8). Section 2711 incorporates the
    definitions set forth in section 2510 for purposes of sections
    2701-2711.

[^144]: *See id*. § 2511 (2)(h)(ii). That section states that it shall
    not be unlawful

    > for a provider of electronic communication service to record the
    > fact that a wire or electronic communication was initiated or
    > completed in order to protect such provider, another provider
    > furnishing service toward the completion of the wire or electronic
    > communication, or a user of that service, from fraudulent,
    > unlawful or abusive use of such service.

    *Id.*

[^145]: *See id*. § 2701(c)(1).

[^146]: *See id*. §§ 2702, 2703.

[^147]: *See* Wiretap Act, Pub. L. No. 90-351, 82 Stat.197 (1968),
    *reprinted in* 1968 U.S.C.C.A.N. 237.

[^148]: *See id.* §§ 2511(2)(h)(ii), 2703(c)(1)(a). *But see* United
    States v. Hambrick, 55 F. Supp. 2d 504, 507 (1999) (suggesting the
    ECPA permits service providers to turn over any stored data and
    transactional records over to any nongovernmental entity).

[^149]: *See* 18 U.S.C. §§ 2511 (2)(h)(ii), 2703(c)(1)(a).

[^150]: *See id*. § 2702(a)(1). The distinction between context and
    content is critical to an understanding of the ECPA.

[^151]: *See id*. §§ 2511, 2517, 2702, 2703.

[^152]: McVeigh v. Cohen, 983 F. Supp. 215 (D.D.C. 1998).

[^153]: *See generally* 10 U.S.C. § 654 (1998). For a comprehensive
    discussion of the legal issues surrounding the military's homosexual
    conduct policy, see Captain John A. Carr, *The Difference Between
    Can and Should:* Able v. United States *and the Continuing Debate
    About Homosexual Conduct in the Military,* 46 [A.F. L. Rev. 1
    (1999).]{.smallcaps}

[^154]: No relation to the primary defendant in the Oklahoma City
    Bombing Case.

[^155]: *See* McVeigh, 983 F. Supp. at 216-17.

[^156]: *Id*. at 217.

[^157]: *Id.* It is interesting to note that the profile included some
    additional, unpublicized information describing interests such as
    \"collecting pics of other young studs\" and \"boy watching,\" but
    the profile apparently had no identifying information such as full
    name, address, or phone number. *Id*. at 217. The volunteer, though,
    had communicated with the Plaintiff about his participation in the
    charity event on previous occasions. *Id*.

[^158]: *See* 18 U.S.C. §§ 2510-2520, 2701-2709.

[^159]: McVeigh, 983 F. Supp. at 217-18.

[^160]: *See id*. at 219.

[^161]: *See id*. at 218.

[^162]: *See id*. at 222.

[^163]: *Id.* at 219.

[^164]: *See* Bradley Graham, *Gay Sailor Takes Navy Retirement
    Settlement; AOL Also Will Pay For Privacy Violation,* [Wash.
    Post]{.smallcaps}, June 13, 1998, at A03; Janet Kornblum, *AOL
    Admits to Privacy Lapse*, [CNET News.com]{.smallcaps} (Jan. 21,
    1998) \<http://news.cnet.com/news/0-1005-200-325806.html\>.

[^165]: After admitting it violated its own privacy policy, AOL issued a
    public apology, improved its in-house training program for customer
    service representatives, agreed to an out-of-court settlement with
    McVeigh, and publicly blamed the Navy for misleading one of their
    customer service representatives to gain access to the information.
    *See id.*

[^166]: *See* 18 U.S.C. § 2702(a)(1)

[^167]: *See* *id.* §§ 2511, 2701, 2702.

[^168]: *See* Graham, *supra* note 164*,* at A03.

[^169]: 55 F. Supp. 2d 504 (1999).

[^170]: *Id.* at 508-9.

[^171]: 47 U.S.C. § 521 (1999).

[^172]: *See id*. §§ 551, 552.

[^173]: *See id*.

[^174]: 12 U.S.C. § 3401 (1999).

[^175]: *See id*. §§ 3403, 3413. There exist fifteen exceptions to the
    general prohibition. However, an in depth discussion of those
    exceptions is beyond the scope of this article. For more information
    on these exceptions and the RFPA generally, as well as how the RFPA
    applies to Internet commerce, see Bryan S. Schultz, Comment,
    *Electronic Money, Internet Commerce, and the Right to Financial
    Privacy: A Call for New Federal Guidelines,* 67 [U. Cin. L.
    Rev.]{.smallcaps} 779 (1999); Nancy M. Kirschner, *The Right to
    Financial Privacy Act of 1978 - the Congressional Response to United
    States V. Miller: A Procedural Right to Challenge Government Access
    to Financial Records*, 13 [U. Mich. J.L. Reform]{.smallcaps} 10
    (1979).

[^176]: *See* 12 U.S.C. § 3402.

[^177]: *See id*. §§ 3402, 3410.

[^178]: 15 U.S.C. §§ 1693-1693(r) (1998).

[^179]: *See id*.

[^180]: *See id*.

[^181]: 18 U.S.C. § 2710 (1999).

[^182]: *See* Privacy Exchange, *National Sector Laws* (visited Aug. 31,
    1999) \<http://www.
    privacyexchange.org/legal/nat/sect/natsector.html\>.

[^183]: *See* 18 U.S.C. § 2710(b).

[^184]: *See id*. § 2710(e).

[^185]: *Id*. § 2710(b)(2).

[^186]: *Id*. §§ 2721-2725.

[^187]: *See* Condon v. Reno, 972 F. Supp. 977, 979 n.4 (1997). *See
    also* Jennifer Carter, *Access to DMV Records May Change*, [Or.
    Daily Emerald]{.smallcaps}, Nov. 26, 1996, at 1.

[^188]: *See* Carter, *supra* note 187, at 1.

[^189]: *See* 18 U.S.C. §§ 2721-2725. There are fourteen exemptions that
    generally relate to use by a government agency in the ordinary
    course of business and health, safety, and research concerns. *See
    id*.

[^190]: *See* 18 U.S.C. § 2725, 2725 cmt. at 381 (Supp. 1999)

[^191]: *See* Courtney Macavinta, *Abortion Clinic Sues CompuServe,
    ISP*, [CNET News.com]{.smallcaps} (Jan 6, 1999)
    \<http://www.abcnews.go.com/sections/tech/CNET/cnet_abortion990106.html\>.
    *See also* Aware Woman Center for Choice v. Raney, No.
    99-5-CIV-ORL-18C (M.D. Fla. filed Jan. 5, 1999). *Aware Woman Center
    for Choice v. Raney* was dismissed on September 1, 1999, for failure
    to prosecute. However a similar harassment suit was brought on March
    2, 1999, by Manhattan Magnolia, a parent corporation of the Aware
    Woman Center for Choice, and six other plaintiffs against many of
    the same defendants in the previous suit, including CompuServe.
    *See* Manhattan Magnolia v. Unterburger, No. 99-CV-8164 (M.D. Fla.
    filed Mar. 2, 1999). This most recent suit alleges violations of
    several constitutional rights and federal statutes, including the
    Driver\'s Privacy Protection Act.

[^192]: *See* Manhattan Magnolia, No. 99-CV-8164, at 3-20 (complaint).

[^193]: *See id.*

[^194]: The protection afforded by the DPPA on and off-line may be in
    jeopardy. In *Condon v. Reno*, 972 F. Supp. 977 (1997), the State of
    South Carolina won an injunction against the United States
    preventing enforcement of the DPPA in the state. The court found
    that the DPPA failed to properly enforce the Fourteenth Amendment
    guarantee of the right to privacy and concluded that while some of
    the matters protected by the DPPA are personal in nature, the court
    found the matters not to be entitled to constitutional protection.
    The Fourth Circuit upheld the decision, but the issue is far from
    resolved. *See* Condon v. Reno, 155 F.3d 453 (4th Cir. 1998), *cert.
    granted,* 119 S. Ct. 1753, 143 L. Ed. 2d 786 (1999).

[^195]: This article will only review the four most promising pieces of
    legislation.

[^196]: S. 809, 106th Cong. (1999).

[^197]: *See id.*

[^198]: *See id*.

[^199]: *Id.* *See also* Library of Congress, *Thomas, Legislative
    Information on the Internet, S. 809* (visited Aug. 22, 1999)
    \<http://thomas.loc.gov/cgi-bin/bdquery/D?d106:144:./temp/\~bdjnfB::/
    bss/d106query.html\> (bill summary and status).

[^200]: H.R. 313, 106th Cong. (1999). []{.mark}

[^201]: *See id*. Interactive computer service is defined as any
    information service that provides computer access to multiple users
    via modem to the Internet.

[^202]: *See id*.

[^203]: *See id*.

[^204]: H.R. 367, 106th Cong. (1999).

[^205]: *Id*. *See also* Library of Congress, *Thomas, Legislative
    Information on the Internet, H.R. 367* (visited Aug. 22, 1999)
    \<http://thomas.loc.gov/cgi-bin/bdquery/D?d106:20:./temp/
    \~bdIDxN::/bss/d106query.html\>.

[^206]: *See* H.R. 367.

[^207]: H.R. 2644, 106th Cong. (1999).

[^208]: *See id.* This is known as the opting out. []{.mark}

[^209]: *See id.*

[^210]: *See id.*

[^211]: *See id.*

[^212]: *See* Federal Trade Commission*, Self Regulation and Online
    Privacy, supra* note 2, at 12; Culnan, *GIPPS Report*, *supra* note
    3, app. E at 65, 74, 89, 95; Carney, *supra* note 34.

[^213]: *See* Federal Trade Commission, *Self-Regulation and Online
    Privacy, supra* note 2.

[^214]: *See* Carney, *supra* note 34.

[^215]: *See id*.

[^216]: *See* CDT, *Behind the Numbers, supra* note 94, at 11; Federal
    Trade Commission, *Self-Regulation and* *Privacy Online,* *supra*
    note 2, at 9-12.

[^217]: *See* CDT, *Behind the Numbers, supra* note 94, at 11; Federal
    Trade Commission, *Self-Regulation and* *Privacy Online,* *supra*
    note 2, at 9-12.

[^218]: *See* CDT, *Behind the Numbers, supra* note 94, at 11; Federal
    Trade Commission, *Self-Regulation and* *Privacy Online,* *supra*
    note 2, at 9-12.

[^219]: *See supra* notes 124-126 and accompanying text.

[^220]: *See* John Markoff, *supra* note 74.

[^221]: *See id*.

[^222]: *See* Wired News Report*, Microsoft Off Truste's Hook* (Mar. 22,
    1999) \<http://www.wired.
    com/news/news/technology/story/18639.html\>.

[^223]: *See id.*

[^224]: *See id.*

[^225]: *See id.*

[^226]: *See* Swire, *supra* note 29, at 4.

[^227]: 15 U.S.C. § 41 (1998).

[^228]: *See supra* note 103.

[^229]: *See* Culnan, *GIPPS Report*, *supra* note 3, app. E at 91.

[^230]: American Express Company, *Shop Safely Online* (1998)
    \<http://www.ftc.gov/bcp/conline/ pubs/online/cybrsmrt.htm\>
    \[hereinafter American Express, *Shop Safely Online*\].

[^231]: *See id*.

[^232]: *See* Federal Trade Commission, *Sight Seeing on the Internet,
    supra* note 4.

[^233]: *See supra* notes 22-26 and accompanying text.

[^234]: *See American Express, Shop Safely Online, supra* note 230.

[^235]: Consumers should be cautioned about product reviews found
    on-line. Such reviews might be nothing more than a "lure" or "hook"
    ploy designed to fool the customer about the value of the product.

[^236]: Such advice should be easy to provide to would-be consumers
    since members of the Department of Defense are responsible for
    practicing good operation security by using similar techniques on
    their computers at work.

[^237]: 15 U.S.C. § 6501 (1999). For a discussion of this legislation,
    see *supra* notes 105-111 and accompanying text.

[^238]: *See American Express, Shop Safely Online, supra* note 230.

[^239]: *See id.* For a complete discussion of seal programs, see
    *supra* notes 41-49 and accompanying text.

[^240]: *See* CDT, *Behind the Numbers, supra* note 94.

[^241]: The Federal Trade Commission web site address is
    http://www.ftc.gov.

[^242]: *See* [Consumer Resource Handbook]{.smallcaps}, *supra* note 46.