# Presentation: 161817

## THE BOSTON CONSULTING GROUP

- THE BOSTON CONSULTING GROUP

**eTRUST INTERNET PRIVACY STUDY****Summary of Market Survey Results**

**March 12, 1997**

## eTRUST INTERNET PRIVACY STUDYSummary of Market Survey Resultsprepared foreTRUSTByThe Boston Consulting GroupTwo Embarcadero CenterSan Francisco, California  94111telephone: 415-732-8000e-mail: etrust.study@bcg.comMarch 12, 1997

## PROLOGUE

**The following pages are a partial summary of the results of a project conducted by The Boston Consulting Group, Inc. on behalf of eTRUST – a not-for-profit organization co-founded by CommerceNet and the Electronic Frontier Foundation **
**The purpose of the project was to investigate consumer and business attitudes regarding privacy of personal information online.  A further objective was to develop a business model for a privacy assurance entity that would create and enforce guidelines for disclosure of privacy policies and the handling of personal information online **
**The market survey portion of the project included 9,300 responses to an online consumer survey, 55 responses to an online merchant survey and 17 merchant interviews**
**The BCG project team consisted of:**
**Michael Kleeman – Vice President**
**Andy Blackburn – Manager**
**Theanne Thomson – Consultant**

## PRIVACY IS A MAJOR CONCERN ON THE INTERNET To a Greater Extent Than in the Physical World

**In the physical world, privacy often **
**has been a subliminal issue**

**Businesses historically have collected and used many forms of personal information, but mostly in ways that are not highly visible to consumers**
**Information is collected through multiple channels (transactions, mail, in person, etc.)...**
**... and stored in forms not directly observable by the consumer**
**In addition, the use of personal information is not often easily linked to a specific source**
**In the physical world, consumers rely on subjective cues to determine how much they trust a business **
**Cues can include appearance of the business, conduct of personnel, community ties, etc..**
**Consumers use these cues for determining whether and how they will disclose information or conduct a transaction**

**The Internet has elevated consumers’ **
**latent concerns about privacy**

**The Internet offers businesses opportunities to make greater use of consumers’ personal information**
**Online businesses have access to sophisticated tools to collect and manipulate information**
**Generating the potential for misuse or abuse**
**The Internet makes the collection and use of personal information more threatening to consumers **
**Many sites are asking consumers to provide detailed personal information online**
**A number of sites are collecting information from consumers without their knowledge or permission**
**Some sites are providing online access to personal information**
**On the Internet, consumers lack many of the traditional cues they use to gauge their trust a business**

**Online consumers want to know:  Who stands behind this site?  Can I trust them?  **
**How do they intend to use my information?  Will they take care in protecting my privacy?**

## PRIVACY IS AN IMPORTANT ELEMENT OF CONSUMER TRUSTTrust Spans Issues of Privacy, Security and Authentication

**PRIVACY IS AN IMPORTANT ELEMENT OF CONSUMER TRUST****Trust Spans Issues of Privacy, Security and Authentication**

**Privacy**
**“****what?”**

**Security**
**“****how?”**

**Authentication**
**“****who?”**

***“******How will you protect whatever information I give you?”***
***- and -***
***“******How can I protect myself from sites taking whatever information they want without my knowledge?”***

***“******Who wants my information for what purposes?”***

***“******How can I ensure that my information will go only to the place(s) I intend?”***

**TRUST**

**Technology**

**Business**
**Practices**

## SUMMARY OF KEY FINDINGS (I)Consumer and Merchant Perspectives on Privacy

**Consumers express strong concerns regarding privacy over the Internet**
**Interested in limiting and controlling spread of their information**
**See privacy and security as interrelated and overlapping issues**
**Generally less willing to disclose more sensitive personal information to businesses they are not familiar with**
**Consumers also recognize that they have only crude control over dissemination of their personal information**
**Primarily through opting-out or disguising their identity**
**Usually based on a subjective assessment of trust**

## SUMMARY OF KEY FINDINGS (II) Consumer and Merchant Perspectives on Privacy

**Consumers indicate they would increase the depth and breadth of their Internet activity in response to a privacy disclosure and assurance program**
_**Assurance**_** of non-dissemination of personal information would have a significant impact, increasing consumer willingness to participate in ****e-commerce by a factor of 2 to 3**
_**Disclosure**_** of privacy practices alone would have a more limited impact, increasing consumer willingness to participate by approximately 50%**
**The combined positive impact on e-commerce could reach $6B by 2000**
**Merchants also express interest in a privacy assurance program, however, they are less certain about specific benefits to their businesses**
**Smaller companies seeking trusted brand recognition see highest value**
**Larger companies want a proven, credible program before signing on**

## CONSUMERS’ PRIVACY CONCERNS ARE LIMITING INTERNET ACTIVITY AND THE GROWTH OF E-COMMERCE

**Issue**

**Georgia Tech survey**

**BCG/eTRUST survey**

**Supporting evidence**

**Internet privacy is generally ****high concern for consumers**
**Internet generates higher privacy concerns than traditional media **
**Privacy concerns inhibit ****Internet activity/commerce**
**Consumers refuse to give****information**
**Consumers give ****inaccurate information **** **

**94% expressed strong desire for****private communications over Internet**
**86% expressed desire to control use ****of demographic data**
**81% believe sites do not have right to resell demographic information without****permission**
**More than magazine vendors (71%)**
**70% of consumers cite privacy ****concerns as primary reason for not ****registering demographic information**
**34% of consumers give inaccurate ****registration information**

**76% expressed concern about sites monitoring browsing on Internet **
**(70% concerned about purchases)**
**39% willing to pay >0.5% of selling price for privacy assurance (29% for disclosure)**
**71% are more concerned about information transmitted over Internet than telephone**
**72% are more concerned about Internet than mail**
**42% of consumers refuse to give registration information because of privacy concerns**
**27% sometimes falsify information because of privacy concerns**

**Addressing Internet privacy can favorably influence e-commerce market development**

- Source: 6th Annual GVU survey; BCG/eTRUST Internet privacy survey; BCG analysis

## PRIVACY IS A CONSISTENT, SIGNIFICANT CONCERN FOR INTERNET CONSUMERS

**Privacy concerns are consistent across Internet experience levels...**

**... ****and across geographies**

**Respondents somewhat/very concerned over privacy**
**(%)**

**1,609**

**1,650**

**2,395**

**3,052**

**Sample size:**

**Internet experience (months)**

**Respondents somewhat/very concerned over privacy (%)**

**8,649**

**Sample size:**

**Region**

**352**

**114**

**138**

**86**

**87**

**86**

**86**

**88**

**70**

**94**

**77**

- Source: BCG/eTRUST Internet privacy survey

**38**

**74**

**28**

**61**

## PRIVACY IS AN ISSUE ACROSS ALL AGES AND INCOMES

**Salary ($K)**

**<22**

**22–30**

**31–45**

**45–60**

**Age**

**<30**

**30–60**

**60–90**

**>90**

**Increasing privacy concern**

**=**

**100**
**respondents**

**=**

**% somewhat****or very ****concerned**
**about privacy**
**of informa-****tion given to**
**businesses**

- Source: BCG/eTRUST Internet privacy survey

**76%**

**86%**

**90%**

**94%**

**75%**

**87%**

**91%**

**93%**

**57%**

**86%**

**89%**

**93%**

**68%**

**79%**

**87%**

**90%**

**Consumer concern over information provided online**

## A LARGE PROPORTION OF CONSUMERS SEE SECURITY AND PRIVACY AS OVERLAPPING ISSUES 

- Source: BCG/eTRUST Internet privacy survey

**Consumers see similar value in **
**security and privacy assurance**

**% of respondents who say assurance will increase their comfort in giving information over Internet**

**78**

**86**

**Consumers intermingle privacy and security**

**Many respondents’ comments indicated genuine privacy concerns**
**“****How do I know who is on the other end of the line?  It is too easy for con artists to set up shop on the Internet”**
**“****I’m concerned information will be collected without my knowledge, especially in a form that is easily disseminated and sold”**
**However, many respondents (up to 40%) don’t make a clear distinction between security and privacy**
**Hackers, encryption frequently cited as privacy concerns**
**“****I don’t want to end up like Sandra Bullock in *****The Net*****”**
**“****I’m concerned companies are collecting data without my knowledge, **_**but that’s a different issue than privacy**_**”**

**Online businesses need to address both privacy **_**and**_** security to increase consumer confidence in electronic commerce**

## CONSUMERS INDICATE PRIVACY ASSURANCEHAS GREATER VALUE THAN DISCLOSURE ALONE (I)

**Consumers asked under what conditions they would be willing to disclose various types of information over the Internet**
**Would give today**
**Would give if privacy policies **_**disclosed**_** — e.g., including if information is shared with third party**
**Would give if privacy policies disclosed and privacy was **_**assured**_** — e.g., no information given to third party    **
**With no privacy disclosure, consumers are less likely to disclose key financial information (credit card number, Social Security number, bank and stock information) than basic demographic or registration information over the Internet**

## CONSUMERS INDICATE PRIVACY ASSURANCEHAS GREATER VALUE THAN DISCLOSURE ALONE (II)

**Privacy **_**disclosure**_** increases consumer willingness to give information **
**If a site discloses its privacy practices, up to 18% of respondents would give information that they otherwise wouldn’t disclose **
** **
_**Assurance**_** of non-dissemination of personal information has a much more significant impact**
**If a site assures non-dissemination of personal information, up to 45% of respondents would give more sensitive information they otherwise wouldn’t disclose**
**Reflects strong consumer desire to control the spread of their information**

## CONSUMER WILLINGNESS TO DISCLOSE VARIES WITH TYPE OF INFORMATION AND KIND OF BUSINESS

**Consumers less willing to disclose **
**more sensitive information...**

**... ****particularly to businesses they have **
**little familiarity with**

**Consumers generally disclose more information to businesses they have established relationship/are familiar with**
**They are less comfortable disclosing information to businesses they don’t know well **
**Particularly very sensitive information**
**Leads to an understanding of which types of online businesses could benefit the most from privacy assurance**

**Survey respondents (%)**

**Registration data (name; email)**

**Personal info (prod. preferences;  job info; date of birth)**

**Key numbers (SS#; credit cards)**

**Sensitive info (salary; bank/stock info; medical)**

**Would give over Internet today**

**Would give if privacy policy disclosed**

**Would never give over Internet**

- Source: BCG/eTRUST Internet privacy survey

**Home/work mailing address**

**Would give if privacy assured**

## CONSUMERS ARE LESS WILLING TO DISCLOSE PERSONAL INFORMATION TO UNFAMILIAR COMPANIES

**CONSUMERS ARE LESS WILLING TO DISCLOSE ****PERSONAL INFORMATION TO UNFAMILIAR COMPANIES**

**63**

- (1) Includes name, address, credit card number, product preferences
- (2) Includes social security number, bank account, stock portfolio, medical history
- Source: BCG/eTRUST Internet privacy survey; BCG analysis

**Sensitivity of information**

**=  Privacy disclosure/assurance opportunity**

**... ****company never **
**heard of before**

**... ****company ****familiar with**

**... ****company currently**** do business with**

**High**

**Low**

**86**

**51**

**Customer relationship with company**

**Weak**

**Strong**

**Very personal/health/ financial**
**information****(2) **

**Transaction information****(1)**

**Basic demographic/ information**

**Percent of total respondents very/somewhat **
**uncomfortable giving information to...**

**94**

**74**

**58**

**17**

**13**

**38**

## MOST WEB SITES TODAY REPRESENT SMALLER, LESS WELL KNOWN COMPANIES

**MOST WEB SITES TODAY REPRESENT ****SMALLER, LESS WELL KNOWN COMPANIES**

**Retail**

**Information only**

- (1) Medical and finance sites not mutually exclusive from information and retail sites
- (2) BCG estimate of adult sites
- (3) Excludes 7.6M home businesses, .02% of which have web sites
- Source: Yankee Group; Datamation & Co.; Computer Intelligence Corp., IDC, Activ Media

**Website by activity/ type**

**Small**
**<100**
**6,803,000 **
**50,330**

**Medium**
**100–999 **
**139,000 **
**24,385**

**Large**
**1000+ **
**6,360 **
**3,180**

**High sensitivity**

**Low sensitivity**

**Company size**
**(number of employee)**
**Total U.S. companies****(3)**** **
**U.S. companies with websites**

**Company size**

**(67–74)**

**% sites**

**Approximate Number of Web Sites–1996**

**Medical**
**Finance**
**Adult**

**(7–9)****(1)**

**(8–10)****(1)**

**(9–12)****(2)**

**(14–30)**

**=  Privacy disclosure/assurance opportunity**

**700**

**13,800**

**6,700**

**900**

**35,500**

**17,200**

**2,200**

**11,100**

**5,400**

## DISCLOSURE OF PRIVACY PRACTICES INCREASES CONSUMER COMFORT IN GIVING INFORMATION Levels the Playing Field For Companies with Low Brand Recognition

**Very personal, health/financial information****(2)**
**Transaction information****(1)**
**Basic demographic data**

**3.5x**
**2.9x**
**1.8x**

**Percent of total respondents **
**comfortable giving information to...**

**... ****company never heard of before**

**... ****company never heard of before but discloses accredited privacy practices**

- (1) Includes name, address, credit card number, product preferences
- (2) Includes social security number, bank account, stock portfolio, medical history
- Source: BCG/eTRUST Internet privacy survey

**Increase due to privacy disclosure**

**6%**
**14%**
**37%**

**21%**
**40%**
**65%**

**26%**
**49%**
**83%**

**... ****company familiar with**

**Even large, brand-name companies would benefit from greater consumer trust with respect to sensitive information**

**Type of**
**information**

## PRIVACY ASSURANCE IS LIKELY TO BOLSTER E-COMMERCE Consumers Want to Know That Their Information Will Be Treated Responsibly

**A small proportion of consumers are participating in e-commerce today**

**If privacy is **_**assured**_**, retail, financial and medical transactions are likely to increase**

**Consumers (%)**

- (1) Preliminary estimate: 9.2M of 23M _online_ consumers conduct financial transactions, assume 1/3 conducted over Internet
- Source: IDC, GeorgiaTech; University of Michigan; Hermes project; Jupiter Communications; BCG/eTRUST Internet privacy survey; BCG analysis

**Survey respon-dents**
**(%)**

**Email**

**Browse**

**Retail shopping**

**Financial transactions****(1)**

**Browsing, information, chat**

**Retail shopping (purchase)**

**Financial transactions (banking trading stocks)**

**Medical****transactions**

**Would do over Internet if privacy policy disclosed**

**Would do over Internet**

**Currently do over Internet**

**69**

**12**

**18**

**13**

**5**

**87**

**63**

**10–15**

**45**

**46**

**10–13**

**11**

**4**

**12**

**8**

**9**

**Would do over Internet if privacy assured**

**6**

**40**

**5**

**8**

## PRIVACY ASSURANCE COULD HAVE UP TO A$6 BILLION IMPACT ON E-COMMERCE BY 2000If Privacy Programs Are Adopted by Commerce Sites(1)

**Projected global consumers on the Internet**

**Projected e-commerce consumer market**

- (1) Assumes 40% of e-commerce merchants adopt eTRUST by 2000 (on a transaction basis)
- (2) Estimates based on eTRUST consumer survey results, adjusted to reflect overlapping security concerns and rate of adoption
- Source: Forrester; Computer Reseller News; Computerworld; IDC; BCG estimates and analysis

**(M)**

**($B)**

**Range**
**of****estimates**

**Potential**
**privacy**
**impact****(2)**

**Assurance**

**Disclosure**

**Consumer****e-commerce**

## MERCHANTS SURVEYED EXPRESS INTEREST IN ANINTERNET PRIVACY ASSURANCE PROGRAMBut Level of Interest Varies With Size of Firm

**Most merchants interviewed express interest in a privacy assurance program**
**Small businesses seeking stronger brand recognition and credibility expressed higher interest than larger businesses with strong existing brands outside the Internet**
** **
**Majority of merchants perceive the primary benefit of privacy assurance to be promoting electronic commerce in general**
**Many believe that privacy will have a direct economic impact on their businesses**
**Smaller businesses foresee a greater impact than larger businesses **
**30% increase in customers versus 15% increase**
**Large businesses want proven credibility before signing on**
**worry about diluting their brand**

## SMALL AND MEDIUM-SIZED COMPANIES HAVETHE GREATEST INTEREST IN PRIVACY ASSURANCE

**SMALL AND MEDIUM-SIZED COMPANIES HAVE****THE GREATEST INTEREST IN PRIVACY ASSURANCE**

**Privacy interest (total sample)**

**Privacy interest (excluding eTRUST pilots)**

**Percent**
**respondents**

**Percent**
**respondents**

**12**

**45**

**40**

**46**

**12**

**5**

**Medium company (100–999 employees)**

**Large company (1000+ employees)**

**Small company (<100 employees)**

**Very **
**interested**

**Somewhat**
**interested**

**Neutral**

**Somewhat**
**uninterested**

**Not very**
**interested**

**75%**

**61%**

**Very **
**interested**

**Somewhat**
**interested**

**Neutral**

**Somewhat**
**uninterested**

**Not very**
**interested**

**26**

**6**

**6**

**10**

**–**

**5**

**6**

**–**

**3**

**2**

**–**

**2**

**1**

**–**

**2**

**Small**

**Medium**

**Large**

**# Merchants**

**8**

**1**

**2**

**5**

**-–**

**4**

**6**

**–**

**3**

**1**

**–**

**2**

**1**

**–**

**2**

**Small**

**Medium**

**Large**

**# Merchants**

- Source: BCG/eTRUST Internet merchant survey

## PRIVACY ASSURANCE PERCEIVED PRIMARILYAS OFFERING BROAD SOCIAL BENEFITSBusinesses Also Foresee Some Direct Economic Benefits

**Smaller firms expect privacy assurance to have a greater economic benefit**

**Merchants in general have lower expectations than consumers about the business impact of privacy assurance **
**Smaller businesses believe privacy programs could increase the size of their customer base by 0 to 30% **
**Average expected increase of 17%**
**Medium to large businesses expect a 0 to 16% increase **
**Average of 10%**

**Percent of respondents who rated benefits in top 3 of 8 factors**
**(%)**

**Companies mostly see broad, social benefits of privacy assurance**

**Economic (builds my business)**

**Social (promotes e-commerce)**

**Benefit category:**

**Privacy assurance benefits by category**

- Source: BCG/eTRUST Internet merchant survey

## SUMMARY (I)

**Consumers are concerned about controlling the privacy of their personal information on the Internet **
**Privacy concerns generate multiple negative effects on e-commerce**
**low rates of consumer participation**
**falsification of personal information given online**
**potential for government intervention**
**Consumers would welcome Internet privacy assurance**
**indicating that they would modify their behavior accordingly**
**Online businesses mostly see broad, social value in addressing these concerns**
**Perceive less direct value to their business than indicated by consumers**
**Many may mistake privacy concerns for security issues**
**Some believe that their brands will carry them through**

## SUMMARY (II)

**Online businesses will need to take action in order to build consumer trust in electronic commerce and further the development of the electronic marketplace**
**Beyond technical solutions**
**Beyond security and authentication**
**Addressing consumer concerns about the privacy of their information**
**disclosure of information practices**
**assurance of good business practices generally**
**An independent privacy assurance entity could generate significant benefits for ****e-commerce as well as for consumers and online businesses**
**Increased consumer trust and confidence in online businesses**
**Higher accuracy of consumer information provided online**
**Increased consumer online activity — valued at up to $6 billion by 2000**