```

[Senate Hearing 106-1116]
[From the U.S. Government Publishing Office]

                                                       S. Hrg. 106-1116

                      TO REVIEW THE FEDERAL TRADE 
                COMMISSION'S SURVEY OF PRIVACY POLICIES
                     POSTED BY COMMERCIAL WEB SITES

=======================================================================

                                HEARING

                               before the

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                       ONE HUNDRED SIXTH CONGRESS

                             SECOND SESSION

                               __________

                              MAY 25, 2000

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation

81-862              U.S. GOVERNMENT PRINTING OFFICE
                            WASHINGTON : 2003
____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800  
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001

       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                       ONE HUNDRED SIXTH CONGRESS

                             SECOND SESSION

                     JOHN McCAIN, Arizona, Chairman
TED STEVENS, Alaska                  ERNEST F. HOLLINGS, South Carolina
CONRAD BURNS, Montana                DANIEL K. INOUYE, Hawaii
SLADE GORTON, Washington             JOHN D. ROCKEFELLER IV, West 
TRENT LOTT, Mississippi                  Virginia
KAY BAILEY HUTCHISON, Texas          JOHN F. KERRY, Massachusetts
OLYMPIA J. SNOWE, Maine              JOHN B. BREAUX, Louisiana
JOHN ASHCROFT, Missouri              RICHARD H. BRYAN, Nevada
BILL FRIST, Tennessee                BYRON L. DORGAN, North Dakota
SPENCER ABRAHAM, Michigan            RON WYDEN, Oregon
SAM BROWNBACK, Kansas                MAX CLELAND, Georgia
                  Mark Buse, Republican Staff Director
            Martha P. Allbright, Republican General Counsel
               Kevin D. Kayes, Democratic Staff Director
                  Moses Boyd, Democratic Chief Counsel

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on May 25, 2000.....................................     1
Statement of Senator Ashcroft....................................     8
Statement of Senator Bryan.......................................     7
Statement of Senator Burns.......................................     6
Statement of Senator Cleland.....................................    13
Statement of Senator Gorton......................................    12
Statement of Senator Hollings....................................     2
    Prepared statement...........................................     3
Statement of Senator Kerry.......................................    10
Statement of Senator McCain......................................     1
Statement of Senator Rockefeller.................................    12
Statement of Senator Stevens.....................................     4
Statement of Senator Wyden.......................................     4
    Prepared statement...........................................     5

                               Witnesses

Anthony, Hon. Sheila F., Commissioner, Federal Trade Commission..    23
    Prepared statement...........................................    25
Berman, Jerry, Executive Director, Center for Democracy and 
  Technology.....................................................    68
    Prepared statement...........................................    70
Catlett, Jason, President and Chief Executive Officer, 
  Junkbusters Corporation, and Visiting Scholar, Columbia 
  University Department of Computer Science......................    63
    Prepared statement...........................................    65
Leary, Hon. Thomas B., Commissioner, Federal Trade Commission....    35
    Prepared statement...........................................    36
Lesser, Jill A., Vice President of Domestic Public Policy, 
  America Online, Inc............................................    53
    Prepared statement...........................................    56
Pitofsky, Hon. Robert, Chairman, Federal Trade Commission........    15
    Prepared statement...........................................    17
Swindle, Hon. Orson, Commissioner, Federal Trade Commission......    28
    Prepared statement...........................................    30
Thompson, Hon. Mozelle W., Commissioner, Federal Trade Commission    32
    Prepared statement...........................................    33
Varney, Christine, Senior Partner, Hogan and Hartson, on behalf 
  of the Online Privacy Alliance.................................    60
    Prepared statement...........................................    62
Weitzner, Daniel J., Technology and Society Domain Leader, World 
  Wide Web Consortium............................................    77
    Prepared statement...........................................    79

                                Appendix

Berman, Jerry, Executive Director, Center for Democracy and 
  Technology, letter dated September 8, 2000, to Hon. John McCain    97
Jaffe, Daniel L., Executive Vice President, Association of 
  National Advertisers, Inc., letter dated June 12, 2000, to Hon. 
  John McCain....................................................    98
Response to written questions submitted by Hon. Max Cleland to:
    Jason Catlett................................................    91
    Federal Trade Commission.....................................    93
    Jill A. Lesser...............................................    92
    Orson Swindle................................................    94
Torricelli, Hon. Robert G., U.S. Senator from New Jersey, 
  prepared statement.............................................    99

 
                      TO REVIEW THE FEDERAL TRADE 
                    COMMISSION'S SURVEY OF PRIVACY 
                     POLICIES POSTED BY COMMERCIAL 
                               WEB SITES

                              ----------                              

                         THURSDAY, MAY 25, 2000

                                       U.S. Senate,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 9:30 a.m. in room 
SR-253, Russell Senate Office Building, Hon. John McCain, 
Chairman of the Committee, presiding.

            OPENING STATEMENT OF HON. JOHN McCAIN, 
                   U.S. SENATOR FROM ARIZONA

    The Chairman. Good morning. This morning the Committee will 
examine the recently released FTC report on online privacy. I 
welcome the members of the Commission and all the witnesses we 
will hear from today to the Committee. I also want to thank all 
of you for the hard work and dedication you have brought to 
this difficult issue.
    Every accolade that can be ascribed to the Internet has 
been stated many times over. Needless to say, it continues to 
transform our lives and our economy. While the Internet 
promises great opportunities, it also presents new concerns and 
fears. Chief among those concerns is the ability of the 
Internet to further erode individual privacy.
    Since the beginning of commerce, business has sought to 
learn more about consumers. The ability of the Internet to aid 
business in the collection, storage, and transfer of 
information about consumers, however, is unprecedented.
    While this technology can allow business to better target 
goods and services, it has also increased consumers' fears 
about the collection and use of personally identifiable 
information. The Commission documented many of these concerns 
in its report.
    Last year when the Committee reviewed the FTC's 1999 report 
on privacy, I made clear that my primary concern was to ensure 
that privacy policies were clear and understandable, that 
consumers could use them to guide their decisions, and that 
companies actually followed the policies they posted. Improving 
the depth of privacy policies is the primary factor motivating 
this Committee's interest in this matter.
    This year's report demonstrates that the business community 
has had great success in providing consumers with some form of 
notice of their information practices. However, the report 
makes it equally clear there is much work to be done to improve 
the depth of information practices on the Internet.
    Consumers should not be forced to forego what has been 
described by Justices Brandeis and Warren as the ``sacred 
precincts of private and domestic life'' to enjoy the benefits 
of this new medium. It is clear that businesses should inform 
consumers in a clear and conspicuous manner how they treat 
personal information and give consumers meaningful choices as 
to how that information is used. While we may disagree on the 
manner in which we meet this goal, we all agree that it must be 
done.
    I am hopeful that today's hearing will begin the process of 
developing consensus about the best way to accomplish this goal 
and enable consumers to protect their privacy online. I look 
forward to working with all of you to address this vital issue.
    Welcome, Senator Hollings.

             STATEMENT OF HON. ERNEST F. HOLLINGS, 
                U.S. SENATOR FROM SOUTH CAROLINA

    Senator Hollings. Well, Mr. Chairman, let me thank you for 
this hearing. We have toyed with the problem long enough. It 
worsens every day. Industry agrees that there should be privacy 
protection. They have all enunciated privacy policies, but that 
has added more to the confusion rather than assisted the 
problem because it is written either in legalese or it cannot 
be found or understood.
    We have had the Federal Trade Commission, this 
distinguished group, work on it for at least 5 years. As a 
result of their fine work, incidentally, we passed a bill on 
children's privacy, and that is working. The intellectual 
community is saying that this technology is advancing so 
quickly that you cannot keep up with it; it is silly to try to 
even draw up a statute about it because it will be obsolete by 
the time it is passed.
    That is not what they said when they came to us for 
protection of intellectual property, regarding movies, books, 
and everything else. We passed these other protections, and now 
we have got to do it for the individual. Mind you me, this is 
not a technology or advancement that was invented either by the 
Vice President or by the advertisers. It was started by Senator 
Stevens in the Defense Subcommittee back in the late sixties.
    It has been free. It will stay free. And unless you are 
commercializing privacy, you do not have any worry about any 
statute on privacy. This is for those who are taking individual 
private information and commercializing it. Internet companies 
have agreed that there should be some protection for privacy. 
The question is how to give notice and consent with respect to 
access to what information the companies do have as well as the 
enforcement of the security.
    So what we need to do is look at this issue. Several 
Senators have. I commend my colleagues Senator Wyden and 
Senator Burns. They have sort of led the way. I have consulted 
over the last 3 months now with various Senators and the FTC 
and other entities interested in it, with industry, and with 
the consumer groups. We have a bill on course now with ten co-
sponsors, and I think we have got a pretty good target for a 
good approach, which is very necessary at this particular time.
    Do not let us come here and say that it is going to ruin 
the Internet and no longer is it going to be free. I have heard 
statements recently to that effect. That is outrageous 
nonsense. There is nothing wrong with the Internet. You and I 
cannot stop it. In fact, the President only yesterday said it 
is going to bring democracy to China. So it is a wonderful 
thing.
    I will include my full statement in the record.
    [The prepared statement of Senator Hollings follows:]

            Prepared Statement of Hon. Ernest F. Hollings, 
                    U.S. Senator from South Carolina

    Today the Committee will hear from the Federal Trade Commission, 
the agency with unique expertise on the issue of Internet privacy. 
Having studied privacy online for five years, and having issued three 
consecutive annual reports on privacy policies online, beginning in 
1998, the FTC concluded this week that it is time for legislation to 
protect consumer privacy on the Internet. This recommendation carries 
with it particular credibility in light of the FTC's record of 
extensive analysis on this issue and its two prior recommendations to 
allow self-regulation a chance to work.
    In light of this recommendation, how should we respond? To answer 
that question, I first want to recognize the constructive efforts of 
two of my colleagues on this Committee, Senators Burns and Wyden, who 
attempted the first foray into the complicated issue of Internet 
privacy when they introduced their legislation last year. I look 
forward to working with them as we grapple with this significant 
consumer issue.
    The bill that we introduced Tuesday with ten cosponsors, the 
Consumer Privacy Protection Act, grants consumers, not companies, 
control over their personal information on the Internet. We do that by 
coupling a strong federal standard to protect consumers online with 
preemption of state Internet privacy laws to ensure business certainty. 
Our strong federal standard tracks the time-honored ``fair information 
practices'' of notice, consent, access, security, and enforcement, that 
the FTC recommends we codify, and that we did codify with respect to 
childrens' privacy.
    Specifically, we require companies to do what some like Alta Vista 
are already doing--namely obtain prior consent from consumers before 
collecting and using or disclosing consumers' personal information. At 
the same time, we need federal preemption to give industry the business 
certainty it cannot obtain from a mishmash of inconsistent state 
Internet privacy laws.
    Notwithstanding this sensible approach, industry will claim that we 
should ignore the FTC's findings and give self-regulation more time. I 
say that is like letting the fox guard the henhouse. How can we trust 
companies whose every economic incentive is to collect, compile, 
enhance, target, and disseminate personal information for profit. Given 
these undeniable incentives, it is not surprising that industry argues 
so strenuously against regulating the protection of consumer privacy on 
the Internet.
    What industry forgets is the Internet is not theirs. The truth is, 
Internet owes its existence to federally funded research by the Defense 
Department in the late 1960s. The DOD Advanced Research Project Agency 
(ARPA) developed a radical new type of computer based communications 
system. This system was enhanced and expanded to more users through 
funding via the national science foundation. To put it simply--the 
Internet was created for the public good--to facilitate scientific and 
academic research, to promote our national security, and to aid the 
exchange of ideas and information. The development of the Internet 
represents the single greatest modern example of government support for 
a revolutionary new technology. After its creation in 1969, the 
government sustained it for over two decades and now is subsidizing the 
commercial explosion on the Internet by refraining from imposing tax 
collection duties, and by exempting the Internet from regulations and 
fees that currently are imposed on other telecommunications companies. 
Protecting privacy online will enhance confidence in the medium and 
continue government's important and ongoing role as a promoter of the 
Internet's now exponential development.
    Industry also argues our approach will undermine some business 
models on the Internet that are based on customized advertising 
targeted to individuals whose personal information has been collected. 
But The New York Times reports on May 7, 2000, that targeted 
advertising on the Internet may not be a sustainable business model. 
Most advertisers ``say the response to their ads does not go up enough 
to be worth the extra cost and bother'' of targeting. America Online's 
Robert Pittman appears to agree that targeted advertising is not 
necessary. ``We don't need to track people. If you want to sell cars, 
you talk to people when they are in the car area.'' More to the point--
we do not attempt to prohibit this advertising model on the Internet. 
We simply create a framework that requires that consumers be notified 
and consent to these practices, if businesses choose to collect 
information online.
    One last point. Many of the same companies that oppose privacy 
regulation on the Internet were up here seeking protection for their 
intellectual property on the Internet just three years ago. They 
demanded legislation to protect their books, records, music, and 
software from copyright infringement on the Internet. They insisted 
that such protection could be accomplished notwithstanding the rapidly 
changing technology of the online medium. Now, these same companies 
argue that any government attempt to protect privacy online can't 
possibly comport with the rapidly changing technology in the industry. 
It's funny how, on the one hand, they demand Congress protect their 
intellectual property online and, on the other hand, flatly oppose 
congressional efforts to protect consumers' personal information on the 
Internet.

    The Chairman. Thank you very much, Senator Hollings.
    Senator Stevens.

                STATEMENT OF HON. TED STEVENS, 
                    U.S. SENATOR FROM ALASKA

    Senator Stevens. That one was long enough, Senator. You 
have got me becoming the grandfather. I do not want to get in a 
fight with Al Gore.
    Senator Hollings. Well, we started it in defense.
    Senator Stevens. You are right about that.
    Mr. Chairman, I thank you for holding this hearing. I hope 
we have a series of hearings. I think this is one of the most 
complex issues we will face in regard to the Internet. I was 
privileged to have a discussion with the chairman here this 
past week. I look forward to working on it with all of you.
    But I do have a firm feeling that this is not an issue to 
be hasty about. So I am glad you are holding the hearing and I 
hope we can pursue and understand what we are doing before we 
bring out a bill from this Committee.
    Thank you. By the way, I am pleased to see all the members 
of the Commission here and to see that it was a unanimous 
position taken by the Commission.
    The Chairman. Thank you, sir. I think we may require more 
hearings on this issue. As you say, it is very complex and it 
is changing rather dramatically as we find out with the reports 
that we receive every year from the FTC.
    Senator Wyden.

                 STATEMENT OF HON. RON WYDEN, 
                    U.S. SENATOR FROM OREGON

    Senator Wyden. Thank you, Mr. Chairman. I, too, appreciate 
your scheduling the hearing. At the outset, I want to thank 
Senator Hollings for his kind comments. I think Senator 
Hollings' bill is a very credible and very significant product. 
I want to assure the Senator I am looking forward to working 
closely with him.
    Mr. Chairman and colleagues, Senator Burns and I introduced 
more than a year ago an online privacy bill. At this point, 
when you have been following the issue it probably is a little 
hard to figure out how it can be that the last time the Federal 
Trade Commission surveyed prospects for self-regulation things 
seemed very rosy, and now it appears that prospects are pretty 
dire.
    My sense is that we are going to find that reality is 
probably somewhere in between. The fact is that until this 
week's survey, the Commission has shown extraordinary patience 
and support for industry self-policing. My read of the Federal 
Trade Commission's report is that they are still showing 
support for self-regulation, but I think it is appropriate that 
they are showing a little less patience.
    In my opinion, the privacy situation was never as rosy as 
the headlines that last year's survey had you believe. The 
reality then was that some of the surveyed privacy policies 
were just as flimsy as they are today. Further, there was 
virtually no enforcement, little accountability, and many less-
visited Web sites were ignoring privacy altogether.
    The truth today, I suspect, is that things are not nearly 
as dire as some would have us believe. While the same problems 
exist today that were in place at the time of the previous 
survey, there are important steps indicating progress. The seal 
programs, I think, are getting better at what they do, and it 
does seem that more Web sites are taking privacy more 
seriously.
    But, for more than a year, Senator Burns and I, as I stated 
earlier, have worked on this on a bipartisan basis and have 
said that the costs are just too high to wait and see if self-
regulation alone can tackle the bulk of the online privacy 
problem. None of us, none of us, want to see an Exxon Valdez of 
privacy that undermines the extraordinary growth of e-commerce.
    So the worst thing that we could do now is set back the 
progress of self-regulatory efforts. But what I think makes the 
best sense is to build on those kinds of approaches. That is 
what Senator Burns and Senator Kohl and I have sought to do, to 
reward and build on the self-regulatory efforts while creating 
a baseline set of requirements to ensure that there are 
important consumer protection standards that would apply to 
those who are unwilling to take consumer privacy seriously.
    Mr. Chairman, I would ask that the rest of my statement be 
part of the record. I look forward to hearing from Chairman 
Pitofsky and, again, commend Senator Hollings and Senator 
Rockefeller for what I think is a very important bill that they 
have introduced as well, and I yield back.
    [The prepared statement of Senator Wyden follows:]

     Prepared Statement of Hon. Ron Wyden, U.S. Senator from Oregon

    I'm sure many who have been following the online privacy issue in 
the newspapers are asking themselves how the situation at the time of 
the last FTC survey could be so rosy, and could now be so dire. I would 
counsel them that the truth, as usual, probably lies somewhere in-
between.
    The fact is that until this week's survey, the Commission showed 
extraordinary patience and support for industry's effort at self-
policing. And by my reading of the report, they are still showing 
support for self-regulation: just a little less patience.
    Frankly, the privacy situation was never as rosy as the headlines 
from last year's survey would have had you believe. The reality was 
that some of the surveyed privacy policies were just as flimsy then as 
they are today. Further, there was virtually no enforcement, little 
accountability, and many less-visited Web sites were ignoring privacy 
altogether.
    And the reality now, I suspect, is that things aren't nearly as 
dire as some would have us believe. While the same problems exist today 
as were in existence at the time of the previous survey, the seal 
programs are clearly maturing and getting better at what they do, and 
more Web sites are taking privacy seriously than ever before.
    For over a year, however, I have been saying that the costs are 
simply too high to wait and see if self-regulation, alone, tackles the 
bulk of the online privacy problem. I am pleased that the Commission 
now agrees with Chairman Burns and myself on this point. We also 
agree--and look forward to their amplification of this point--that the 
worst thing we could do now is set back the progress of the self-
regulatory efforts.
    Chairman Burns, Senator Kohl, and I have legislation that is 
founded on the idea of rewarding and building on the industry's self-
regulatory efforts, while creating a baseline of behavior for those who 
are unwilling to take consumer privacy seriously. We believe that if 
some regulation is necessary, the lightest practicable regulatory touch 
should be used to protect consumers. Sensible regulation need not, and 
should not, stifle private sector innovation.
    Several other members now have introduced online privacy bills, or 
have bills in the works. Senator Hollings has a new privacy bill with 
Senator Rockefeller and others, and it strikes me as a very credible 
and significant effort. Their bill raises a number of important issues, 
such as consumer choice with regard to personally-identifiable 
information, and I look forward to the Committee reviewing both bills, 
and others, as the debate moves forward.
    I'll let the Commission speak for itself, but I think it's clear 
from the report that the Commission isn't here today to bury self-
regulation, but to praise it. I sure hope that's the case. I look 
forward to hearing from Chairmen Pitofsky and the rest of the 
Commission, and thank the Chairman for holding this timely and 
important hearing.

    The Chairman. Senator Burns.

                STATEMENT OF HON. CONRAD BURNS, 
                   U.S. SENATOR FROM MONTANA

    Senator Burns. Thank you, Mr. Chairman, and thank you for 
holding this hearing today, as this continues to be a great 
center of interest when we start talking about the Internet and 
related items around it.
    I think we are charged with issues like this today. If the 
Internet and electronic commerce continue to grow, we have to 
do something about safety and security and privacy and these 
types of things for it to reach its real potential. We have 
been amazed at the continuing spectacular growth of the 
Internet, which has become a staple in modern life, it seems. 
The tremendous reach of the Internet does pose challenges as 
well as opportunities.
    Unfortunately, digital technology can be used by bad actors 
to collect nearly limitless information on individuals without 
their knowledge. I am convinced that legislation is necessary 
to provide consumers with a safety net of privacy in the online 
world. As I stated in the hearing on privacy held in the 
Communications Subcommittee last summer, I am very 
disappointed--I was very disappointed--in the Federal Trade 
Commission's report on online privacy last year. The July 1999 
report acknowledged that fewer than 10 percent of the Web sites 
met the basic privacy protections, yet called for no Federal 
legislation to address this critical situation.
    However, at that time I was encouraged by the chairman's 
pledge that if the industry failed to produce strong progress 
the Commission would call for action in this area. The chairman 
and the Commission have been true to their word in the report 
issued to Congress just this last Monday, which called for 
legislation.
    I want to take a moment to specifically commend the work 
and the insight of Commissioner Anthony on these privacy 
matters. In retrospect, her dissenting opinion in last year's 
report has proved to be absolutely correct. Last year she 
stated that the legislation was necessary to ensure a minimum 
consumer privacy protection in the digital area. In her 
statement she expressed concern that the absence of effective 
privacy protection would undermine consumer confidence and 
hinder the advancement of electronic commerce.
    That is exactly what has happened in this past year. While 
e-commerce has continued to grow, several studies point out 
that the primary reason that is preventing more people from 
making purchases online and doing more business online is the 
lack of privacy. While the Internet has continued to exhibit 
massive growth, less than 1 percent of all consumer retail 
spending is done online. In short, e-commerce still has a huge 
up side potential, but the potential will never be fulfilled 
without basic assurance of consumer privacy.
    I am going to submit the rest of my statement, but I want 
to thank Senator Wyden and his hard work on our legislation. It 
continues to be massaged and to be made better.
    I also welcome the introduction of Senator Hollings' piece 
of legislation and look forward in working with Senator 
Hollings, because we can find and take care of this problem, 
because it has to be done in a bipartisan way and it is not a 
partisan situation where we start talking about these building 
blocks of the future e-commerce of this country. So we welcome 
all of these ideas, and I am sure that we will come up with a 
bill that we can all support. So I appreciate that very much.
    I would ask unanimous consent that the rest of my statement 
be put in the record.*
---------------------------------------------------------------------------
    * The information referred to was not available at the time this 
hearing went to press.
---------------------------------------------------------------------------
    The Chairman. Without objection.
    Senator Hollings. Who is next? Senator Bryan.

              STATEMENT OF HON. RICHARD H. BRYAN, 
                    U.S. SENATOR FROM NEVADA

    Senator Bryan. Thank you very much.
    First, I would like to preface my comments by thanking 
Chairman McCain for calling today's hearing on this important 
issue of Internet privacy. Second, I would like to commend the 
FTC for all the work that it has done over the past 5 years in 
the area of online privacy. Each of the FTC's three reports to 
Congress detailing online privacy practices and the numerous 
workshops and hearings they have held on this issue have 
contributed greatly to the ongoing dialog about the best way to 
protect the privacy of consumers on the Internet.
    The protection of privacy is a core value of our democratic 
society. Although not mentioned explicitly in the Constitution, 
the Supreme Court has recognized that a fundamental right to 
privacy is embodied in both the Fourth and the Fourteenth 
Amendments to the Constitution. The right to privacy recognized 
by the court is a reflection of our citizenry's long-held 
expectation that they should be able to engage in a range of 
day to day activities with a significant degree of autonomy and 
confidentiality.
    The Internet presents new challenges as well as new 
opportunities for the protection of privacy. The sheer volume 
of personal information that is exchanged on a daily basis 
between individuals and businesses on the Internet, coupled 
with the ability of other entities to track the flow of this 
information with relative ease, poses serious privacy concerns 
for many customers.
    A recent survey showed that 92 percent of consumers are 
concerned about the misuse of their personal information 
online. Conversely, the architecture of the Internet provides 
an opportunity for technology to enhance online privacy. Many 
innovative companies are focusing more and more resources on 
the development of privacy-enhancing tools that will enable 
consumers to have more control over the use of their personal 
information.
    I agree with the recommendation of the majority of the 
Commission that the time has come for the Congress to establish 
a baseline standard for the protection of consumer privacy on 
the Internet. Earlier this week, I was pleased to join the 
distinguished Ranking Member of this Committee, Senator 
Hollings, in introducing consumer privacy legislation that 
largely tracks the recommendations of the majority FTC report. 
This legislation builds upon the framework of legislation that 
was established in legislation that I offered in the children's 
online privacy protection, which just took effect last month. 
It embodies the four widely accepted fair information 
practices: notice, choice, access, and security for the 
collection of personally identifiable information about 
consumers online.
    The Commission's report does indicate that the industry has 
made progress with self-regulatory initiatives. But in spite of 
this progress, however, I remain concerned about the 
effectiveness of online privacy seal programs, especially in 
the area of enforcement. I agree with the Commission that 
legislation is necessary to complement the industry's self-
regulatory efforts in order to enhance adequate protection of 
consumer privacy.
    I fully understand the industry's concerns with the 
regulatory approach to protecting privacy on the Internet. But 
I am hopeful, however, that they will come to view this effort 
as an opportunity to enhance consumer confidence in e-commerce, 
much like what occurred in the offline world with the credit 
card industry in the 1970's. I look forward to working with the 
industry, much as I did during the Committee's consideration of 
the Children's Online Privacy Protection Act, to enact a 
responsible piece of legislation that adequately protects 
consumer privacy online in a manner that does not unduly burden 
the growing importance of e-commerce in the marketplace.
    Senator Stevens [presiding]. Senator Ashcroft.

               STATEMENT OF HON. JOHN ASHCROFT, 
                   U.S. SENATOR FROM MISSOURI

    Senator Ashcroft. Thank you very much. Thank you very much, 
Mr. Chairman. Thank you for holding today's hearing.
    I do not see this hearing as merely discussing a report 
from a Federal agency to Congress. I think this hearing will 
help us determine whether the Federal Government should develop 
a significant and sweeping regulatory scheme. We are here to 
understand whether the growth of a flourishing high-tech 
industry would be hindered by such an involvement. We must 
discuss this issue in terms of whether or not the American 
people will be well served by significant government 
involvement in this dynamic industry.
    We should ask ourselves whether it will continue to grow or 
will it continue to provide jobs, new opportunity, and 
education and research. We should ask whether the involvement 
of government bureaucrats will dramatically diminish the new 
efficiencies gained by conducting business on the Internet.
    All of us are concerned about consumer privacy. I am 
concerned that consumers who want privacy should have privacy. 
In fact, Congress recently has recognized through statutes 
which apply to every segment of the economy that sensitive 
consumer information, such as financial and medical records, 
should be treated with extra care. I would point out that those 
regulations apply to everyone, not just companies who conduct 
business in the traditional brick and mortar sense. But the 
privacy laws which we now have in place already apply to 
companies doing business on the Internet.
    However, through the fear-mongering from Washington, in 
some situations consumers have been led to believe that there 
are no protections in place on the Internet, and that is simply 
not true. Not only do our new privacy laws apply to Internet 
transactions, so do our consumer protection laws. In fact, we 
have heard glowing testimony before this Committee about the 
work of the FTC, about the work that the FTC has done to fight 
consumer fraud on the Internet. The Internet has even been 
credited with giving the FTC new and powerful tools to fight 
such fraud.
    A few months ago the FTC Commissioners sat before this 
Committee to discuss this very issue, and at that time I was 
concerned that the latest Internet sweep was predestined to 
reach the conclusion contained in the Commission's report, that 
is that there need to be special regulations that apply to the 
Internet that do not apply to other collections of data, do not 
apply to other businesses, and do not apply to the other 
utilizations of data in our culture.
    For example, when people promote through the distribution 
of coupons refund opportunities for individuals who buy 
products, people mail in those refund opportunities. There are 
not special laws that relate to what they can do with that 
information or how it can be used. It is not on the Internet, 
but it is the collection of consumer data and it is distributed 
widely.
    Many people like the opportunity to participate in refund 
schemes and are willing to trade the value of the refund for 
the utilization of that information, which is consumer data, by 
businesses. It is a big part of the way we do business in this 
country. In our household, my wife scarcely lets a refund offer 
go by without collecting the labels necessary to cash in. As a 
matter of fact, she keeps a file of labels so that when the 
offer comes out she does not have to go buy additional 
products; she already has the labels ready to mail them in.
    Now, I would just point out that I think we have got to be 
careful that we do not impose on the Internet unnecessary 
regulation that is differential, specially designed, and would 
curtail and confine the Internet from operating in ways that we 
do not ask for responsibility or we do not ask for regulation 
on the rest of commerce.
    Further, I think we ought to make sure that when we are 
talking about choice we allow people the choice of saying that 
they want to receive data based on the kinds of practices they 
have and they are interested, for instance, in getting offers 
from companies and the like based on the kinds of interest they 
have expressed in purchasing patterns, whether it be through 
refund coupons or other devices.
    Although regulating the Internet was the recommendation 
following the sweep by the Commission, I am a little confused 
about how the numbers really move us toward that result. Two 
years ago a sweep showed that 14 percent of Web sites had 
privacy policies. Today 90 percent posted policies. That really 
says that, in an industry that showed a 543 percent improvement 
in 2 years, that it was deemed to be failing in self-
regulation.
    So in the interest of time and because the witnesses will 
address this issue, I will not mention all of the significant 
work done by industry to improve privacy and security on the 
net. I just want to say that I hope that we do not single out 
the Internet for a kind of regulation which would stifle it, 
which would limit the kinds of choices consumers have, and make 
the Internet a place where it would be difficult to grow 
business in the same way that it might be available for growth 
in other settings.
    With that note, I want to indicate again how I respect 
privacy and want to be able to protect privacy, but I do not 
have a clear picture of how I want to inhibit information on 
the Internet that is not inhibited in other sectors of our 
economy.
    Thank you.
    Senator Stevens. Senator Kerry.

               STATEMENT OF HON. JOHN F. KERRY, 
                U.S. SENATOR FROM MASSACHUSETTS

    Senator Kerry. Mr. Chairman, thank you very much.
    I am delighted that Senator McCain has called this hearing. 
I think there is going to be a unanimity among most of us on 
the Committee, as there is probably among most Americans, that 
they want their privacy protected. I applaud the FTC and the 
analysis that they have put into this, and I particularly 
respect the effort of Senator Hollings and colleagues on the 
Committee who drafted some legislation and who have moved in 
that direction.
    But I differ a little bit with some of them with respect to 
the degree to which at this stage, at a 5- or 6-year point in 
terms of the development of the net, that Congress has the 
ability to move adroitly enough, fast enough, with sufficient 
analysis and information, to be able to properly regulate 
something that is developing even as we sit here so rapidly, 
with so many technological advances that have the ability to 
answer some of our questions without our constricting the 
creativity and the efforts that are going into this.
    It seems to me that there are certain principles we could 
adopt, for instance anonymity. What I hear from people in the 
industry is that the technology is moving fast enough that 
there are ways that the offerings of the marketplace are going 
to make it very clear to people that they can use one service 
or another that protects their privacy and protects their 
options, without our setting up a rigid, strict structure, at 
least at this point.
    I think the FTC sort of adopted this up until this sudden 
point, and one of the questions today obviously is why there is 
the moment of departure. Maybe they do not think things have 
moved fast enough, obviously. But initially self-regulation was 
certainly their guiding theory, and this is the first moment of 
departure from that.
    The opt-in requirement on the whole, while obviously I 
favor opt-in as a principle and I think most Americans are 
going to want that kind of choice and demand it in the 
marketplace, but in point of fact to mandate that actually sets 
a standard that in some cases in terms of marketplace behavior 
is neither necessary nor technologically sound. There are 
certain instances where certain kinds of marketing can take 
place that do no harm to people, they may choose to participate 
in it; you do not require that kind of burden.
    I think the Committee is very much behind the curve, the 
country is behind the curve, in analyzing the degree to which 
we are drawing distinctions for the online world that we do not 
draw in the offline world. When you go to a local store here, 
let us say you go in Georgetown, you visit some store and buy a 
bunch of goods and you swish your card through the thing when 
you leave, that entity could determine everything you bought. 
They can market accordingly.
    I mean, I must get 40 or 50 magazines every 3 weeks that 
are targeted based on my offline behavior. Yet we are about to 
require language restrictions that have no relationship to what 
is happening in the offline world, and I do not think we have 
thought that through adequately.
    So I think there is a lot more analysis that needs to be 
done, and I am going to introduce legislation that I think will 
kind of balance these interests, where we can establish what we 
think are the goals and principles by which this ought to be in 
its earliest stages developed. There ought to be maximum amount 
of opt-in, there ought to be anonymity. Clearly, in the 
marketing you do not have to know that it is John Smith at 
Myrtle Street. You have to know that X number of goods are 
being bought in a certain area by certain demographics. But 
there are ways to protect the privacy without our becoming, I 
think, extraordinarily mandating at the federal level.
    I might add to that that it seems to me there are very 
significant realities of the marketplace, that Americans are 
going to opt for those entities that most protect them if that 
is what indeed they want. And if they do not want it, they can 
also have the opportunity to make that kind of conscious 
choice.
    There is clearly a difference between what happens in opt-
in and opt-out. We all know it. I will wrap it up very quickly. 
We fought that out on the Banking Committee last year and in 
the Financial Modernization Act. It seems to me that also we 
have not really balanced some of those kinds of equities in how 
the market works.
    In my judgment, Mr. Chairman, I think we have to be very, 
very careful on this Committee and in the Congress not to move 
fast. I think there are ways to protect Americans, to protect 
our interests, protect our prerogatives to come back, protect 
the capacity of the FTC to, in fact, regulate and enforce and, 
if we were to set adequate standards and goals, the FTC would, 
in fact, be leveraged in its capacity to enforce, particularly 
if each company adopts its own privacy regime.
    So I hope we are going to measure this carefully and not 
move overly rapidly, and I hope the Committee can find a 
consensus on this with some careful deliberation. Thank you, 
Mr. Chairman.
    Senator Stevens. Senator Gorton.

                STATEMENT OF HON. SLADE GORTON, 
                  U.S. SENATOR FROM WASHINGTON

    Senator Gorton. I will pass.
    Senator Stevens. Thank you.
    Senator Rockefeller.

           STATEMENT OF HON. JOHN D. ROCKEFELLER IV, 
                U.S. SENATOR FROM WEST VIRGINIA

    Senator Rockefeller. Thank you, Mr. Chairman.
    I do not think the problem is whether we move slowly or 
quickly. This Committee has a history of not reacting at all on 
issues that we do not understand and, therefore, we have got to 
give ourselves ample time.
    Well, there is no such thing as ample time in the world of 
the net. There is no such thing as ample time if I have 
diabetes, for example, and that is my own private information 
and that gets out and it is sold to a third party, and there 
are not controls, and I cannot get a job. That example is used 
often.
    This is a different world. To compare, as the Senator from 
Missouri did, this--``Missoura''--this medium that we are 
talking about to sort of other things and what transactions he 
and his wife might make at home, is behind the curve. This is a 
new world.
    There has been a 548 percent increase in online disclosure 
and privacy policies. Of course that is exactly what the FTC 
looked at, and it is the quality of what the privacy policies 
say. Can you find them? Can you read them? Is the print big 
enough, and is it written in words that only those who are 
lawyers can understand? The American consumer is not always the 
most sophisticated, and the American consumer when on the net 
or on a Web site is almost always in a hurry and does not take 
the time. It is simply understanding human nature in a medium 
which is changing and then rechanging every 6 to 8 months.
    So this is not a question of should we wait and make sure 
that we do absolutely the most perfect thing. There are 
hundreds of thousands or millions of people whose lives are 
going to be intervened with in ways that are dramatic and 
dangerous if this Committee does not pass a bill which supports 
what the FTC basically says. That is, that the work is not 
being done sufficiently.
    I would remind the Senators from Massachusetts and Missouri 
that we heard all these same arguments back in the 1970's when 
the credit cards started up. The credit card industry was all 
over everybody saying that you cannot regulate us. And it was 
only, in fact, when we did put regulations on the credit card 
industry that the 90 percent of American consumers who at that 
time perhaps were not using credit cards or who are not at this 
point on Web sites or using the Internet the way they might 
gained confidence in precisely the industry that had just gone 
through some form of regulation.
    It was the regulation and thus the privacy and the access 
and the security that in fact helped the industry to attract 
users. So it is a cliche to say, but it is through judicious 
and cautious regulation not irrational exuberance that will 
help protect Americans and which will also help the industry 
grow.
    We will make a mistake here if we apply traditional values 
to our legislative course.
    Senator Stevens. Thank you.
    Senator Cleland, do you have an opening statement?

                STATEMENT OF HON. MAX CLELAND, 
                   U.S. SENATOR FROM GEORGIA

    Senator Cleland. Yes, sir, I do. Thank you very much, Mr. 
Chairman.
    More and more as a Member of this Committee, I feel like I 
am in a cul de sac on the information highway. I am still 
struggling, trying to find out what it is all about. I was 
thinking this morning of how to equate what we are facing now 
with what I understood. I am from a small town, and it was not 
that many years ago in my little town that there were only four 
numbers involved with a telephone. And it was a totally public 
line. It was a party line, it used to be called, and basically 
everybody else knew each other's business. My State director, 
who is only 5 years older than I am, remembers when he would go 
home from school in the afternoon, pick up the phone, call the 
switchboard operator and say: Where is my mother? And she would 
say: Over at Gracie's.
    I wonder if here in the early days of the Internet that 
everybody that is online is actually on a party line and does 
not know it.
    The information superhighway began just a few short years 
ago as a footpath and now it is an unlimited expressway. People 
can now use the Internet to shop at virtual stores located 
thousands of miles away, find turn-by-turn directions to far 
away destinations, and journey to hamlets, cities, and states 
across the country.
    While the virtual world is available to us with just a few 
keystrokes and mouse clicks, there is one area of the Internet 
that many are finding troublesome. It is the collection and use 
of personal data. All too often, web surfers are providing 
personal information about themselves without their knowledge 
and consent. It is a party line, except people do not know they 
are on a party line.
    There is so much information being collected on people 
visiting Web sites today that it would take several buildings 
the size of the Library of Congress to store it all. That is a 
lot of information, much of which is very personal, and I 
believe it must be kept that way.
    My concern about privacy on the Internet is that this issue 
is keeping people from fully enjoying the marvelous technology 
available to them. According to a recent survey by the Center 
for Democracy and Technology, consumers are fearful of the sale 
of their personal information to others and Web sites tracking 
people's use of the web. I think the term ``cookies'' is a 
fascinating term. I love cookies, but not this way.
    This survey seems to be pointing to the same argument that 
was made when credit cards were first introduced to the 
American public. At that time credit cards did not initially 
enjoy widespread usage because of the potential misuse by 
others, but it was only after regulatory intervention to 
protect consumers that this fear was somewhat dispelled. We 
should learn this lesson from the Internet and the challenges 
that it is experiencing over privacy concerns.
    These concerns are translating into lost opportunities for 
consumers and businesses. Now, most of the dot-com companies 
doing business over the Internet today are very cognizant of 
the fact that privacy is a major concern. However, in a report 
you just released, you found that 92 percent of the Web sites 
that you surveyed were collecting great amounts of personal 
information from consumers and only 14 percent disclosed 
anything about how the information would be used.
    Interestingly enough, the report, your report, found that a 
mere 41 percent, less than half, of the randomly selected Web 
sites notified the visitor of their information practices and 
offered the visitor choices on how their personal information 
would be used. Now, this report seems to suggest to me that 
industry efforts by themselves are, indeed, not sufficient to 
control the gathering and dissemination of personal data.
    At one Web site visit, a company can collect some very 
interesting facts about the person who is on the other end 
without them knowing it. While surfing the web the other day, I 
hit on a Web site that provided me with the insight into just 
how much information can be collected. In less than a minute, 
the site reported what other sites I had visited, what sites I 
would likely visit in the future, what plug-ins are installed 
on my PC, how my domain is configured, and a lot more 
information that I did not really understand.
    Many consider this type of tracking akin to stalking. I 
believe that the information that can be collected by Web site 
administrators can create problems for people through a 
violation of trust and invasion of privacy. I would say, as an 
old Army signal officer, I know that you cannot communicate 
important data unless you have a feeling that it is secure. 
Novice Internet users generally are unaware, as I was until 
visiting this site, of the extent of information being 
collected on them. Even those who are aware of the capabilities 
of firms to collect private data are frightened by what can 
happen.
    I believe in increasing the level of protection for private 
information to a level that the people of our nation and the 
dot-coms can live with, and I believe in providing assurances 
to those who are providing information that their privacy 
rights will be protected. It seems reasonable to me that firms 
that are collecting private data should notify consumers of the 
firm's information practices, offer the consumer choices on how 
the personal information will be used, allow consumers to 
access the information that is collected on them, and require 
those firms to take reasonable steps to protect the security of 
that information.
    However, I am looking forward to learning more about the 
Internet privacy issue this morning and hearing from experts 
like these wonderful people at the table, Mr. Chairman, and the 
rest of our distinguished testifiers.
    Thank you very much.
    The Chairman [presiding]. Chairman Pitofsky, welcome. I am 
sorry for the delay. I apologize to all the Commissioners. 
Chairman Pitofsky.

              STATEMENT OF HON. ROBERT PITOFSKY, 
               CHAIRMAN, FEDERAL TRADE COMMISSION

    Mr. Pitofsky. Thank you, Mr. Chairman, Senator Hollings, 
members of the Committee. I welcome this opportunity to once 
again appear before this Committee to discuss this important 
subject, especially because this Committee has supported so 
consistently and so well our efforts to deal with the kinds of 
problems we will discuss today.
    As you know, the Commission has been active in the area of 
protecting consumers on the Internet since 1995. To a large 
extent we have dealt with fraud on the Internet, but we have 
also addressed questions of privacy.
    We all know that the Internet commerce sector of the 
economy is growing at an amazing pace. But we also know that 
many people, some surveys say over 90 percent, are apprehensive 
about the way their private information is being used, 
including people who go ahead and buy things on the Internet.
    Most observers believe that consumer protection would 
require four fair information practices. Incidentally, the 
business community in their seal programs and elsewhere have 
also indicated that these are the four bases that need to be 
touched.
    First, notice: What information is being collected and what 
are the collectors doing with it? Consumers ought to know that.
    Choice, the opportunity of consumers to say that we do not 
want this information used for any purpose other than 
completion of the transaction.
    Most people also think that there ought to be some access, 
so if sensitive information is involved in the data base and it 
is wrong, there is an opportunity to correct it, so that 
consumers are not injured by errors.
    The fourth practice involves an obligation to keep the 
information firms collect secure.
    The debate really concerns whether these rights can be 
achieved through legislation or through growing efforts of 
responsible companies in the field to engage in self-
regulation. My own view is that neither legislation alone nor 
self-regulation alone is the right answer, but it ought to be 
some combination of the two.
    I applaud the progress that has been made in self-
regulation in recent years. On the matter of notice, we have 
gone from 14 percent notice on all Web sites to 88 percent 
notice on all Web sites in a little over two years. The 
question has been raised: If that is the case, why has a 
majority of the Commission changed its view about the adequacy 
of self-regulation? I would make a number of points.
    First of all, the 88 percent figure is a little misleading. 
It includes ``notice'' that says in effect, ``we protect your 
privacy,'' or it could include notice that says, ``we do not 
protect your privacy.'' The fact of the matter is if you ask 
the questions, ``how many of these notices actually tell 
consumers what information is collected and how it is used?'' 
then the figure falls down to about 55 percent for all sites, 
89 percent for the most visited sites.
    If you ask the questions, ``what about all four information 
practices? Are they being adequately addressed through self-
regulation?,'' it turns out only 20 percent of firms on the 
Internet, one in five, have adopted all four fair information 
practices.
    Some have said, ``Well, but access and security are 
difficult to understand, the industry is slow to move in those 
two areas.'' All right, let us leave out access and security 
and ask only about notice and consent. There, on all Web sites, 
we find only 41 percent have notice and consent, 60 percent of 
the most traveled sites.
    Finally, the whole notion of self-regulation requires that 
companies be part of seal programs and if they do not abide by 
self-regulatory standards, the seal will be taken away. Well, 
we find in that area, even though these seal programs have been 
working for over a year and a half, almost 2 years, 8 percent 
of Web sites are members of seal programs. That does not seem 
adequate.
    What is to be done? First let me say again that self-
regulation has achieved a good deal and has an important role 
to play in the future. I have always been a strong advocate of 
self-regulation. It works in many sectors of the economy. But I 
tell you on the basis of my experience that the most effective 
self-regulatory programs are those that have a rule of law to 
back them up, so that the self-regulators can then say to the 
irresponsible few who do not go along with the standards that 
their behavior will be referred to a law enforcement agency.
    The idea that the self-regulators can go to the less 
responsible few and say, if you continue to collect and sell 
this information without permission at a profit to third 
parties we are going to take your seal of approval away from 
you, just does not get the job done. It helps, but it is not in 
my opinion adequate.
    Second, I do believe that Congress must be cautious in this 
area and not impose on this growing and wonderful pro-consumer 
marketplace burdens that will hamper the development of the 
marketplace.
    Third, as our report tries to emphasize, there are many 
complicated questions that arise here: What is adequate notice? 
How much access is required? What do we mean by ``security''? 
Therefore, I applaud those who say that we should be careful; 
we should get it right rather than rush to any judgment in this 
area.
    Any legislation should be sufficiently flexible so that if 
there are technological solutions--and we hear about them all 
the time--if they really develop then they should be 
incorporated and they should be allowed to protect consumers 
rather than direct government regulation.
    Finally, an issue that has been raised by several: Why are 
we emphasizing consumer protection online and not offline? 
First of all, it is possible to manipulate data online in a 
very special way. But more important than that, in our report 
we address the question of online privacy. We have not examined 
the question of offline privacy. Slowly, I have come around to 
the view, as we have moved through this area, that the argument 
that offline and online should be treated in a radically 
different way just does not hold up and we should be addressing 
whether or not consumers offline, deserve protection as well.
    Let me conclude my remarks with a reference to some basic 
principles. Millions of people now enthusiastically shop online 
and they have no problem at all supplying personally 
identifiable information--names, addresses, credit card numbers 
if necessary, even social security numbers--if necessary to 
complete the transaction. But many sellers on the Internet are 
not just in the business of selling a product or selling a 
service, but rather they are in the business of accumulating 
data--the books we read, the music we hear, the pharmaceuticals 
and cosmetics we buy, our travel and vacation plans, the 
information we research, on and on and on. And that is often 
sold at a profit to third parties with whom we have no direct 
connection whatsoever. We do not even know who they are or what 
they are doing with that information.
    Many people do not object to that either, as long as they 
have an opportunity to say to the online seller: ``If that is 
what you are going to do with the data, just leave me out; I 
visited your Web site to buy a product, not to provide 
information about my life, my family, my habits, or my economic 
class.''
    I think that is the goal that virtually all of us share. We 
must make sure that that option is available to consumers on 
the Internet. They should not be required to forfeit their 
privacy online in exchange for the rich benefits of electronic 
commerce. Careful, non-burdensome legislation, backed up by 
effective self-regulation, and the legislation would set 
minimum standards, seems to me at this point the right way to 
go.
    Thank you very much.
    [The prepared statement of Chairman Pitofsky follows:]

         Prepared Statement of Hon. Robert Pitofsky, Chairman, 
                        Federal Trade Commission

    Mr. Chairman, I am Robert Pitofsky, Chairman of the Federal Trade 
Commission. I appreciate this opportunity to present the Commission's 
views on the privacy issues raised by the collection and use of 
consumers' personal information by commercial sites on the World Wide 
Web.\1\
---------------------------------------------------------------------------
    \1\ The Commission vote to issue this testimony was 5-0. 
Commissioners Anthony, Thompson, Swindle, and Leary have issued 
separate statements, which are attached.
    My oral testimony and any responses to questions you may have 
reflect my own views and are not necessarily the views of the 
Commission or any other Commissioner.
---------------------------------------------------------------------------
I. Introduction and Background

A. FTC Law Enforcement Authority
    The FTC's mission is to promote the efficient functioning of the 
marketplace by protecting consumers from unfair or deceptive acts or 
practices and to increase consumer choice by promoting vigorous 
competition. As you know, the Commission's responsibilities are far-
reaching. The Commission's primary legislative mandate is to enforce 
the Federal Trade Commission Act (``FTCA''), which prohibits unfair 
methods of competition and unfair or deceptive acts or practices in or 
affecting commerce.\2\ With the exception of certain industries and 
activities, the FTCA provides the Commission with broad investigative 
and law enforcement authority over entities engaged in or whose 
business affects commerce.\3\ Commerce on the Internet falls within the 
scope of this statutory mandate.
---------------------------------------------------------------------------
    \2\ 15 U.S.C. Sec. 45(a).
    \3\ The Commission also has responsibility under 45 additional 
statutes governing specific industries and practices. These include, 
for example, the Truth in Lending Act, 15 U.S.C. Sec. Sec. 1601 et 
seq., which mandates disclosures of credit terms, and the Fair Credit 
Billing Act, 15 U.S.C. Sec. Sec. 1666 et seq., which provides for the 
correction of billing errors on credit accounts. The Commission also 
enforces over 30 rules governing specific industries and practices, 
e.g., the Used Car Rule, 16 C.F.R. Part 455, which requires used car 
dealers to disclose warranty terms via a window sticker; the Franchise 
Rule, 16 C.F.R. Part 436, which requires the provision of information 
to prospective franchisees; the Telemarketing Sales Rule, 16 C.F.R. 
Part 310, which defines and prohibits deceptive telemarketing practices 
and other abusive telemarketing practices; and the Children's Online 
Privacy Protection Rule, 16 C.F.R. Part 312.
    In addition, on May 12, 2000, the Commission issued a final rule 
implementing the privacy provisions of the Gramm-Leach-Bliley Act, 15 
U.S.C. Sec. Sec. 6801 et seq. The rule requires a wide range of 
financial institutions to provide notice to their customers about their 
privacy policies and practices. The rule also describes the conditions 
under which those financial institutions may disclose personal 
financial information about consumers to nonaffiliated third parties, 
and provides a method by which consumers can prevent financial 
institutions from sharing their personal financial information with 
nonaffiliated third parties by opting out of that disclosure, subject 
to certain exceptions. The rule is available on the Commission's Web 
site at /www.ftc.gov/os/2000/05/index.htm#12>. See Privacy of 
Consumer Financial Information, to be codified at 16 C.F.R. pt. 313.
    The Commission does not, however, have criminal law enforcement 
authority. Further, under the FTCA, certain entities, such as banks, 
savings and loan associations, and common carriers, as well as the 
business of insurance, are wholly or partially exempt from Commission 
jurisdiction. See Section 5(a)(2) and (6)a of the FTC Act, 15 U.S.C. 
Sec. 45(a)(2) and 46(a). See also The McCarran-Ferguson Act, 15 U.S.C. 
Sec. 1012(b).
---------------------------------------------------------------------------
B. Privacy Concerns in the Online Marketplace
    Since its inception in the mid-1990's, the online consumer 
marketplace has grown at an exponential rate. Recent figures suggest 
that as many as 90 million Americans now use the Internet on a regular 
basis.\4\ Of these, 69%, or over 60 million people, shopped online in 
the third quarter of 1999.\5\ In addition, the Census Bureau estimates 
that retail e-commerce reached $5.3 billion for the fourth quarter of 
1999.\6\
---------------------------------------------------------------------------
    \4\ The Intelliquest Technology Panel, Panel News, available at 
/www.techpanel.com/news/index.asp> [hereinafter ``Technology 
Panel''] (90 million adult online users as of third-quarter 1999). 
Other sources place the number in the 70-75 million user range. See 
Cyber Dialogue, Internet Users, available at /
www.cyberdialogue.com/resource/data/ic/index.html> (69 million users); 
Cyberstats, Internet Access and Usage, Percent of Adults 18+, available 
at /www.mediamark.com/cfdocs/MRI/cs_f99a.cfm> (75 million 
users).
    \5\ Technology Panel. This represents an increase of over 15 
million online shoppers in one year. See id.
    \6\ United States Department of Commerce News, Retail E-commerce 
Sales for the Fourth Quarter 1999 Reach $5.3 Billion, Census Bureau 
Reports (Mar. 2, 2000), available at /www.census.gov/mrts/www/
current.html>.
---------------------------------------------------------------------------
    At the same time, technology has enhanced the capacity of online 
companies to collect, store, transfer, and analyze vast amounts of data 
from and about the consumers who visit their Web sites. This increase 
in the collection and use of data, along with the myriad subsequent 
uses of this information that interactive technology makes possible, 
has raised public awareness and consumer concerns about online privacy. 
Recent survey data demonstrate that 92% of consumers are concerned (67% 
are ``very concerned'') about the misuse of their personal information 
online.\7\ The level of consumer unease is also indicated by a recent 
study in which 92% of respondents from online households stated that 
they do not trust online companies to keep their personal information 
confidential.\8\ To ensure consumer confidence in this new marketplace 
and its continued growth, consumer concerns about privacy must be 
addressed.\9\
---------------------------------------------------------------------------
    \7\ Alan F. Westin, Personalized Marketing and Privacy on the Net: 
What Consumers Want, Privacy and American Business at 11 (Nov. 1999) 
[hereinafter ``Westin/PAB 1999'']. See also IBM Multi-National Consumer 
Privacy Survey at 72 (Oct. 1999), prepared by Louis Harris & Associates 
Inc. [hereinafter ``IBM Privacy Survey''] (72% of Internet users very 
concerned and 20% somewhat concerned about threats to personal privacy 
when using the Internet); Forrester Research, Inc., Online Consumers 
Fearful of Privacy Violations (Oct. 1999), available at /
www.forrester.com/ER/Press/Release/0,1769,177,FF.html> (two-thirds of 
American and Canadian online shoppers feel insecure about exchanging 
personal information over the Internet).
    \8\ Survey Shows Few Trust Promises on Online Privacy, Apr. 17, 
2000, available at /www.nyt.com> (citing recent Odyssey survey).
    \9\ The Commission, of course, recognizes that other consumer 
concerns also may hinder the development of e-commerce. As a result, 
the agency has pursued other initiatives such as combating online fraud 
through law enforcement efforts. See FTC Staff Report: The FTC's First 
Five Years Protecting Consumers Online (Dec. 1999). The Commission, 
with the Department of Commerce, is also holding a public workshop and 
soliciting comment on the potential issues associated with the use of 
alternative dispute resolution for online consumer transactions. See 
Initial Notice Requesting Public Comment and Announcing Public 
Workshop, 65 Fed. Reg. 7,831 (Feb. 16, 2000); Notice Announcing Dates 
and Location of Workshop and Extending Deadline for Public Comments, 65 
Fed. Reg. 18,032 (Apr. 6, 2000). The workshop will be held on June 6 
and 7, 2000. Information about the workshop, including the federal 
register notices and public comments received, is available at /
www.ftc.gov/bcp/altdisresolution/index.htm>.
---------------------------------------------------------------------------
C. The Commission's Approach to Online Privacy--Initiatives Since 1995
    Since 1995, the Commission has been at the forefront of the public 
debate concerning online privacy.\10\ The Commission has held public 
workshops; examined Web site information practices and disclosures 
regarding the collection, use, and transfer of personal information; 
and commented on self-regulatory efforts and technological developments 
intended to enhance consumer privacy. The Commission's goals have been 
to understand this new marketplace and its information practices, and 
to assess the costs and benefits to businesses and consumers.\11\
---------------------------------------------------------------------------
    \10\ The Commission's review of privacy has mainly focused on 
online issues because the Commission believes privacy is a critical 
component in the development of electronic commerce. However, the FTC 
Act and most other statutes enforced by the Commission apply equally in 
the offline and online worlds. As described infra, n.11, the agency has 
examined privacy issues affecting both arenas, such as those implicated 
by the Individual Reference Services Group, and in the areas of 
financial and medical privacy. It also has pursued law enforcement, 
where appropriate, to address offline privacy concerns. See FTC v. 
Rapp, No. 99-WM-783 (D. Colo. filed Apr. 21, 1999); In re Trans Union, 
Docket No. 9255 (Feb. 10, 2000), appeal docketed, No. 00-1141 (D.C. 
Cir. Apr. 4, 2000). These activities--as well as recent concerns about 
the merging of online and offline databases, the blurring of 
distinctions between online and offline merchants, and the fact that a 
vast amount of personal identifying information is collected and used 
offline--make clear that significant attention to offline privacy 
issues is warranted.
    \11\ The Commission held its first public workshop on privacy in 
April 1995. In a series of hearings held in October and November 1995, 
the Commission examined the implications of globalization and 
technological innovation for competition and consumer protection 
issues, including privacy concerns. At a public workshop held in June 
1996, the Commission examined Web site practices regarding the 
collection, use, and transfer of consumers' personal information; self-
regulatory efforts and technological developments to enhance consumer 
privacy; consumer and business education efforts; the role of 
government in protecting online information privacy; and special issues 
raised by the online collection and use of information from and about 
children. The Commission held a second workshop in June 1997 to explore 
issues raised by individual reference services, as well as issues 
relating to unsolicited commercial e-mail, online privacy generally, 
and children's online privacy.
    The Commission and its staff have also issued reports describing 
various privacy concerns in the electronic marketplace. See, e.g., FTC 
Staff Report: The FTC's First Five Years Protecting Consumers Online 
(Dec. 1999); Individual Reference Services: A Federal Trade Commission 
Report to Congress (Dec. 1997); FTC Staff Report: Public Workshop on 
Consumer Privacy on the Global Information Infrastructure (Dec. 1996); 
FTC Staff Report: Anticipating the 21st Century: Consumer Protection 
Policy in the New High-Tech, Global Marketplace (May 1996). Recently, 
at the request of the Department of Health and Human Services 
(``HHS''), the Commission submitted comments on HHS' proposed Standards 
for Privacy of Individually Identifiable Health Information (required 
by the Health Insurance Portability and Accountability Act of 1996). 
The Commission strongly supported HHS' proposed ``individual 
authorization'' or ``opt-in'' approach to health providers' ancillary 
use of personally identifiable health information for purposes other 
than those for which the information was collected. The Commission also 
offered HHS suggestions it may wish to consider to improve disclosure 
requirements in two proposed forms that would be required by the 
regulations. The Commission's comments are available at /
www.ftc.gov/be/v000001.htm>.
    The Commission also has brought law enforcement actions to protect 
privacy online pursuant to its general mandate to fight unfair and 
deceptive practices. See FTC v. ReverseAuction.com, Inc., No. 00-0032 
(D.D.C. Jan. 6, 2000) (consent decree) (settling charges that an online 
auction site obtained consumers' personal identifying information from 
a competitor site and then sent deceptive, unsolicited e-mail messages 
to those consumers seeking their business); Liberty Financial 
Companies, Inc., FTC Dkt. No. C-3891 (Aug. 12, 1999) (consent order) 
(challenging the allegedly false representations by the operator of a 
``Young Investors'' Web site that information collected from children 
in an online survey would be maintained anonymously); GeoCities, FTC 
Dkt. No. C-3849 (Feb. 12, 1999) (consent order) (settling charges that 
Web site misrepresented the purposes for which it was collecting 
personal identifying information from children and adults).
---------------------------------------------------------------------------
    In June 1998 the Commission issued Privacy Online: A Report to 
Congress (``1998 Report''), an examination of the information practices 
of commercial sites on the World Wide Web and of industry's efforts to 
implement self-regulatory programs to protect consumers' online 
privacy.\12\ The Commission described the widely-accepted fair 
information practice principles of Notice, Choice, Access and Security. 
The Commission also identified Enforcement--the use of a reliable 
mechanism to provide sanctions for noncompliance--as a critical 
component of any governmental or self-regulatory program to protect 
privacy online.\13\ In addition, the 1998 Report presented the results 
of the Commission's first online privacy survey of commercial Web 
sites. While almost all Web sites (92% of the comprehensive random 
sample) were collecting great amounts of personal information from 
consumers, few (14%) disclosed anything at all about their information 
practices.\14\
---------------------------------------------------------------------------
    \12\ The Report is available on the Commission's Web site at 
/www.ftc.gov/reports/privacy3/index.htm>.
    \13\ 1998 Report at 11-14.
    \14\ Id. at 23, 27.
---------------------------------------------------------------------------
    Based on survey data showing that the vast majority of sites 
directed at children also collected personal information, the 
Commission recommended that Congress enact legislation setting forth 
standards for the online collection of personal information from 
children.\15\ The Commission deferred its recommendations with respect 
to the collection of personal information from online consumers 
generally. In subsequent Congressional testimony, the Commission 
discussed promising self-regulatory efforts suggesting that industry 
should be given more time to address online privacy issues. The 
Commission urged the online industry to expand these efforts by 
adopting effective, widespread self-regulation based upon the long-
standing fair information practice principles of Notice, Choice, 
Access, and Security, and by putting enforcement mechanisms in place to 
assure adherence to these principles.\16\
---------------------------------------------------------------------------
    \15\Id. at 42-43. In October 1998, Congress enacted the Children's 
Online Privacy Protection Act of 1998 (``COPPA''), which authorized the 
Commission to issue regulations implementing the Act's privacy 
protections for children under the age of 13. 15 U.S.C. Sec. Sec. 6501 
et seq. In October 1999, as required by COPPA, the Commission issued 
its Children's Online Privacy Protection Rule, which became effective 
last month. 16 C.F.R. Part 312.
    \16\See Prepared Statement of the Federal Trade Commission on 
``Consumer Privacy on the World Wide Web'' before the Subcommittee on 
Telecommunications, Trade and Consumer Protection of the House 
Committee on Commerce, U.S. House of Representatives (July 21, 1998), 
available at /www.ftc.gov/os/1998/9807/privac98.htm>.
---------------------------------------------------------------------------
    Last year, Georgetown University Professor Mary Culnan conducted a 
survey of a random sample drawn from the most-heavily trafficked sites 
on the World Wide Web as well as a survey of the busiest 100 sites.\17\ 
The former, known as the Georgetown Internet Privacy Policy Survey, 
found significant improvement in the frequency of privacy disclosures, 
but also that only 10% of the sites posted disclosures that even 
touched on all four fair information practice principles.\18\ Based in 
part on these results, a majority of the Commission recommended in its 
1999 report to Congress, Self-Regulation and Privacy Online, that self-
regulation be given more time, but called for further industry efforts 
to implement the fair information practice principles.\19\
---------------------------------------------------------------------------
    \17\ The results for the random sample of 361 Web sites are 
reported in Georgetown Internet Privacy Policy Survey: Report to the 
Federal Trade Commission (June 1999), available at /www.msb.edu/
faculty/culnanm/gippshome.html> [hereinafter ``GIPPS Report'']. The 
results of Professor Culnan's study of the top 100 Web sites, conducted 
for the Online Privacy Alliance, are reported in Online Privacy 
Alliance, Privacy and the Top 100 Sites: Report to the Federal Trade 
Commission (June 1999), available at /www.msb.edu/faculty/
culnanm/gippshome.html> [hereinafter ``OPA Report''].
    \18\ See GIPPS Report, Appendix A, Table 8C.
    \19\ Self-Regulation and Privacy Online (July 1999) at 12-14 
(available at /www.ftc.gov/os/1999/9907/index.htm#13>).
---------------------------------------------------------------------------
    This week the Commission issued its third report to Congress 
examining the state of online privacy and the efficacy of industry 
self-regulation. Privacy Online: Fair Information Practices in the 
Electronic Marketplace (``2000 Report'') * presents the results of the 
Commission's 2000 Online Privacy Survey, which reviewed the nature and 
substance of U.S. commercial Web sites' privacy disclosures, and 
assesses the effectiveness of self-regulation. The 2000 Report also 
considers the recommendations of the Commission-appointed Advisory 
Committee on Online Access and Security.\20\ Finally, the Report sets 
forth the Commission's conclusion that legislation is necessary to 
ensure further implementation of fair information practices online and 
recommends the framework for such legislation.\21\
---------------------------------------------------------------------------
    * The information referred to has been retained in Committee files.
    \20\ On December 1999, the Commission established the Federal Trade 
Commission Advisory Committee on Online Access and Security, pursuant 
to the Federal Advisory Committee Act, 5 U.S.C. App. Sec. Sec. 1-15. 
Notice of Establishment of the Federal Trade Commission Advisory 
Committee on Online Access and Security and Request for Nominations, 64 
Fed. Reg. 71,457 (1999).
    The Commission asked the Advisory Committee, a group comprising 40 
e-commerce experts, industry representatives, security specialists, and 
consumer and privacy advocates, to consider the parameters of 
``reasonable access'' to personal information collected from and about 
consumers online and ``adequate security'' for such information, and to 
prepare a report presenting options for implementation of these fair 
information practices and the costs and benefits of each option. The 
duties of the Advisory Committee were solely advisory. The Advisory 
Committee Report and proceedings are available at /www.ftc.gov/
acoas>.
    \21\ The Commission vote to issue the 2000 Report was 3-2, with 
Commissioner Swindle dissenting and Commissioner Leary concurring in 
part and dissenting in part. Both Commissioners' separate statements 
are attached to the Report. Copies of the 2000 Report and of the report 
of the Advisory Committee on Online Access and Security are attached. * 
The Reports are also available at /www.ftc.gov/reports/
privacy2000/privacy2000.pdf> and /www.ftc.gov/acoas/papers/
finalreport.htm>, respectively. *The information referred to has been 
retained in Committee files.
---------------------------------------------------------------------------
II. Fair Information Practices in the Electronic Marketplace: The 
        Results of the 2000 Survey

    In February and March 2000, the Commission conducted a survey of 
commercial sites' information practices, using a list of the busiest 
U.S. commercial sites on the World Wide Web.\22\ Two groups of sites 
were studied: (a) a random sample of 335 Web sites (the ``Random 
Sample'') and (b) 91 of the 100 busiest sites (the ``Most Popular 
Group'').\23\ As was true in 1998, the 2000 Survey results show that 
Web sites collect a vast amount of personal information from and about 
consumers. Almost all sites (97% in the Random Sample, and 99% in the 
Most Popular Group) collect an e-mail address or some other type of 
personal identifying information.\24\
---------------------------------------------------------------------------
    \22\ The list of Web sites was provided by Nielsen//NetRatings 
based upon January 2000 traffic figures. 2000 Report, Appendix A.
    \23\ 2000 Report at 7, 9 and Appendix A.
    \24\ 2000 Report at 9.
---------------------------------------------------------------------------
    The 2000 Survey results also show that there has been continued 
improvement in the percent of Web sites that post at least one privacy 
disclosure (88% in the Random Sample and 100% in the Most Popular 
Group).\25\ The Commission's 2000 Survey went beyond the mere counting 
of disclosures, however, and analyzed the nature and substance of these 
privacy disclosures in light of the fair information practice 
principles of Notice, Choice, Access, and Security. It found that only 
20% of Web sites in the Random Sample that collect personal identifying 
information implement, at least in part, all four fair information 
practice principles (42% in the Most Popular Group).\26\ While these 
numbers are higher than similar figures obtained in Professor Culnan's 
studies, the percentage of Web sites that state they are providing 
protection in the core areas remains low. Further, recognizing the 
complexity of implementing Access and Security as discussed in the 
Advisory Committee report, the Commission also examined the data to 
determine whether Web sites are implementing Notice and Choice only. 
The data showed that only 41% of sites in the Random Sample and 60% of 
sites in the Most Popular Group meet the basic Notice and Choice 
standards.\27\
---------------------------------------------------------------------------
    \25\ Id. at 10.
    \26\ Id. at 12-13.
    \27\ Id. at 13-14.
---------------------------------------------------------------------------
    The 2000 Survey also examined the extent to which industry's 
primary self-regulatory enforcement initiatives--online privacy seal 
programs--have been adopted. These programs, which require companies to 
implement certain fair information practices and monitor their 
compliance, promise an efficient way to implement privacy protection. 
However, the 2000 Survey revealed that although the number of sites 
enrolled in these programs has increased over the past year,\28\ the 
seal programs have yet to establish a significant presence on the Web. 
The Survey found that less than one-tenth, or approximately 8%, of 
sites in the Random Sample display a privacy seal. Moreover, less than 
one-half, or 45%, of the sites in the Most Popular Group display a 
seal.\29\
---------------------------------------------------------------------------
    \28\ Id. at 6-7.
    \29\ Id. at 20.
---------------------------------------------------------------------------
III. Commission Recommendations

    Based on the past years of work addressing Internet privacy issues, 
including examination of prior surveys and workshops with consumers and 
industry, it is evident that online privacy continues to present an 
enormous public policy challenge.\30\ The Commission applauds the 
significant efforts of the private sector and commends industry leaders 
in developing self-regulatory initiatives. The 2000 Survey, however, 
demonstrates that industry efforts alone have not been sufficient. 
Because self-regulatory initiatives to date fall far short of broad-
based implementation of effective self-regulatory programs, a majority 
of the Commission has concluded that such efforts alone cannot ensure 
that the online marketplace as a whole will emulate the standards 
adopted by industry leaders. While there will continue to be a major 
role for industry self-regulation in the future, a majority of the 
Commission recommends that Congress enact legislation that, in 
conjunction with continuing self-regulatory programs, will ensure 
adequate protection of consumer privacy online.
---------------------------------------------------------------------------
    \30\ As noted earlier, supra n.10, and as illustrated by 
legislative decisions made in the areas of medical and financial 
privacy, offline privacy issues are also significant.
---------------------------------------------------------------------------
    The proposed legislation would set forth a basic level of privacy 
protection for consumer-oriented commercial Web sites.\31\ Such 
legislation would establish basic standards of practice for the 
collection of information online, and provide an implementing agency 
with the authority to promulgate more detailed standards pursuant to 
the Administrative Procedure Act.\32\
---------------------------------------------------------------------------
    \31\ Legislation should cover such sites to the extent not already 
covered by the Children's Online Privacy Protection Act, 15 U.S.C. 
Sec. Sec. 6501 et seq.
    \32\ 5 U.S.C. Sec. 553.
---------------------------------------------------------------------------
    Consumer-oriented commercial Web sites that collect personal 
identifying information from or about consumers online would be 
required to comply with the four widely-accepted fair information 
practices:

        (1) Notice--Web sites would be required to provide consumers 
        clear and conspicuous notice of their information practices, 
        including what information they collect, how they collect it 
        (e.g., directly or through non-obvious means such as cookies), 
        how they use it, how they provide Choice, Access, and Security 
        to consumers, whether they disclose the information collected 
        to other entities, and whether other entities are collecting 
        information through the site.\33\
---------------------------------------------------------------------------
    \33\ The Commission will soon be addressing the issue of third-
party online collection of personal information for profiling purposes 
in a separate report to Congress.

        (2) Choice--Web sites would be required to offer consumers 
        choices as to how their personal identifying information is 
        used beyond the use for which the information was provided 
        (e.g., to consummate a transaction). Such choice would 
        encompass both internal secondary uses (such as marketing back 
        to consumers) and external secondary uses (such as disclosing 
---------------------------------------------------------------------------
        data to other entities).

        (3) Access--Web sites would be required to offer consumers 
        reasonable access to the information a Web site has collected 
        about them, including a reasonable opportunity to review 
        information and to correct inaccuracies or delete information.

        (4) Security--Web sites would be required to take reasonable 
        steps to protect the security of the information they collect 
        from consumers.

    The Commission recognizes that the implementation of these 
practices may vary with the nature of the information collected and the 
uses to which it is put, as well as with technological developments. 
For this reason, a majority of the Commission recommends that any 
legislation be phrased in general terms and be technologically neutral. 
Thus, the definitions of fair information practices set forth in the 
statute should be broad enough to provide flexibility to the 
implementing agency in promulgating its rules or regulations.
    Finally, the Commission notes that industry self-regulatory 
programs would continue to play an essential role under such a 
statutory structure, as they have in other contexts.\34\ The Commission 
hopes and expects that industry and consumers would participate 
actively in developing regulations under the new legislation and that 
industry would continue its self-regulatory initiatives. The Commission 
also recognizes that effective and widely-adopted seal programs could 
be an important component of that effort.
---------------------------------------------------------------------------
    \34\ For example, the program administered by the National 
Advertising Division of the Council of Better Business Bureaus, Inc. 
(``NAD'') is a model self-regulatory program that complements the 
Commission's authority to regulate unfair and deceptive advertising. 
The NAD expeditiously investigates complaints made by consumers or 
competitors about the truthfulness of advertising. An advertiser that 
disagrees with the NAD's conclusion may appeal to the National 
Advertising Review Board (``NARB''), which includes members from inside 
and outside the advertising industry. The vast majority of disputes 
handled by the NAD and NARB are resolved without government 
intervention, resulting in greater respect for and enforcement of the 
law at a substantial savings to the taxpayer. Those disputes that the 
NAD and NARB are unable to resolve are referred to the Commission.
    The Commission also has a long record of working with industry to 
develop and disseminate informational materials for the public. See, 
e.g., Notice of Opportunity to Participate and Obtain Co-Sponsorship in 
Agency Public Awareness Campaign re: Children's Online Privacy 
Protection Rule, available at /:www.ftc.gov/os/2000/05/
index.htm#12>.
---------------------------------------------------------------------------
    For all of these reasons, a majority of the Commission believes 
that its proposed legislation, in conjunction with self-regulation, 
will ensure important protections for consumer privacy at a critical 
time in the development of the online marketplace. Without such 
protections, electronic commerce will not reach its full potential and 
consumers will not gain the confidence they need in order to 
participate fully in the online marketplace.
IV. Conclusion
    The Commission is committed to the goal of assuring fair 
information practices for consumers online, and looks forward to 
working with the Committee as it considers the Commission's Report and 
proposals for protecting online privacy.

    The Chairman. I thank you, Chairman Pitofsky.
    I would tell the other Commissioners, your complete 
statement will be made part of the record and if you could 
summarize we would very much appreciate it. But at the same 
time, we do not want to prevent the Committee from receiving 
all the information you wish to convey.
    Commissioner Anthony.

      STATEMENT OF HON. SHEILA F. ANTHONY, COMMISSIONER, 
                    FEDERAL TRADE COMMISSION

    Ms. Anthony. Thank you, Mr. Chairman. I am delighted to be 
here today and I am pleased that the Commission is recommending 
Federal legislation----
    Senator Stevens. Would you pull that mike up to you, 
please.
    Ms. Anthony. Sure.
    I am pleased that the Commission is recommending 
legislation necessary to protect consumer privacy. I wish to 
emphasize four points related to our legislative 
recommendation:
    One, any quality privacy policy should offer true 
protections to consumers and be presented in a simple format 
that is clear and understandable;
    Two, an enforcement mechanism must be in place that gives 
consumers confidence that Web sites do what they say they do 
with consumers' personal data;
    Three, a patchwork of State privacy laws will result in 
confusion both to consumers and businesses, and thus Federal 
preemption should at least be seriously considered;
    Four, implementation of consumer consent via opt-in and 
opt-out may require making a distinction between market 
information and sensitive health and financial information.
    The 2000 survey reports that 97 percent of the random 
sample and 99 percent of the most popular group collect 
personally identifying information, but only 20 percent of the 
random sample and just 42 percent of the most popular group 
address, at least in part, all four information practices.
    Seal programs and audits can be key enforcement mechanisms. 
Yet only 8 percent in the random sample and 45 percent of the 
most popular group display a seal.
    Perhaps more troubling to me is that many privacy policies 
are confusing, contradictory, and ambiguous. I reviewed some of 
the privacy policies in the most popular group of Web sites in 
our survey. Frankly, I was disappointed. Almost half of the 
policies are too long, varying from 3 to 12 pages. Many try to 
lull a consumer into a false sense of comfort. Despite opening 
statements asserting the importance of the user's privacy, 
subsequent paragraphs frequently contain contradictory 
information.
    Consider the following language in an Internet service 
provider's published privacy policy. The first sentence states: 
``Your privacy is important to us,'' but continues several 
paragraphs later: ``The personal information we collect from 
members during the registration process is used to manage each 
member's account. This information is not shared with third 
parties unless specifically stated otherwise or in special 
circumstances.''
    Three pages later, the same policy goes on to say: ``We may 
disclose personal information about our visitors or members or 
information regarding your use of the services or Web sites 
accessible through our services for any reason if, in our sole 
discretion, we believe it is reasonable to do so.''
    Would you call this a clear, unambiguous disclosure? I do 
not. Does it inform consumers about whether his or her 
information will be shared and, if so, with whom? I do not 
believe it does.
    My next example illustrates serious concerns with regard to 
meaningful consent. I quote from a privacy policy statement 
from one of the top 100 sites: ``When you submit personal 
information to us, you understand and agree that our 
subsidiaries, affiliates, and trusted vendors may transfer, 
store, and process your customer profile in any of the 
countries in which we and our affiliates maintain offices.''
    Has the site identified with specificity the parties with 
whom it will share this consumer's information? Is consent 
meaningful if consumers do not see this notice or have access 
to it at the time they supply their personal information?
    Even a policy that incorporates all four fair information 
practices can be ambiguous and contradictory. What do you make 
of this privacy policy that contains the following disclaimer: 
``This statement and the policies outlined herein are not 
intended to and do not create any contractual or other legal 
rights in or on behalf of any party.'' This disclaimer seems to 
absolve the site of any responsibility to protect a consumer's 
information. It reminds me of a letter I once received from a 
lawyer which had the following postscript: ``Dictated but not 
read.''
    I do not think it is difficult to design a standardized, 
conspicuous privacy notice that informs consumers in an 
unambiguous, non-contradictory way. The chart, which is 
attached to my testimony and is what you see here, tells the 
viewer most of what she needs to know about a Web site's 
privacy practices and consumer choices. Web sites can take 
advantage of the interactive nature of the Internet to design 
effective mechanisms and to provide meaningful notice or 
privacy policies.
    I share Commissioner Leary's view that a comprehensive 
privacy policy for consumers must extend to the offline world. 
The business incentive to compete simultaneously in both the 
offline and online worlds is high. To create a distinction 
between offline and online is artificial and outdated and in 
the long run may foster market barriers.
    Finally, I want to commend the FTC staff for the hard work 
they have done on this report. The Bureau of Consumer 
Protection, with the assistance of the Bureau of Economics, 
designed and implemented this survey, and the numbers were 
reported clearly, fairly, and without bias.
    Thank you for allowing me to share my views.
    [The prepared statement of Commissioner Anthony follows:]

      Prepared Statement of Hon. Sheila F. Anthony, Commissioner, 
                        Federal Trade Commission

    Mr. Chairman and members of the Committee, I am delighted to be 
here this morning, and I appreciate your holding this hearing to 
address a topic of great importance to the American people and critical 
to the growth and success of electronic commerce.
    I am pleased the Commission is recommending that federal 
legislation is necessary to protect consumer privacy. Survey after 
survey demonstrates that public concerns about privacy have been 
growing and that these concerns have focused on the power of 
technologies to collect, store, search, and transmit large amounts of 
personally identifiable information. I not only share those concerns, I 
note that threats to consumer privacy are increasing with the merging 
of the offline and online worlds. In short, things may be getting worse 
for Americans on the privacy front.
    I wish to emphasize four points related to the legislative 
recommendation the Commission makes to you today:

        1) Any quality privacy policy should offer true protections to 
        consumers and be presented in a simple format that is clear and 
        understandable.

        2) An enforcement mechanism must be in place that gives 
        consumers confidence that Web sites do what they say they will 
        do with consumers' personal data. While the seal of approval 
        programs offer promise, 92 percent of the surveyed sites did 
        not have a privacy seal from one of the industry-established 
        programs. There may be some advantage to building on industry 
        standards that utilize audits.

        3) A patchwork of state privacy laws will result in confusion 
        to both consumers and businesses, and thus federal pre-emption 
        should be, at least, seriously considered. People value 
        uniformity and predictability.

        4) Implementation of consumer consent, via opt-in and opt-out 
        methods, may require making a distinction between market 
        information and sensitive health and financial information.

A. Fair Information Principles Are Widely Accepted
    In the Commission's first Privacy Report in 1998, we summarized 
four widely accepted principles regarding the collection, use, and 
dissemination of personal information. These core principles of privacy 
protection are common to government reports, guidelines, and model 
codes, and predate the online medium:

   Notice--data collectors must disclose their information 
        practices before collecting personal information from 
        consumers.

   Choice--consumers must be given options with respect to 
        whether and how personal information collected from them may be 
        used for purposes beyond those for which the information was 
        provided.

   Access--consumers should be able to view and contest the 
        accuracy and completeness of data collected about them.

   Security--data collectors must take reasonable steps to 
        assure that information collected from consumers is accurate 
        and secure from unauthorized use.

B. The Vast Majority of Web sites Collect Personal Data But Do Not 
        Provide Privacy Protections
    The percentage of commercial Web sites that collect personally 
identifying information is very high. The 2000 Survey reports that 97 
percent of the Random Sample and 99 percent of the Most Popular Group 
collect personally identifying information, but the percentage 
providing aspects of these fair information practices is still quite 
low. The 2000 Survey reports that only 20 percent of the Random Sample 
and just 42 percent of the Most Popular Group address, at least in 
part, all four fair information practices. In fact, these results 
likely overstate the percentage of sites that truly implement the fair 
information practices in a meaningful way. Our content analysts 
credited policies if the stated practices applied to any of the 
information collected, even if it did not apply to all the information 
collected.\1\
---------------------------------------------------------------------------
    \1\ The 2000 Survey analysis gave Access credit for informational 
statements about any one of three elements (review, correction or 
deletion). However, the Commission previously stated that fair 
information practices require that consumers be afforded both an 
opportunity to review information and an opportunity to contest the 
data's accuracy or completeness. Under this standard, only 11% of the 
random and 27% of the Most Popular Group would receive credit for 
providing Access rather than the 18% of the random and 47% of the Most 
Popular Group calculated using an expansive measure.
---------------------------------------------------------------------------
C. Policies Posted By Web sites Are Confusing and Contradictory
    Perhaps more troubling to me is that many privacy policies are 
confusing, contradictory, and ambiguous. What good is a privacy policy 
that is not understandable by ordinary consumers, is contradictory from 
paragraph to paragraph, or fails to offer basic protections?
    I reviewed some of the privacy policies of the Most Popular Group 
of Web sites in the survey. Frankly, I was disappointed. Almost half of 
the privacy polices are too long, varying from 3-12 pages. Many try to 
lull the consumer into a false sense of comfort by utilizing opening 
statements regarding the importance of respecting individual privacy or 
by referring to third parties as ``trusted vendors'' or those with whom 
there is an ``established agreement to protect your privacy.'' Despite 
the opening statements asserting the importance of the user's privacy, 
subsequent paragraphs frequently contain contradictory information. 
After reviewing some of these policy statements, I am left to wonder 
whether:

   these policies truly inform consumers

   the Web sites have something to hide

   the Web sites themselves are confused about their own 
        policies

   the drafting lawyers have run amok.

    Consider the following language in an Internet Service Provider's 
published Privacy Policy.

    The first sentence states:

        Your privacy is very important to us.

    But, continues several paragraphs later:

        The personal information we collect from members during the 
        registration process is used to manage each member's account. 
        This information is not shared with third parties unless 
        specifically stated otherwise or in special circumstances.

    Three pages later, the same policy goes on to say:

        [We] may disclose personal information about our visitors or 
        members or information regarding your use of the Services or 
        Web sites accessible through our Services, for any reason if, 
        in our sole discretion, we believe that it is reasonable to do 
        so, . . .

    Would you call this a clear, unambiguous disclosure? I do not. Does 
it inform the consumer about whether his or her information will be 
shared and, if so, with whom? I do not believe it does.

    My next example illustrates serious concerns with regard to 
meaningful consent. I quote from a privacy policy statement from one of 
the top 100 sites:

        When you submit personal information to [us] you understand and 
        agree that our subsidiaries, affiliates and trusted vendors may 
        transfer, store, and process your customer profile in any of 
        the countries in which we and our affiliates maintain offices.

    Has the site identified with specificity the parties with whom it 
will share customer information? Is consent meaningful if consumers do 
not see this notice or have access to it at the time they surrender 
their personal information?

    Even a policy statement that incorporates all of the four fair 
information practices may still be ambiguous and contradictory. What do 
you make of a privacy policy that contains the following disclaimer:

        These policies are effective as of [x date]. [This site] 
        reserves the right to change the policy at any time by 
        notifying users of the existence of a new privacy statement. 
        This statement and the policies outlined herein are not 
        intended to and do not create any contractual or other legal 
        rights in or on behalf of any party.

    I wonder through what means consumers will be notified of changes 
in the policy statement. How will data collected pursuant to one policy 
be treated under a new policy? Must consumers ``check back'' from time 
to time? The disclaimer, quoted above, seems to absolve the site of any 
responsibility to protect a consumer's information. It reminds me of a 
letter I once received from a lawyer, which had the following post 
script: ``Dictated, but not read.''

D. An Increase in Posted Privacy ``Policies'' Does Not Correlate with 
        Increased Privacy Protections
    Although the survey demonstrates some increase in the percentage of 
sites posting privacy policies, these policies all too often do not 
offer privacy protections. While Web sites should be offering privacy 
protections, a whopping 80 percent of the surveyed Web sites in the 
Random Sample failed to implement aspects of notice, choice, access, 
and security.

E. No Enforcement Tools Exists to Ensure Sites Do What They Say
    For years the Commission has urged industry to engage in meaningful 
self-regulatory efforts. For self-regulation to be credible, there must 
be an enforcement mechanism that gives consumers confidence that Web 
sites do what they say they do with consumers' personal data. Seal 
programs and audits can be key enforcement mechanisms. Yet, 92 percent 
of the surveyed Web sites in the Random Group did not have a privacy 
seal. Our legislative recommendation would reward those sites that have 
offered meaningful privacy protections and would require all others to 
meet basic privacy standards. It would also give consumers the 
assurance that a legal structure is in place to provide confidence that 
stated privacy polices will be honored.

F. A Standardized Privacy Notice May be Useful: See Chart
    How difficult is it to design a conspicuous privacy notice that 
informs consumers in a standardized, unambiguous, non-contradictory 
way? Not very difficult. Appended to this testimony is a simple chart 
that tells the viewer most of what she needs to know about a Web site's 
privacy practices and consumer choices. Web sites can take advantage of 
the interactive nature of the Internet to design effective mechanisms 
to provide meaningful notice or privacy policies.

G. Profiling is Invisible and Threatens Consumer Privacy
    Profiling is beyond the scope of this report, and I believe it will 
be the subject of a later Commission report. Profiling poses a serious 
privacy threat to consumers because it is largely invisible to them. I 
am concerned about the passive, surreptitious collection of information 
about consumers and their browsing habits without their knowledge. Our 
report notes that third party cookies are placed by ad servers on 78 
percent of the sites in the Most Popular Group. Of those sites, only 51 
percent disclose to consumers that they have allowed third party 
cookies to be placed (and they usually locate that disclosure at the 
end of the policy statement). Unless consumers are technically skilled 
enough to set their browser to alert them to cookies or to decline all 
third party cookies, the placement of third party cookies generally 
goes unnoticed by consumers.

H. Online, Offline: What's the Difference?
    Finally, I share Commissioner Leary's view that a comprehensive 
privacy policy for consumers must extend to the offline world. 
Traditional brick and mortar businesses no longer store and maintain 
their customer records on index cards. The data businesses have 
collected offline are often transferred to computers and can be merged 
with online databases with a simple click of a button. The business 
incentive to compete simultaneously in both the online and offline 
worlds is high. To create a distinction between the offline and online 
worlds is artificial and outdated and in the long run may foster market 
barriers.
    Finally, I want to commend the FTC staff for the excellent job they 
have done on this Report. The Bureau of Consumer Protection, with the 
assistance of the Bureau of Economics, designed and implemented the 
survey that formed the basis of this report. The survey numbers were 
reported clearly, fairly, and without bias. My hat is off to them.
    I appreciate the opportunity to express my views.

                                              Sample Privacy Policy
----------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------
We collect Personally Identifiable Information about    Yes                 No                 Click here to see
 you                                                                                            what kinds of
                                                                                                EJNo information
                                                                                                we collect

We use your personal information to notify you of our   Yes                 No                 Click here to opt
 future promotions                                                                              out/opt in

We share information about you with Third Parties for   Yes                 No                 Click here to opt
 marketing purposes. Click here to see who we share                                             out/opt in
 information with

You may review and correct or delete information        Yes                 No                 Click here to
 about yourself (with proper authentication)                                                    access our
                                                                                                database. Have
                                                                                                your Membership
                                                                                                # and Pin #
                                                                                                ready.

We provide reasonable security to protect your          Yes                 No
 personal information during its transmission and
 while it is in our possession
----------------------------------------------------------------------------------------------------------------

    The Chairman. Thank you very much, Commissioner Anthony.
    Commissioner Swindle.

        STATEMENT OF HON. ORSON SWINDLE, COMMISSIONER, 
                    FEDERAL TRADE COMMISSION

    Mr. Swindle. Thank you, Mr. Chairman, Senator Hollings, and 
members of the Committee.
    The Chairman. You need the microphone.
    Mr. Swindle. I appreciate this opportunity to be with you 
today and share some thoughts. I will, at the chairman's 
request, try to summarize my prepared statement, which we have 
all submitted.
    I have dissented against the Commission's embarrassingly 
flawed privacy report and its conclusory, yet sweeping, 
legislative recommendation. In an unwarranted reversal of its 
earlier acceptance of a self-regulatory approach, a majority of 
the Commission has recommended that Congress require all 
commercial consumer-oriented Web sites that collect personally 
identifying information from consumers to adopt government-
prescribed versions of four fair information privacy practices, 
known as FIPPs. You have heard: notice, choice, access, and 
security.
    The majority has abandoned the self-regulatory approach in 
favor of an excessive government regulation despite continued 
progress in self-regulation. Why has a majority of the 
Commission decided to discontinue relying on self-regulation? 
The fundamental rationale given is that not enough Web sites 
are providing the type of privacy protections that the 
Commission has decided should be provided and this is hindering 
and will continue to hinder the growth of electronic commerce.
    Instead of focusing on consumers' increasing ability to 
make choices concerning online privacy protection, the majority 
emphasizes that the survey, the 2000 survey, reveals that only 
20 percent of all commercial Web sites and 42 percent of the 
most popular Web sites meet the full FIPPs requirement. But the 
main reason for this relatively low percentage is that 
commercial Web sites have not disclosed to consumers whether 
they provide access and security. This failure to disclose is 
not surprising given the access and security implementation 
difficulties recently identified by the Advisory Committee on 
Access and Security, a copy of which I believe is included in 
our report.
    In this regard, it is important to emphasize that the 2000 
survey did not attempt to measure whether sites actually 
provide access and security. Rather, it gauged only whether 
disclosures address these issues. The 2000 survey certainly did 
not give any credit for no access, even though the majority 
indicates it might consider no access to be reasonable access 
in some instances.
    If these access and security disclosure requirements are 
eliminated, the percentages of all Web sites meeting the FIPPs 
requirement rises significantly, to 41 percent of all 
commercial Web sites and 60 percent of the most popular. But 
even this 41 percent figure is understated because it uses a 
very strained definition of choice that is more accurately, in 
my mind, described as mandated choice.
    Specifically, there is no choice recognized by the survey 
unless the consumer is allowed to make two choices: whether or 
not his information can be used internally by the Web site or 
the business or, and the second requirement, whether the 
business is allowed to use that information with third parties.
    The report's recommendation that choice be legislated does 
not mean the kind of choice that informed consumers exercise in 
a marketplace once they know the terms on which they are 
dealing with retailers. That is real choice. The effect of 
mandated choice may be, as Senator Kerry pointed out, to start 
to eliminate or reduce choices for the consumers.
    Legislation, in my mind, should be reserved for problems 
that the market cannot fix on its own and should not be adopted 
without consideration of the problems legislation may create 
by, for example, imposing costs or other unintended 
consequences that could severely stifle a thriving new economy.
    The majority has recommended that Congress give rulemaking 
authority to an implementing agency, presumably the Commission, 
to define the proposed legislative requirements. In my 
judgment, however, the Commission owes it to the Congress and 
to the public to comment more specifically on what it has in 
mind before it recommends legislation that requires all 
consumer-oriented commercial Web sites to comply with 
breathtakingly broad laws whose details will be filled in later 
during the rulemaking process.
    The privacy report is devoid of any consideration of cost 
of legislation in comparison to the asserted benefits of 
enhancing consumer confidence and allowing electronic commerce 
to reach its full potential.
    For the sake of time, I will not cover my entire dissent 
nor the prepared statement that I have submitted today. But, I 
would like to make a couple of remarks in conclusion. The 
privacy report fails to pose and to answer basic questions that 
all regulators and lawmakers should consider before embarking 
on extensive regulation that could throttle the new economy. 
Shockingly, there is absolutely no consideration of the costs 
and benefits of regulation, nor of regulation's predictable and 
unanticipated effects on competition and consumer choice, nor 
the experience we have to date with government regulation of 
privacy, nor of the constitutional issues, nor of how this 
vague and vast mandate will be enforced.
    Industry self-regulation is working. Effective privacy 
protection is more than a numbers game, and the private sector 
is continuing to address consumer concerns about privacy 
because it is in industry's best interest to do so. Let us not 
make the search for the perfect the enemy of the good. The best 
way to build consumer trust and to ensure the continued growth 
of the Internet is through a combination of education, strong 
industry self-regulation, and strong FTC enforcement under 
existing legal authority. It is premature and counterproductive 
for the Commission to radically change course and call for 
broad legislation.
    Thank you, sir. I would be happy to answer questions later.
    [The prepared statement of Commissioner Swindle follows:]

        Prepared Statement of Hon. Orson Swindle, Commissioner, 
                        Federal Trade Commission

    Mr. Chairman and Members of the Committee, I am Orson Swindle, a 
Commissioner of the Federal Trade Commission. I appreciate the chance 
to testify today on the issue of online privacy.\1\
---------------------------------------------------------------------------
    \1\ My oral testimony and any responses to questions you may have 
reflect my own views and are not necessarily the views of the 
Commission or any other Commissioner.
---------------------------------------------------------------------------
    I have dissented from the Commission's embarrassingly flawed 
Privacy Report and its conclusory--yet sweeping--legislative 
recommendation. In an unwarranted reversal of its earlier acceptance of 
a self-regulatory approach, a majority of the Commission has 
recommended that Congress require all commercial consumer-oriented Web 
sites that collect personal identifying information from consumers to 
adopt government-prescribed versions of four fair information practice 
principles (``FIPPs''): Notice, Choice, Access, and Security.\2\ The 
majority has abandoned a self-regulatory approach in favor of extensive 
government regulation, despite continued progress in self-regulation.
---------------------------------------------------------------------------
    \2\ While this is a reversal for the Commission, Commissioner 
Anthony has consistently preferred a legislative approach. See 
Statement of Commissioner Sheila F. Anthony, Concurring in Part and 
Dissenting in Part, Self-Regulation and Privacy Online (July 1999), 
available at /www.ftc.gov/os/1999/9907/index.htm#13>.
---------------------------------------------------------------------------
    Why has the majority of the Commission decided to discontinue 
relying on self-regulation? The fundamental rationale given is that not 
enough Web sites are providing the type of privacy protections that the 
Commission has decided should be provided, and this is hindering and 
will continue to hinder the growth of e-commerce. The available data do 
not support this rationale. The 2000 Survey shows that 88% of all 
commercial Web sites (100% of the most popular sites) displayed at 
least one privacy disclosure to consumers, up from a mere 14% of all 
sites (71% of the most popular sites) in 1998. (Privacy Report [``PR''] 
at 10, Appendix C, Table 2a). Thus, online companies are by and large 
providing notice to consumers as to their privacy policies, and 
consumers can choose whether to deal with these companies based on 
their privacy policies. For those who believe that allowing consumers 
to make their own choices is the fundamental objective, the results of 
the 2000 Survey are very encouraging, although more work certainly 
needs to be done by industry.
    Instead of focusing on consumers' increasing ability to make 
choices concerning online privacy protections, the majority emphasizes 
that the 2000 Survey reveals that only 20% of all commercial Web sites 
(42% of the most popular sites) meet the full FIPPS requirements. (PR 
Appendix C, Table 4). But the main reason for this relatively low 
percentage is that commercial Web sites have not disclosed to consumers 
whether they provide access and security. This failure to disclose is 
not surprising, given the access and security implementation 
difficulties recently identified by the Advisory Committee on Access 
and Security.\3\
---------------------------------------------------------------------------
    \3\ In 1999, the Commission established an Advisory Committee on 
Online Access and Security to provide advice and recommendations to the 
Commission regarding implementation of reasonable access and adequate 
security by domestic commercial Web sites. That Committee provided the 
final version of its report to the Commission on May 15, 2000, 
describing options for implementing reasonable access to, and adequate 
security for, personal information collected online and the costs and 
benefits of each option.
---------------------------------------------------------------------------
    In this regard, it is important to emphasize that the 2000 Survey 
did not attempt to measure whether sites actually provide Access and 
Security; rather, it gauged only whether disclosures addressed these 
issues. And the 2000 Survey certainly did not give any credit for ``No 
Access,'' even though the majority indicates it might consider no 
access to be ``reasonable Access'' in some instances.
    If these access and security disclosure requirements are 
eliminated, the percentage of all Web sites meeting the FIPPS 
requirements rises significantly to 41% of all commercial Web sites 
(60% of the most popular sites). But even this 41% figure is 
understated because it uses a strained definition of ``choice'' that is 
more accurately described as ``Mandated Choice.'' Specifically, the 
2000 Survey gave credit for choice only when a Web site (1) gave the 
consumer a chance to agree to or to authorize communications back to 
the consumer from the Web site and (2) gave the consumer a chance to 
agree to or authorize disclosure of the consumer's information to third 
parties. The Report's recommendation that ``choice'' be legislated does 
not mean the kind of choice that informed consumers exercise in a 
marketplace once they know the terms on which they are dealing with 
retailers. That is real choice. Instead, the majority has recommended 
Mandated Choice that would require Web sites to continue to do business 
with consumers who do not agree to the uses the site tells them it will 
make of their personal information. For sites whose business depends on 
the use of information to provide consumers with discounts or to reduce 
the cost of services to consumers, the effect of Mandated Choice may be 
to mandate their exit from the marketplace or at least the reduction of 
the choices or products and services now available. Thus, in the name 
of Mandated Choice, consumers would have less choice.
    Not satisfied with the self-regulation's very encouraging progress 
concerning privacy policy notices and its solid progress with regard to 
Mandated Choice, the majority recommends that the Congress impose a 
legislative solution. Legislation could limit consumer choices and 
provide a disincentive for the development of further technological 
solutions. Government regulation may actually give consumers fewer 
choices and, as technology changes, less privacy. Legislation should be 
reserved for problems that the market cannot fix on its own and should 
not be adopted without consideration of the problems legislation may 
create by, for example, imposing costs or other unintended consequences 
that could severely stifle the thriving New Economy.
    The majority has recommended that Congress give rulemaking 
authority to an ``implementing agency'' (presumably the Commission) to 
define the proposed legislative requirements. In my judgment, however, 
the Commission owes it to Congress--and to the public--to comment more 
specifically on what it has in mind before it recommends legislation 
that requires all consumer-oriented commercial Web sites to comply with 
breathtakingly broad laws whose details will be filled in later during 
the rulemaking process.
    The Privacy Report is devoid of any consideration of the costs of 
legislation in comparison to the asserted benefits of enhancing 
consumer confidence and allowing electronic commerce to reach its full 
potential. Instead, it relies on skewed descriptions of the results of 
the Commission's 2000 Survey and studies showing consumer concern about 
privacy as the basis for a remarkably broad legislative recommendation. 
It does not consider whether legislation will address consumer 
confidence problems and why legislation is preferable to alternative 
approaches that rely on market forces, industry efforts, and 
enforcement of existing laws.
    For the sake of time, I will not cover my entire dissent, but I 
would like to draw your attention to additional points that it makes:

   the Report does not adequately credit self-regulatory 
        efforts and ignores developments in technology;

   the 2000 Survey provides a unique baseline for measuring the 
        quality of privacy disclosures;

   individual FIPPS are widespread;

   measuring success on the basis of full FIPPs is irrational;

   equating self-regulatory enforcement with the prevalence of 
        seal programs is misleading;

   the Report confirms the exponential growth in online 
        commerce but misuses consumer confidence surveys and lost sales 
        projections;

   the meaning of surveys showing consumer unease is unclear; 
        and

   the Report ignores or glosses over Constitutional issues, 
        enforcement difficulties, and questions relating to the 
        protection of offline privacy.

    In conclusion, the Privacy Report fails to pose and to answer basic 
questions that all regulators and lawmakers should consider before 
embarking on extensive regulation that could throttle the New Economy. 
Shockingly, there is absolutely no consideration of the costs and 
benefits of regulation; nor of regulation's predictable and 
unanticipated effects on competition and consumer choice; \4\ nor of 
the experience to date with government regulation of privacy; nor of 
Constitutional issues; nor of how this vague and vast mandate will be 
enforced.
---------------------------------------------------------------------------
    \4\ I note that the regulations promulgated to implement the 
Children's Online Privacy Protection Act (``COPPA''), 15 U.S.C. 
Sec. 6501 et seq., require detailed Notice; Access, including the 
ability to review, correct, and delete information maintained by the 
site; and a form of opt-in mandated Choice (verifiable parental 
consent). 16 C.F.R. Sec. Sec. 312.4, 312.6(a)(1), 312.6(a)(2), 
312.5(a), 312.5(b). The regulations went into effect on April 21, 2000, 
and already press reports state that some small online companies have 
stopped providing services to children because implementation of 
COPPA's requirements is too costly. See, e.g., ``New Children's Privacy 
Rules Pose Obstacles for Some Sites,'' The Wall Street Journal at B-8 
(April 24, 2000) (reporting one attorney's estimate that it will cost 
her clients between $60,000 and $100,000 annually to meet COPPA 
standards); ``New privacy act spurs Web sites to oust children,'' 
William Glanz, The Washington Times (April 20, 2000), available at 
/www.washtimes.com/business/default-2000420233432.htm>. See also 
``COPPA Lets Steam out of Thomas,'' Declan McCullagh, Wired News (May 
16, 2000), available at /1/http://www.wired.com/news/
politics/0,1283,36325,00.html>.
---------------------------------------------------------------------------
    Industry self-regulation is working. Effective privacy protection 
is more than a numbers game, and the private sector is continuing to 
address consumer concerns about privacy because it is in industry's 
interest to do so. Let us not make the search for the perfect the enemy 
of the good. The best way to build consumer trust and to ensure the 
continued growth of the Internet is through a combination of education, 
strong industry self-regulation, and strong FTC enforcement under 
existing legal authority. It is premature and counterproductive for the 
Commission to radically change course and call for broad legislation.

    The Chairman. Thank you.
    Commissioner Thompson.

            STATEMENT OF HON. MOZELLE W. THOMPSON, 
             COMMISSIONER, FEDERAL TRADE COMMISSION

    Mr. Thompson. Thank you, Mr. Chairman. Good morning to you 
and members of the Committee. I wanted to thank you for 
inviting me to appear before you again with my fellow 
Commissioners to address our most recent report on online 
privacy.
    In 1997 when we began to look at the issue of privacy on 
the Internet, consumer-based electronic commerce was largely 
viewed as a place for the most adventurous and technologically 
savvy. But at the same time, people with vision viewed the 
Internet as a place that could potentially transform the 
American consumer marketplace by empowering consumers with 
access to vast quantities of information and new goods and 
services.
    Since then we have witnessed great progress in achieving 
that transformation. Yet we still have a long way to go until 
Americans fully embrace the Internet and accept its technology 
as integral parts of their daily lives. Today industry, 
government, and consumers alike share a common goal of making 
the Internet as meaningful and productive for those at the 
center of the market bell curve, namely the family in the 
suburbs of Canton, Ohio, as it is for the technologist in 
Silicon Valley.
    To achieve this goal, we must be led by the voice of users 
and allow the Internet to become consumer-driven. From the 
beginning of the Commission's work, consumers have expressed a 
great concern about privacy of their personal information on 
the Internet, and industry has focused its attention on 
attracting the core of American consumers. The concern that the 
public has about privacy has only grown louder, so today the 
issue of data privacy has become a litmus for consumer 
confidence in the online marketplace.
    Back in December 1998, I told industry that we were at a 
critical juncture, one where industry is asked to self-regulate 
at the behest of government and public trust. This choice, 
while daunting, provides an exciting and unprecedented 
opportunity for industry to take the lead in shaping public 
policy for this important new medium. Consumers are expecting 
that industry and government will work together to find new and 
better ways to make the Internet safe, inspire consumer 
confidence, and preserve the innovative spirit of e-commerce. 
But the failure of industry to meet this challenge will not 
only have a negative effect on the future of e-commerce, but 
also on the public's confidence in industry's ability to take 
the lead in solving important public policy problems.
    To its credit, the most responsible segments of the online 
economy recognized the importance of data privacy, both from 
the public policy standpoint and as a test of their own 
accountability.
    The Chairman. Commissioner Thompson, could you summarize.
    Commissioner Thompson. OK.
    I think that we are at a critical juncture here. I think 
that what we are trying to do is propose a model that is not 
heavy-handed legislation, but provides a means for what some 
people term as co-regulation. That puts industry in the 
forefront.
    But the problem of Internet privacy may indeed be larger 
than what we originally envisioned. Industry has a very 
important role as the lead, but there are holes in the Swiss 
cheese. A legislative backdrop allows us to get at those holes. 
You see them in our report when we talk about the quality of 
what is being provided, and still parts of the Internet 
industry that are not doing anything at all. Those need 
attention, and we think it is a critical issue for consumer 
confidence.
    Thank you.
    [The prepared statement of Commissioner Thompson follows:]

     Prepared Statement of Hon. Mozelle W. Thompson, Commissioner, 
                        Federal Trade Commission

    In 1997 when the FTC began looking at the issue of privacy on the 
Internet, consumer-based electronic commerce was largely viewed as a 
place only for the adventurous and technologically savvy. At the same 
time, however, many also viewed the Internet as a place that could 
potentially transform the American consumer marketplace by empowering 
consumers with access to vast quantities of information, as well as 
goods and services. Since then, we have indeed witnessed great progress 
in achieving that transformation; yet, we still have a long way to go 
until Americans fully embrace the Internet and accept its technology as 
integral parts of their daily lives. Today, industry, government and 
consumers alike share the common goal of making the Internet as 
meaningful and productive for those Americans at the center of the 
market bell curve--the family in the suburb of Canton, Ohio--as it is 
for the technologist in Silicon Valley. To achieve this goal, we must 
be led by the voice of users and allow the Internet to become 
``consumer driven.''
    From the beginning of the Commission's Internet work, consumers 
have expressed strong concern about the privacy of their personal 
information on the Internet. And as industry has focused its attention 
on attracting the core of American consumers, public concern about 
privacy has only grown louder so that today, the issue of data privacy 
has become a litmus for consumer confidence in the online marketplace.
    In December 1998, I stated:

        [W]e are all at a critical juncture, a point where industry is 
        asked to self-regulate at the behest of government and public 
        trust. This choice, while daunting, presents an exciting and 
        unprecedented opportunity for industry to take the lead in 
        shaping public policy for this important new medium. Consumers 
        are expecting that industry and government will work together 
        to find new and better ways to make the Internet safe, inspire 
        consumer confidence, and preserve the innovative spirit of e-
        commerce. But, the failure of industry to meet this challenge 
        will not only have a negative effect on the future of e-
        commerce, but also on the public's confidence in industry's 
        ability to take the lead in solving important public policy 
        problems.\1\
---------------------------------------------------------------------------
    \1\December 1, 1998, ``Managing the Privacy Revolution `98,'' 
Remarks Before the 4th Annual National Conference on Privacy & American 
Business.

    To its credit, the most responsible segment of the online economy 
recognized the importance of the data privacy issue--both from a public 
policy standpoint as a test of the technology industry's 
accountability, as well as from a consumer confidence perspective as a 
test of industry responsiveness to consumer demand. As a result, the 
industry leaders have worked with the Commission and consumer groups to 
provide the market with seal programs, privacy policies and consumer 
and business education initiatives designed to address the public 
policy and business challenge posed by the issue of Internet privacy. 
Furthermore, to date, government has appropriately put industry self-
regulatory efforts at the forefront of America's response to the 
privacy challenge. We recognize the important role that industry plays, 
and will continue to play, in defining good business practices in 
electronic commerce. After three years of Internet surveys, public 
workshops, hearings and reports, however, it has become evident that 
the public policy challenge posed by the issue of Internet privacy may 
indeed be larger than any one segment--industry, government or 
consumers--can address alone.
    People in the Internet community are fond of stating that one 
Internet year is equivalent to three calendar years. The Commission has 
carefully and cautiously waited over three Internet years before 
recommending legislative action. During that time, government, industry 
and consumers have all learned much more about the substantial 
challenge involved with providing online privacy. In recognition of 
this complexity and the importance of Internet privacy as a threshold 
issue for the future growth of electronic commerce, I believe that now 
is the appropriate time for well-crafted legislation.
    In July 1999, I testified before the Senate Commerce Committee 
where I cautioned that industry faced a formidable challenge in 
achieving effective self-regulation of Internet privacy. I stated that:

        During the past year, industry leaders have expended 
        substantial effort to build self-regulatory programs. However, 
        I believe that we will not progress further unless industry 
        acts on the specific shortcomings that our report documents. 
        Congress and the Administration should not foreclose the 
        possibility of legislative and regulatory action if we cannot 
        make swift and significant additional progress.\2\
---------------------------------------------------------------------------
    \2\ July 13, 1999, Statement of Commissioner Mozelle W. Thompson in 
support of ``Self-Regulation and Privacy Online,'' FTC Report to 
Congress.

    Based upon what I perceived as real progress by industry in having 
a greater number of Web sites bearing a privacy disclosure, I was 
willing to withhold calling for legislative action to give industry 
further opportunities to: (1) maximize privacy coverage by reaching out 
to spur non-participating companies to adopt and implement effective 
privacy policies; and, (2) to significantly improve the quality of 
privacy protections by encouraging participating companies to embrace 
and implement what the Commission, the Organization for Economic 
Cooperation and Development and industry groups themselves (See e.g. 
Privacy Principles of the Online Privacy Alliance) have long recognized 
as the fair information principles of notice, choice, access, security 
and enforcement.
    Now, three years after the Commission submitted its initial report 
to Congress and a year-and-a-half after I posed a direct policy 
challenge to industry, our most recent survey shows that the quality of 
privacy protections that even the most responsible sites provide, is 
far from adequate. In fact, our survey shows that forty percent of the 
most popular (and presumably most sophisticated and responsible) Web 
sites still do not provide consumers with adequate notice and choice--
the most fundamental elements for any privacy policy. I believe these 
results are especially disappointing because they demonstrate 
substantial deficiencies in providing what most industry leaders agree 
should serve as the bedrock of privacy self-regulatory efforts.
    So where does that leave us? Based not only on our 2000 Survey 
results but also our three years of working interactively with everyone 
interested in the online privacy issue, a majority of the Commission 
has concluded that Federal legislation is now appropriate because:

        [S]elf-regulatory initiatives to date fall short of broad-based 
        implementation of effective self-regulatory programs, . . . 
        [and] that such efforts alone cannot ensure that the online 
        marketplace as a whole will emulate the standards adopted by 
        industry leaders.\3\
---------------------------------------------------------------------------
    \3\ May 2000, Privacy Online: Fair Information Practices in the 
Electronic Marketplace, at 35.

    In making my recommendation, I believe that appropriate legislation 
should not be viewed as a substitute for well-crafted industry self-
regulatory programs. This point is particularly important because 
industry self-policing could ultimately provide the public with 
consumer-driven privacy responses. Instead, legislation incorporating 
directed rule-making and safe-harbors should provide a principled 
backstop for effective industry efforts. Thus, if basic privacy 
principles and industry self-regulation define the ``Swiss cheese'' of 
online privacy, the Children's Online Privacy Protection Act and our 
legislative recommendation should be viewed as a means of addressing 
the holes in the cheese.
    I believe the Commission's recommendation is also consistent with 
my view of the cautious, balanced and responsible approach government 
should take in the fast-moving Internet environment. Our recommendation 
incorporates the principles of interactivity, flexibility and 
innovation. Through safe-harbors and a rulemaking process, government 
will interact with consumers and industry to implement appropriate 
solutions to this important public policy problem. Moreover, by 
recommending legislation that ``would set forth a basic level of 
privacy protection for consumer-oriented Web sites [and providing] an 
implementing agency with the authority to promulgate more detailed 
standards,'' \4\ government would avoid an inflexible ``one size fits 
all'' approach that would preclude recognition that consumers vary 
their view of privacy obligations depending on how they believe their 
personal information is being used. Finally, by recommending a 
rulemaking process, it is possible to encourage, and over time 
incorporate, technological innovation that can provide consumers with 
better tools to protect their own privacy.
---------------------------------------------------------------------------
    \4\ May 2000, Privacy Online: Fair Information Practices in the 
Electronic Marketplace, at 
iii-iv.
---------------------------------------------------------------------------
    Accordingly, I strongly support the recommendations contained in 
the Commission's May 2000 Report, Privacy Online: Fair Information 
Practices in the Electronic Marketplace.

    The Chairman. Thank you very much, Commissioner Thompson. 
As I mentioned, your complete statement will be made part of 
the record, which I read and I appreciate.
    Commissioner Leary.

       STATEMENT OF HON. THOMAS B. LEARY, COMMISSIONER, 
                    FEDERAL TRADE COMMISSION

    Mr. Leary. Mr. Chairman, members of the Committee: You have 
my concurring and dissenting statement and, in the interest of 
time, I would just like to summarize and start with the areas 
where I think we have broad agreement.
    There is a dramatic increase in the number of companies 
that publicly address privacy one way or the other, but the 
quality of disclosures varies widely. Too many are confusing, 
if not misleading, and I think that the examples that 
Commissioner Anthony has cited for you speak for themselves. 
More widespread disclosures of this kind could actually do more 
harm than good. Therefore, I agree with some members of this 
Committee and with the Commission majority that both business 
and consumers would benefit from better disclosures.
    There also seems to be broad agreement that any legislation 
to address privacy concerns should ultimately apply in the same 
way to both the online and the offline worlds to the extent the 
information is the same. There are special capabilities in the 
online world, which may require special attention, but there is 
no reasonable basis for treating information that is collected 
about my purchases on Amazon.com any differently from my 
purchases at Borders. I think that we have a consensus on that.
    There seems to be some difference on the issue of timing 
and some question as to whether the Commission has enough 
expertise to recommend broad-based legislation to you because 
we have studied the Internet only. We have had a lot of 
experience in privacy issues in the offline world as well, 
Senators, and if there are any doubts about the issue you have 
the capability yourselves to investigate and satisfy yourselves 
that when the information is the same there should be an equal 
playing field between the online and the offline worlds.
    Finally, I would say that I think we all generally 
recognize that once you get past the issue of notice and 
disclosure the further elements of the so-called fair 
information practices become progressively more complicated. 
There is an even more compelling reason for treating them 
differently than notice or disclosure. I agree with those 
members of this Committee who state that ultimately adequately 
informed consumers should be able to select for themselves the 
level of privacy protection they want and may be willing to pay 
for either directly or by foregoing some benefit.
    It is not fair to allow consumers who are particularly 
solicitous about particular elements of privacy and want broad 
access and broad ability to correct, and so on, to impose costs 
on those consumers who do not care. So I urge you to consider 
whether or not the market, as it does in so many other areas of 
our life, will not work better ultimately than government 
regulation.
    There may be certain special categories of information or 
special uses, like health information or financial information, 
that require special treatment in both the online and the 
offline worlds. But they should not be part of a broad privacy 
policy imposed on the Internet alone.
    Finally, I would just like to say that I think it is in all 
of our interest to continue to encourage the self-regulatory 
schemes which are under way and which I believe ultimately hold 
tremendous promise for improving performance in this industry 
in a market-based fashion.
    Thank you.
    [The prepared statement of Commissioner Leary follows:]

       Prepared Statement of Hon. Thomas B. Leary, Commissioner, 
                        Federal Trade Commission

    Today the Federal Trade Commission recommends that Congress enact 
legislation to help consumers protect their privacy when transacting 
business on the Internet. I agree that some legislation is appropriate, 
but believe that the recommendation in the Report endorsed by a 
majority is too broad in one respect and too narrow in another. The 
recommendation is too broad because it suggests the need for across-
the-board substantive standards when, in most cases, clear and 
conspicuous notice alone should be sufficient. The recommendation is 
too narrow because any legislation should apply to offline commerce as 
well.
    The Report's recommendation is based, in part, on our common belief 
that the Internet has enormous potential to grow our economy; that this 
potential is inhibited to some degree by consumers' concerns about 
their privacy; and that it is an appropriate policy objective to 
address these concerns and encourage growth. So far, so good. The 
issue, then, is how best to address these privacy concerns in an 
evenhanded way. If the Internet is subjected to requirements that do 
not apply pro tanto to offline commerce, the regulatory imbalance could 
itself inhibit the growth of the Internet and undercut our common 
objective.
    We also agree unanimously that, whatever government does or does 
not do, the private sector will have an important role to play. The 
majority looks at the 2000 Web Survey data and concludes that the 
private sector has failed to address privacy concerns rapidly enough. I 
am not convinced that the Survey supports this conclusion, but agree, 
for other reasons, that some legally mandated privacy protections would 
be appropriate.
    The Survey does not necessarily demonstrate that the market has 
failed to respond to consumer demand. It only measures ``inputs,'' the 
prevalence of privacy policies of various kinds; it does not measure 
``outputs,'' the impact that these policies have on consumer confidence 
and consumer behavior. The Survey numbers could be read to support 
alternative scenarios. For example, the most popular sites generally 
have more comprehensive disclosures, and this could mean that some 
consumers favor them because of the disclosures. The fact that gains 
are modest overall, however, may also indicate that consumers are not 
quite as fixated on privacy issues as might appear from the public 
opinion polls cited in the Report. Marketers generally know more about 
consumer demand than regulators do.
    Marketers know, for example, that consumers' actual buying habits 
are not necessarily consistent with their expressed preferences. Their 
stated interest in various ancillary protections like privacy may fade 
or become more nuanced, once they learn more about them and realize 
that there are costs attached. Consumer opinion on privacy issues 
appears to be a complex subject,\1\ and public opinion polls simply do 
not provide an adequate predicate for a legislative recommendation of 
the scope contained in the Report.
---------------------------------------------------------------------------
    \1\ Jupiter Communications, Proactive Online Privacy: Scripting An 
Informed Dialogue to Allay Consumers' Fears, at 3-7 (June 1999).
---------------------------------------------------------------------------
There Is a Need for Better Disclosures
    There is one aspect of the 2000 Web Survey, however, that I find 
particularly disturbing. The Survey results do show a steadily rising 
trend in the number of companies that address privacy, one way or 
another, but we cannot therefore conclude that consumers are better 
informed today or would be even better informed if the numbers rose 
even further. In fact, a site's mere mention of privacy may lead to a 
misperception that the consumer's privacy is well-protected, and a 
plethora of varying and inconsistent privacy claims could add to 
consumer confusion. The Survey tells us that the scope of the 
disclosures varies widely (see Privacy Online: Fair Information 
Practices in the Electronic Marketplace: A Report to Congress 
(``Report'') at 38-44) and, in my view, vendors and their customers 
would both benefit from a legislative initiative to require disclosures 
of greater clarity and comparability.
    Market processes, supplemented by traditional remedies against 
consumer deception, should ultimately provide the most appropriate mix 
of disclosures and substantive protections, but these forces sometimes 
work slowly and I am convinced that privacy concerns have some special 
characteristics that make it prudent to prompt the market to work more 
rapidly. Some standardization of the disclosures would allow consumers 
to compare more easily the privacy practices of different vendors. As 
we learned when considering environmental marketing claims, for 
example,\2\ varied and inconsistent claims lead to consumer confusion. 
Consumers may not be able to recognize valid and invalid comparisons 
when they are dealing with unfamiliar concepts. When terms have uniform 
meaning and basic equivalent information is disclosed for each site, 
the marketplace should work more efficiently.
---------------------------------------------------------------------------
    \2\ See Guides for the Use of Environmental Marketing Claims (the 
``Green Guides''), 16 C.F.R. pt. 260 (1999). When the Commission 
requested public comment on these Guides three years later, 
commentators generally agreed that they benefit both consumers and 
industry, inter alia, by promoting consistency and accuracy in claims, 
helping consumers to make accurate decisions, and thereby bolstering 
consumer confidence. See Guides for the Use of Environmental Marketing 
Claims, Final Rule, 61 Fed. Reg. 53,311 (1996).
---------------------------------------------------------------------------
    Although consumers' knowledge and understanding of these issues is 
steadily increasing, it still has a long way to go. Not only is the 
Internet a recent invention, consumers are just beginning to become 
aware of the potential for data collection both online and offline. 
Consumers still do not know much about the possible uses of their 
personal information (and new ones are invented every day), the 
ramifications of permitting its use, and the costs associated with 
limiting its dissemination. Because an efficient market presupposes 
full and accurate information, it is appropriate to mandate more 
extensive privacy disclosures.
    Privacy concerns also differ from concerns about product attributes 
that consumers may value. An uninformed decision to deal with a vendor 
that disseminates personal information could have ramifications for 
years to come, and that decision cannot be retracted. The marketplace 
may ultimately discipline the less-than-candid vendor, but the 
potential consumer harm will continue because the personal information 
may have spread and cannot be retrieved. The privacy loss and 
consequent harm results from mere participation in the market, with 
insufficient notice, not from a bad purchase decision. By contrast, if 
consumers are uninformed about particular product attributes, and 
regret the purchase, the damage may at most be limited to the value of 
the purchase.\3\
---------------------------------------------------------------------------
    \3\ This limitation may not apply to products that are hazardous to 
health and safety, and this is one reason why there are also 
affirmative disclosure requirements to deal with these risks.
---------------------------------------------------------------------------
    I therefore agree with the Report insofar as it recommends a 
legislative prod to ensure better disclosures. Thereafter, I part 
company.

The Report's Proposal Is Too Broad
    The Report's recommendation is framed around the so-called ``fair 
information practices'' of notice, choice, access, and security. 
Notwithstanding references to the need for flexibility (see, e.g., 
Report at 60-61), the overall thrust of the Report is that any privacy 
policy should, at a minimum, recognize substantive consumer rights in 
each of these areas. What the Report does not do is adequately explain 
why.
    In addition to its expertise on consumer disclosures, the 
Commission is supposed to have some expertise in the operation of 
competitive markets--when they are likely to succeed and when they are 
likely to fail. The Report does not explain why an adequately informed 
body of consumers cannot discipline the marketplace to provide an 
appropriate mix of substantive privacy provisions. These are matters 
that Congress can and should investigate on its own, but our Report 
does not provide any help. It is one thing to recognize that the fair 
information practices (beyond adequate notice) are laudable goals and 
to encourage their adoption by various self-certifying industry groups. 
These certifying programs can make a valuable contribution by 
reinforcing consumers' confidence and reducing consumer costs of 
obtaining information. It is quite another thing to urge that the 
practices, in one form or another, be mandated by legislation and by 
rules.\4\
---------------------------------------------------------------------------
    \4\ I acknowledge that previous Commission reports to Congress, 
which advocated a ``wait and see'' policy, have suggested that 
legislation could be appropriate if the fair information practices were 
not more broadly adopted. I would not have endorsed that aspect of the 
previous reports either, had I been here.
---------------------------------------------------------------------------
    When the Commission issued the Green Guides, it expressly 
disclaimed any authority or intention to achieve a substantive result:

        The Commission does not have a statutory mandate to set 
        environmental policy. It is not the Commission's goal, for 
        example, to require that product [sic] be ``recyclable.'' 
        Rather, any Commission cases, rules, or guides would be 
        designed to address how such terms may be used in a non-
        deceptive fashion in light of consumer understanding of the 
        terms.\5\
---------------------------------------------------------------------------
    \5\ Request for Public Comments on Issues Concerning Environmental 
Marketing and Advertising Claims and Pending Petitions, 56 Fed. Reg. 
24,968 (1991).

These disclosure-oriented guides did have a substantive effect; later 
public comments indicated that they did ``encourage manufacturers to 
improve the environmental characteristics of their products and 
packaging,'' while ``allowing flexibility for manufacturers to improve 
the environmental attributes of their products and to communicate these 
improvements to consumers.'' \6\ Better information did lead to a 
better market outcome. In my view, we should follow the precedent of 
the Green Guides, and not request the authority to issue substantive 
standards.
---------------------------------------------------------------------------
    \6\ Guides for the Use of Environmental Marketing Claims, Final 
Rule, 61 Fed. Reg. 53,311, 53,313 (1996).
---------------------------------------------------------------------------
    The fact that the fair information practices have been favorably 
regarded in the regulatory community for almost thirty years (Report at 
8-9), does not justify mandatory legislation. A provenance from the 
1970s is scant cause for comfort, because government regulators, here 
and throughout the world, had much less faith in free market 
institutions then than they have today.\7\ Moreover, it cannot be 
claimed that the fair information practices are ``widely-accepted'' in 
the business community (Report at 8). Our own Survey of the Internet 
world demonstrates the contrary, and there is no indication that the 
principles are widely accepted in the offline world either. I would not 
be so quick to conclude that we are right and so many others are 
wrong.\8\
---------------------------------------------------------------------------
    \7\ See, e.g., Daniel Yergin and Joseph Stanislaw, The Commanding 
Heights: The Battle Between Government and the Marketplace that is 
Remaking the Modern World (1998).
    \8\ The Commission's own Internet privacy policy, which can be 
readily accessed by a click on the Commission's home page, provides 
notice only. The Commission does protect consumer privacy. It complies 
with the Privacy Act of 1974, a statute that applies fair information 
practice principles to the federal government's collection and use of 
information. 5 U.S.C. Sec. Sec. 552a et seq. However, the Commission's 
privacy policy does not provide information about choice, access or 
security measures.
---------------------------------------------------------------------------
    The Report not only fails to explain why adequate disclosures are 
insufficient, it passes too lightly over issues of complexity. Granted, 
these are issues more appropriately addressed in a rule-making 
proceeding, but Congress needs to have a better understanding of what 
we mean when we ask for authority to set ``reasonable'' standards. For 
example, the Report recognizes that ``access'' is a complicated matter 
and indicates that any determination of what is ``reasonable'' should 
be informed by the discussion of the Advisory Committee on Access and 
Security (Report at 30-31, 61). At the same time, however, the Report 
endorsed by the majority states flatly that ``the Commission believes 
that fair information practices require that consumers be afforded both 
an opportunity to review information and an opportunity to contest the 
data's accuracy or completeness--i.e., to correct or delete the data.'' 
(Report at 32). This is an extraordinarily broad claim, which could in 
many cases lead to vast expense for trivial benefit and which provides 
an ominous portent for the content of any substantive rules.
    Even ``choice,'' which at first glance seems only a natural 
corollary of ``notice'' is a complicated subject. The Report 
recognizes, for example, that it may be appropriate to provide 
affirmative benefits if a consumer agrees to certain personal 
disclosures (Report at 61). If the collection of data is one thing that 
makes it possible for a vendor to offer lower prices, consumers who are 
particularly tender of privacy would otherwise be able to free ride on 
the value created by those who are not. (If a supermarket issues a card 
that offers discounts to people who use it, in exchange for compilation 
of useful data, consumer ``choice'' surely does not involve the right 
to get the discount without supplying the data.\9\)
---------------------------------------------------------------------------
    \9\ This use of an offline example is deliberate because the logic 
is not dependent on the mode of collection. See discussion, infra pp. 
10-12.
---------------------------------------------------------------------------
    On the other hand, if the premium for permission to use information 
is too generous, or the penalty for refusal too severe, consumer 
``choice'' really involves nothing more than the ``choice'' to refuse 
dealings with the vendor. The issue of what is or is not a reasonable 
price differential is complicated, but may be too difficult to bother 
with in a situation where a particular vendor competes with a number of 
others that have their own policies. Does this mean that reasonableness 
should depend on the market power of the vendor?
    Other examples could be cited to illustrate the difficulties 
involved in fashioning substantive rules about choice, access and 
security, but there is no need to burden this statement further. 
Congress can, and should, explore these issues in detail if it takes up 
this aspect of the Report's legislative recommendation.
    I therefore believe that any across-the-board legislative mandate 
should be confined to notice alone, although disclosure rules might 
appropriately provide that notice include information about the other 
categories. In some cases, involving particular kinds of information or 
particular uses, the risk of harm may be so great that specific 
substantive standards are required. This is a legislative judgment. 
Congress can, and already does pass industry-specific legislation to 
deal with these situations.\10\ In addition, I believe it is entirely 
appropriate for the Commission to impose more specific restrictions as 
``fencing-in'' relief in a consent settlement, in order to discipline 
the future behavior of business entities that have misused consumer 
information in the past.
---------------------------------------------------------------------------
    \10\ Gramm-Leach-Bliley Act, 15 U.S.C. Sec. Sec. 6801 et seq.; 
Telecommunications Act of 1996, 47 U.S.C. Sec. Sec. 222 et seq.; Video 
Privacy Protection Act of 1988, 18 U.S.C. Sec. Sec. 2710 et seq.; Cable 
Communications Policy Act of 1984, 47 U.S.C. Sec. Sec. 551 et seq.; 
Fair Credit Reporting Act, 15 U.S.C. Sec. Sec. 1681 et seq.
---------------------------------------------------------------------------
    The Report does recognize (Report at 25) that notice is ``the most 
fundamental of the fair information practice principles,'' but it 
recognizes it for the wrong reason. Notice is not fundamental ``because 
it is a prerequisite to implementing other fair information practice 
principles, such as Choice or Access'' (Id.); it is fundamental because 
it helps the marketplace accurately to reflect consumer preferences 
with respect to the other principles. Consumers, so long as they are 
informed by clear and conspicuous disclosures, will be able to select 
the vendors that give them the privacy protections they want and are 
willing to pay for.

The Report's Proposal Is Too Narrow
    I also disagree with the Report's legislative recommendation to the 
extent that it treats issues of online privacy as wholly different from 
offline privacy. At times the Report acknowledges the existence of 
offline privacy concerns and the erosion of the distinction between 
online and offline commerce (Report at 8 n.26, 55 n.196), but it 
justifies special treatment of Internet privacy on the ground that the 
technology of the Internet has ``enhanced the ability of companies to 
collect, store, transfer and analyze vast amounts of data[.]'' (Report 
at 1).
    Of course, some privacy issues are particular to the Internet. This 
new technology has permitted uniquely invasive tracking of consumer 
preferences by recording not just purchases, but consumers' movements 
on the Internet as well. This practice of tracking, including third-
party profiling, may be particularly threatening and distasteful to 
many. (See Report at 37-38, discussing so-called ``cookies''). Any 
legislative or regulatory scheme can and should ensure that consumers 
are adequately informed about these Internet capabilities.
    However, the majority's recommendation is not focused on the 
special characteristics of e-commerce or on particular categories of 
sensitive information collected online. Instead, the majority would 
apply the fair information practice principles to any personal 
information collected by any commercial Web site, even though the 
identical information can be collected offline. The distinction between 
online and offline privacy is illogical, impractical and potentially 
harmful.\11\ Let me examine each of these points in turn.
---------------------------------------------------------------------------
    \11\ Chairman Pitofsky has expressed some of these views in one of 
his own speeches. See Robert Pitofsky, Electronic Commerce and Beyond: 
Challenges of the New Digital Age, Speech before the Woodrow Wilson 
Center, Sovereignty in the Digital Age Series, Washington, D.C. (Feb. 
10, 2000).
---------------------------------------------------------------------------
    Recognition of the privacy concerns specific to e-commerce should 
not obscure the fact that in significant respects online privacy 
concerns are identical to those raised by offline commerce. The same 
technology that facilitates the efficient compilation and dissemination 
of personal information by online companies also allows offline 
companies to amass, analyze and transfer vast amounts of consumers' 
personal information.\12\ Offline companies collect and compile 
information about consumers' purchases from grocery stores, pharmacies, 
retailers, and mail order companies, in particular.
---------------------------------------------------------------------------
    \12\ Abacus, a consortium of mail order companies, is a good 
example of the ability of merchants to compile and share detailed data 
about consumers' purchasing habits. See In re Trans Union, Docket No. 
9255 (Feb. 10, 2000), appeal docketed, No. 00-1141 (D.C. Cir. Apr. 4, 
2000).
---------------------------------------------------------------------------
    It is also not possible to distinguish offline and online privacy 
concerns on the basis of the nature of the information collected. With 
the exception of online profiling, it is the same information. The 
Report's recommendation would require Amazon.com to comply with the 
fair information practice principles but not the local bookstore which 
can compile and disseminate the same information about the reading 
habits of its customers. The consumer polls, upon which the Report 
places such significant reliance, demonstrate that consumer concerns 
about the disclosure of personal information are not dependent on how 
the data has been collected.\13\
---------------------------------------------------------------------------
    \13\ See IBM Multi-National Consumer Survey, prepared by Louis 
Harris Associates Inc., at 22-24 (October 1999).
---------------------------------------------------------------------------
    Moreover, it is impractical to maintain such a distinction. 
Businesses are likely to have a strong incentive to consolidate 
personal information collected, regardless of the mode of collection, 
in order to provide potential customers with the most personalized 
message possible. Already, companies are seeking to merge data 
collected offline with data collected online.\14\ In light of this 
reality, the majority's recommendation would result in perverse and 
arbitrary enforcement. Enforcement actions would depend on the source 
of and method used to collect a particular piece of consumer data 
rather than on whether there was a clear-cut violation of a company's 
announced privacy policy or mandated standards.
---------------------------------------------------------------------------
    \14\ Dana James, Synchronizing the Elements; Traditional Companies, 
Yearning to Catch Up on the Basics, Find Value in Merging Online, 
Offline Databases, Marketing News, Feb. 14, 2000, at 15.
---------------------------------------------------------------------------
    Finally, the Report's focus only on online privacy issues could 
ultimately have a detrimental impact on the growth of online commerce, 
directly contrary to the Report's objectives. It is clear from the 
Advisory Committee's Report on Access and Security and from limited 
portions of the Commission's own Report that implementation of the fair 
information practices will be complex and may create significant 
compliance costs. Online companies will be placed at a competitive 
disadvantage relative to their offline counterparts that are not forced 
to provide consumers with the substantive rights of notice, choice, 
access and security. Traditional brick and mortar companies that have 
an online presence or are considering entry into the electronic 
marketplace will be forced to assess how the cost of regulation will 
affect their participation in that sector.
    A better approach would be to establish a level playing field for 
online and offline competitors and to address consumers' privacy 
concerns through clear and conspicuous privacy disclosures. Any privacy 
concerns that are unique to a particular medium or that involve 
particular categories of information (however collected) can continue 
to be addressed through separate legislation.\15\
---------------------------------------------------------------------------
    \15\ See supra note 10.
---------------------------------------------------------------------------
    The Report's recommendation limits itself to online privacy for 
reasons that seem primarily historical. The Commission first looked at 
the online world at a public workshop in 1995, followed by subsequent 
workshops in 1996 and 1997. Then, starting in 1998, Commission staff 
conducted annual surveys of Internet sites and their privacy policies 
to measure in a rough way the state of industry self-regulation. Each 
survey has been reported to Congress. The Report's legislative 
recommendation flows from that series of surveys. The surveys have 
provided a lot of useful information, and undoubtedly spurred industry 
attention to online privacy issues, but the scope of these particular 
surveys should not dictate the parameters of a legislative proposal.
    The Commission has ample information available to support a broader 
recommendation, and Congress will have ample opportunity to develop its 
own legislative record. The fair information practices so frequently 
referenced in the Report were, after all, originally developed to 
address concerns regarding the collection of information offline. And 
the Commission itself has had significant exposure to offline privacy 
issues. For example, the Commission has enforced the Fair Credit 
Reporting Act since its enactment in 1970.\16\ This statute addresses 
consumer concerns about the collection and dissemination of sensitive 
data by credit bureaus. Although the Act predates the advent of the 
fair information practices, its provisions mandate some of these same 
requirements.\17\
---------------------------------------------------------------------------
    \16\ 15 U.S.C. Sec. Sec. 681 et seq.
    \17\ The Commission recently issued its decision in In re Trans 
Union, Docket No. 9255 (Feb. 10, 2000), appeal docketed, No. 00-1141 
(D.C. Cir. Apr. 4, 2000), an enforcement action concerning the 
dissemination by a credit bureau of certain information to target 
marketers. The decision considered not only the privacy implications of 
this practice but also the availability of other information collected 
offline.
---------------------------------------------------------------------------
    The Commission also undertook in 1997 a study of the ``look-up'' 
service industry, computerized database services that collect and sell 
consumers' identifying information. The workshop and subsequent report 
to Congress focused on the benefits of these services as well as the 
risks, including consumers' privacy concerns.\18\ Although the Internet 
increased access to these informational products, the information at 
issue was primarily collected offline. Finally, just last week, the 
Commission issued its final rule implementing the privacy provisions of 
the Gramm-Leach-Bliley Act, a rule that focuses on the treatment of 
consumer information by financial institutions--again without regard to 
how the information was collected.\19\
---------------------------------------------------------------------------
    \18\ See Individual Reference Services: A Federal Trade Commission 
Report to Congress (Dec. 1997).
    \19\ See Privacy of Consumer Financial Information, _ Fed. Reg._ 
(2000) (to be codified at 16 C.F.R. pt. 313).
---------------------------------------------------------------------------
    Even if the Commission majority, who endorse the Report, determined 
that our experience was insufficient to assess offline privacy 
concerns, a better course would have been to invite further 
Congressional inquiry. As it is, the Report's advocacy of legislation 
limited to the online world suggests that public remedies should be 
bounded by the scope of the studies we have chosen to conduct. This is 
thinking upside down.

Existing Remedies Should Be Actively Pursued
    Legislation to mandate more comprehensive and clear privacy 
disclosures should ensure in the long run that the marketplace provides 
consumers with their desired level of privacy protection. Legislation 
and rule-making may take considerable time, however, and in the interim 
some consumers may suffer long-lasting harm because they have not been 
adequately informed about privacy issues. In order to reduce these 
potential harms, I would recommend that the Commission take some 
immediate steps.
    First, the Commission should more actively employ its existing 
authority under Section 5 to prohibit unfair or deceptive practices. We 
can not only challenge outright violations of express privacy 
policies,\20\ but also challenge policies that deceive because they 
impliedly offer more protection than they deliver. As noted earlier, 
although the Survey results demonstrate an increase in the number of 
privacy disclosures, they also indicate that these disclosures often 
involve inconsistent or confusing claims. (Of course, enforcement 
actions should only be brought in cases of clear-cut deception, so that 
companies which attempt in good faith to provide information, up to now 
on a voluntary basis, would not be chilled from doing so.) Stepped-up 
enforcement in this area, as elsewhere, serves a double purpose: it 
addresses specific situations and sends a message both to consumers and 
businesses.
---------------------------------------------------------------------------
    \20\ See FTC v. ReverseAuction.com, Inc., No. 00-0032 (D.D.C. Jan. 
6, 2000); GeoCities, FTC Dkt. No. C-3849 (Feb. 12, 1999).
---------------------------------------------------------------------------
    Beyond this, the Commission should redouble its efforts to educate 
consumers directly about the benefits and potential risks associated 
with the collection and dissemination of their personal information. 
Without additional authorization, we can help consumers to better 
understand the meaning of various privacy disclosures. Informed 
consumers will ultimately be the most effective agents for protection 
of privacy, online and offline, by rewarding companies that offer the 
preferred levels of protection.

    The Chairman. Thank you very much, Commissioner.
    We have another panel and I know all of our members have 
questions, so I will just ask one. As has been pointed out, at 
least statistically it is fairly impressive the number of Web 
sites that offer privacy policies. But once you get into some 
of these so-called policies it gets somewhat interesting.
    In May, USA Today reviewed 10 major Web sites and found 
their policies to be a confusing jumble of incomprehensible 
language riddled with loopholes. Yahoo's policy, for instance, 
is eight pages long, and your survey finds that fewer than half 
of the sites had clearly worded procedures.
    One of the more controversial Web sites, Doubleclick, says 
that it would use personal information only with your 
``permission.'' It does not tell you that it assumes it has 
permission unless you explicitly opt out. And here is what you 
have to do: Read the first 1,468 words, click on a link to 
another page, read 650 more words that tell you why you should 
not opt out, read 200 more words urging you once again not to 
opt out, and click onto a final link to opt out of the program.
    That is not exactly privacy as some of us understand it. 
Now, I think this is a matter of real concern, particularly 
when we look at what Doubleclick was set up for. I wonder if, 
according to your report, as the numbers of Web sites that 
provide ``privacy protection'' are more like Doubleclick's than 
the kind of thing we assume that would allow us to ensure 
privacy.
    So I guess I would begin with Chairman Pitofsky and go 
through the witnesses, because I think this is a serious 
problem, for a Web site to advertise that it will protect your 
privacy and then have this kind of mumbo-jumbo. When Yahoo, 
which is one of the most respected and I believe the most used 
Web site, takes eight pages and 3,405 words and 167 sentences, 
that is not what we had in mind and I hope it is not your 
definition of a Web site that allows people to have their 
privacy ensured.
    We will begin with you, Commissioner Pitofsky, and we will 
go through in order of how the Commissioners spoke.
    Mr. Pitofsky. Mr. Chairman, I went through the same process 
with Doubleclick that you followed and I have to tell you, if I 
did not have somebody helping me I would never have found out 
how to get to the third and fourth screen in order to opt out.
    The Chairman. And you are a former university professor.
    Mr. Pitofsky. And I have been doing this consumer 
protection work for 30 years.
    I would have been lost somewhere between the third and the 
fourth screen. This example is extreme, but I tell you, it is 
not the only one. I saw one yesterday that was brought to my 
attention, the headline is: ``We protect your privacy. Read on 
and find out the terms.'' There are then ten single-spaced 
pages. Lawyers would have trouble reading it. When you get to 
the ninth page, you find out you have no rights at all. It is 
notice, I suppose, but it is a kind of notice that does not do 
consumers much good.
    But on the other hand, 60 percent of the Web sites have 
notice that we found was quite fair. The question is how you 
get from that 60 percent all the way to the end. Let me just 
repeat what I said: I am all for self-regulation, but if the 
self-regulators cannot say: if you fail to give better notice 
than that you violate our standards and we will refer you to 
some law enforcement agency, then I am afraid many of these Web 
sites who are fairly irresponsible are going to say: Well, why 
do I not keep making the money selling private identifiable 
information; so take my seal away from me; I will have to get 
along without it.
    I think there has to be a backup. Effective self-regulation 
in my experience almost always has that kind of backup of law.
    The Chairman. Did you see the Yahoo Web site?
    Mr. Pitofsky. I did not see that one.
    The Chairman. I am curious whether that would warrant a 
seal of approval. And I say that not in any bias for or against 
Yahoo, but the fact is it is the most popular Web site there 
is.
    Mr. Pitofsky. Let me check it out and I will get an answer 
for you.
    The Chairman. Thank you.
    Commissioner Swindle.
    Mr. Swindle. I will defer to Commissioner Anthony since she 
was second--OK, or I will continue.
    The Chairman. I am sorry. Commissioner Anthony, I am sorry. 
I apologize.
    Ms. Anthony. That is all right, Senator McCain.
    My view is that a uniform standardized notice setting forth 
in a simple manner, understandable and noncontradictory would 
be a good thing for consumers to reveal what exactly the Web 
site's practices are, and then have an opportunity to either 
opt in or opt out. If there is additional information that 
needs to be conveyed to the consumer, there could be 
interactive ``click-here'' links on a standardized uniform 
notice that could be utilized to further explain the policy.
    But I do not think consumers have any protections if the 
policy is so confusing that not even a university professor can 
understand it.
    The Chairman. Well, I will not comment on university 
professors.
    Commissioner Swindle.
    Mr. Swindle. Mr. Chairman, I think we all agree that these 
lengthy dissertations that we go through, they are so bad that 
we do not look at them. That is obviously counterproductive, 
and I think we can all agree that some form of reasonable 
English notice--and I do not want to get trapped into saying I 
am for English only here, since we have other people of other 
languages----
    The Chairman. How do we enforce that, then?
    Mr. Swindle. The enforcement of it, I think, comes from the 
Federal Trade Commission with its existing regulations. We had 
a case here a couple of years ago called Geocities. It is a 
very popular site. I personally have never visited it, but I 
will take the staff's word that it is very popular. They had a 
privacy statement and they said that, we will do certain 
things.
    We alleged that, contrary to what they said, they turned 
around and shared the information with a third party in some 
sense. They settled the case with us. However, once they posted 
the policy they then came under the umbrella of Section 5 of 
the Federal Trade Commission Act, and if they are deceiving 
their customers we have authority to do something.
    Now, our surveys, as has been reflected here in some of the 
numbers that are addressed today, indicate that something on 
the order of 90 percent of all Web sites have posted some form 
of notice. Now, if that notice was properly conveyed in a more 
simple manner than we are seeing now, to express what the site 
does in the way of collecting information and how it uses it, 
all those sites would be under the oversight of the Federal 
Trade Commission under the existing laws.
    I might point out that, even though we have a quantum leap 
in the number of sites that have these notices, we have only 
handled just a bare handful of cases in which we have 
challenged the practices that they are implementing, having 
stated what they do, such as in Geocities. But I think if we 
continue to expand the numbers of people who have notice, state 
their privacy policies, and we apply very close scrutiny on 
what they are doing, I think the effects of FTC action will 
have a positive effect on seeing more comply with it.
    The Chairman. Commissioner Thompson.
    Mr. Thompson. Mr. Chairman, I agree with you that--and you 
are talking about what we consider to be the good guys, because 
there are people out there who are saying nothing, and that we 
have very few tools to get at those people. One of the 
questions that some people raise is what is it that industry 
cannot fix on its own? As you may remember, last year I was 
here and I talked to you a little bit about coverage, and I 
said that there is a core group that you still cannot get to. 
They are still out there, and consumers deserve better.
    Second of all, there is also a benefit to having a level 
playing field here, so that there are not these wide 
disparities, so the consumers wind up taking a risk every time 
they go on the Internet.
    The reason I might disagree slightly with some of my 
colleagues about why online and why now, is because the 
Internet provides you with an opportunity. The Internet allows 
somebody to follow you around the shopping mall without your 
knowledge. It is a little bit different. And because it allows 
you to aggregate data and collect it on a real-time basis as 
you put it in, they get it and they use it, means something. So 
I think there is a slight difference.
    One other thing is that I understand that Forrester 
Research is coming out with a report today that is going to 
talk a little about this, about some of the pressures on 
businesses in the dot-com space that make it more advantageous 
to sell data. They need to do that for economic reasons, and 
the combination of hyper-partnering, meaning companies doing 
things with other companies, the pressure to get profits in 
that way may actually mean that you will see more of this 
occurring in the Internet space faster.
    The Chairman. Mr. Leary.
    Mr. Leary. Mr. Chairman, I agree with the majority here 
that there should be some legislation directing us to make 
rules to assure more consistent and more adequate disclosure. 
That is something we know how to do and we have done in other 
areas.
    I also agree with a somewhat different majority that you 
should have the same disclosures when you order by mail or when 
you open a charge account at your department store to the 
extent the information is exactly the same.
    Thank you.
    The Chairman. Senator Hollings has a question, and we have 
two votes on the floor and after that we will take a brief 
recess until we can return from the vote. Thank you. Senator 
Hollings.
    Senator Hollings. There is not any question that the 
offline should be regulated as online. We gave it to you to do 
just as you just said, Mr. Leary, that you promulgate rules and 
regulations for the offline as we have it for the online. 
Otherwise we have got the proposition, of course, that it is 
going to be more difficult each day that passes to ex post 
facto or retroactively do anything. We are into an environment 
where the best of the best--and I know Fred Yang and Yahoo and 
they are one of the best, and yet they give little notice. You 
can see the game that is going on.
    I feel like I am in a class where the professor is grading 
by way of a scale and everybody is cheating. I am going to have 
to cheat in order to pass, regardless of how much I know about 
the subject.
    Kennedy said years ago, the captain who waited for his ship 
to be fit never puts to sea. So we put to sea with S. 2606, and 
we did it with your counsel. There is not any question that you 
folks are the nearest experts I can find and the most objective 
folks that I can find. Our staff has done, along with your 
staff, an outstanding job.
    We have drawn a target with S. 2606. Maybe most of you have 
not had a chance to read it because we waited for you to submit 
your report and then we of course introduced our bill. We 
already have ten co-sponsors.
    I want each of you in writing to give me criticisms of that 
particular bill, what is heavy-headed, what is unrealistic, and 
what is impossible for industry. We have been very considerate 
of industry. The Internet is not going to stop. All of these 
folks here act like some day it is going to slow down. It will 
never slow down. This thing is a dynamic that is running way 
ahead of all of us, and each day that passes with State's 
attorneys general all trying to pass their laws, with any and 
everything coming out of the Congress and nothing real, we have 
got to really move on this thing. After 5 years, I think we are 
pretty well in a position to move with your counsel and 
criticism.
    Please do that for me, and we thank you very, very much for 
what you have done for us so far.
    Excuse me. The Committee will be in a brief recess.
    [Recess.]
    The Chairman. The Committee will resume. Please, 
Commissioners, take your seats, and we will begin questioning. 
I think Senator Wyden by early bird rules is next.
    Senator Wyden. Thank you. Thank you very much, Mr. 
Chairman. I will let our guests get their seats.
    [Pause.]
    Mr. Chairman, this question is for you. As you know, 
Senator Burns and I have been at it for well over a year trying 
to craft bipartisan legislation. As I have indicated, I happen 
to think that Senator Hollings, Senator Kerry, and others are 
making important contributions. I think it would be helpful if 
you could tell us, in your view are there any dangers in 
waiting to pass bipartisan privacy legislation?
    Mr. Pitofsky. It is an interesting question. Yes, I think 
that there are inappropriate invasions of privacy that go on at 
this time, and they are of a sort that it is difficult for us 
to get at under present law. Nothing is said about privacy or 
it is a confusing disclosure, but not really a deceptive one.
    So I think there is always a question of protecting 
consumer rights as promptly as possible. On the other hand, I 
do think, having worked on this now for 5 years and very 
energetically for 3, there are differences of view reflected in 
some of the legislation. There are tough questions that were 
raised by our advisory committee and in our report. Therefore I 
think it is more important to do this in a thorough and careful 
way than to rush to any judgment in this area.
    I think we are all aware that it is the end of a 
Congressional session and there are not that many legislative 
days left. If it can be done appropriately in a short period of 
time, fine. But I think it is more important to get it right.
    Senator Wyden. Do you believe that you have existing 
rulemaking authority under your underlying statute, the organic 
statute, to protect consumer privacy?
    Mr. Pitofsky. No, we do not. That is the point. It seems to 
me we need the kind of legislation that we have recommended and 
that you and Senator Burns have authored in order to engage in 
rulemaking. We could call invasions of privacy ``unfair,'' but 
I do not believe that we could sustain that position.
    Senator Wyden. Let me wrap up with this. I do not think 
what you are talking about now is a radical departure from your 
previous position, and I do not think you are abandoning self-
regulation. I hope that what people will see in this whole 
effort is that this is not some sinister government power grab. 
This is an opportunity to empower the consumer; at the end of 
the day, what we want to do is give consumers control over 
important information.
    We can have this debate about the technical terms, opting 
out and opting in. In English what we all understand is that 
explicit permission from the consumer for things like medical 
and financial information is clearly their expectation. Senator 
Kerry has defined that as opt-in.
    At the same time, if you subscribe to Newsweek for 20 years 
and they are thinking about contacting you for the 21st year, 
we should not make them send you one letter in order to get 
permission to send another letter. I think the approach that 
you are talking about is very much in line with the bipartisan 
legislation that Senator Burns has talked. I think it is 
consistent with the kinds of ideas Senator Hollings and Senator 
Kerry have expressed, and we appreciate your leadership and 
look forward to working with you.
    Thank you, Mr. Chairman.
    The Chairman. Senator Kerry.
    Senator Kerry. I appreciate Senator Wyden's comment. 
Senator Wyden, Senator Hollings, Senator Rockefeller, and I 
were chatting on the floor a few moments ago, and it seems to 
me that there is an opportunity here for us, Mr. Chairman, to 
try to see if we cannot find a bipartisan meeting ground here 
that pulls people together. I do not think we are that far off.
    Clearly, medical and financial Web sites deserve some kind 
of special status. I think we can agree on that. We need to 
find a way to do that.
    I still maintain that the degree to which, when you get 
beyond the notice, the choice, access, and security issues are 
at this point perhaps left too much to the regulatory process 
rather than trying to bring the marketplace into it. This would 
bring the private sector into some perhaps joint resolution 
that might even result, for instance, in something like an FTC 
seal of approval, in conjunction with the corporate community 
in a joint effort to arrive at an agreement as to what the 
appropriate measure should be.
    It seems to me there are some choices in front of us. But I 
still remain troubled. Let me ask this question first. If we 
were to pass a fairly significant disclosure and fairly clear 
disclosure requirement, without mandating in specificity each 
aspect of choice, access, or security, would you not then be 
empowered to enforce? And would you not, if you joined together 
with the community in this sort of FTC seal, be leveraged 
significantly in your ability to be able to hold people 
accountable?
    Mr. Pitofsky. In my view, a notice bill is better than the 
status quo and I would be comfortable with it. But I think we 
should go further. I believe Congress should go further.
    Let me emphasize the choice aspect, because access and 
security become very complicated. But what would be the 
consequence of a bill that mandated notice--and we could 
enforce that, of course--but did not provide choice? Well, 
first of all I would point out that is not the way we do things 
in consumer protection. We do not say to consumers: If you go 
to a store and you are the victim of bait and switch, if you 
buy a defective product, if you buy a dangerous product, if you 
are abused in credit terms, then why do you not go to some 
other store? We say to them: You have a right to be protected 
against fraud.
    Now, if privacy is worthwhile--and I believe it is--then we 
ought to go the next step and say: First, you should be told 
what is going to happen with that information; and, second, you 
should be given an opportunity to say count me out.
    Senator Kerry. Sure. But my point is, rather than mandating 
whether it is going to be opt-out or opt-in in a particular 
instance, it seems to me you could arrive with the industry at 
a fair set of options on which you put your approval. And if 
they vary from that or they are not clear, as Chairman McCain 
suggested they are not in eight pages--I agree with that. It is 
clear. You go on the Internet today to some of these sites and 
it is an exercise in obfuscation. They are clearly trying to 
not have you opt-out.
    So we need to empower consumers. Most people I talk to who 
are in the industry want to empower consumers. The entire 
salesmanship of this industry has been based on its 
democratization impact and consumer empowerment. So it seems to 
me you could arrive at that, could you not?
    Mr. Pitofsky. I agree and I think we could. I think if we 
sat down with the responsible people in this industry, from 
what I have seen of their behavior so far, we could find common 
ground about what the rules of play ought to be.
    Senator Kerry. I also want to say that I think it is far 
more urgent because of the conglomeration of information on the 
net and because of the speed with which the net moves and sort 
of the new awareness of choice. The American public is now 
becoming far more sensitized to the privacy issue.
    But, in point of fact, we cannot just gloss over this 
offline-online distinction. It sometimes amuses me. Somebody 
does not want to give their credit card on the Internet, but 
they will hand it to a waiter at a restaurant they have never 
been to and they are never going to go to again. He disappears 
in a back room for 5 minutes and they do not have a clue what 
happened to the credit card or what may happen in the ensuing 
days.
    Likewise, you can buy, I am told, criminal information 
records on individuals in the marketplace today. Additionally, 
information is available on somebody's social security number 
and through any kind of credit check. I have seen people's 
personal credit card transactions appear in newspapers based on 
their private sleuthing through the offline market.
    So the notion that there is some new threat really needs to 
be thought through, because the level of loss of privacy of the 
average American today is absolutely extraordinary. Marketing 
takes place in highly specified ways offline, but we are only 
worried about online, this seems imbalanced.
    Do you not agree that these are inconsistencies we have got 
to try to work through?
    Mr. Pitofsky. I do agree with that.
    Senator Kerry. Are there not dangers in the offline issue?
    Mr. Pitofsky. Speaking for myself, I have increasingly come 
around to the view--I did not start there--that the theory of 
distinguishing online from offline is really rather weak. I was 
very influenced by one of our advisory panel people who said: 
What is the point of treating differently warranty information 
that is gathered when the consumer files a warranty card--an 
example of offline private information--when we know some clerk 
is going to sit there and read it right into an electronic 
format? Why would you treat one differently than the other? I 
found that a very powerful argument.
    I am also influenced by the fact that we hear that through 
mergers, joint ventures, and otherwise that online and offline 
companies are merging their data bases, and that is another 
reason why we should think about both.
    Senator Kerry. But I also say respectfully, and I will 
terminate on this, that that is another reason why I think we 
need to approach this thoughtfully and carefully. I suggest 
simply that if we had at least the first step, where we all 
could agree on a simple, clear, straightforward form of 
required disclosure with a set of principles on which each of 
the acceptable four major principles and enforcement: security, 
access, choice, notice, and enforcement. If we could establish 
that in terms of principles, and then you went to work with the 
industry, it seems to me that you may wind up with a better 
product. Meanwhile, we can go to work.
    Now, I want to emphasize, Mr. Chairman, on financial 
information and medical information those are places where 
there ought to be significant rigidity and clarity, and I hope 
the Committee can come together on it.
    Thank you, Mr. Chairman.
    The Chairman. I would remind Committee members we do have 
another panel after this and it is now quarter to 12. So I hope 
we can ask sufficient questions and yet exercise brevity.
    Senator Burns.
    Senator Burns. Thank you, Mr. Chairman.
    I only have one question in listening to the testimony 
here. It will be very simple. We are pretty much--we agree that 
the four areas of concern in this are notice, choice, access, 
and security. Ms. Anthony, I was interested in your 
recommendation on strong enforcement mechanisms as well as an 
audit process. Can you give me some detail on what that might 
look like? I would be interested in that.
    Ms. Anthony. Well, as I said in my testimony, Senator 
Burns, there are enforcement mechanisms at hand. The seal 
programs I think really had a very sensible way to deal with 
privacy. However, I am unaware of anybody that they have kicked 
out for not complying, and I do not think everyone has 
complied.
    I think also that government has used, in the past, 
industry standards in audits, and that is just another 
suggestion. I am not making any firm recommendation on those 
fronts. I am just throwing them out as suggestions for you to 
consider when you devise some enforcement mechanism.
    Senator Burns [presiding]. That is--everybody jumped up and 
ran away. Oh, are you next? Senator Rockefeller. If you can be 
brief, please.
    [Laughter.]
    Senator Burns. Sorry I asked.
    Senator Rockefeller. A couple quick points. A comparison 
was made between fraud and privacy, and I just want to 
emphasize the enormity of the issue of privacy. It affects 
every single American, mostly without their knowledge, as 
opposed to fraud, which is the usual thing you complain about 
with Medicare and other things--waste, fraud, abuse, etcetera. 
These are issues of enormously different dimensions.
    Second, if you have voluntary compliance or if you have a 
regulatory system set up in which you actually get 80 percent 
or 90 percent of companies that are complying with proper 
notification that meets all of Commissioner Anthony's 
specifications, that the 10 percent can undo all of the 90 
percent in an instant. So it has got to be 100 percent. That is 
not offline; that is an online problem.
    That is why I think that we tread on dangerous water when 
we start comparing offline and online and saying, well, if we 
are going to do one we have got to do the other. They operate 
under different sets of market rules and they access or make 
themselves available and dangerous to the American public at 
very different levels of speed and enormity.
    About nine out of ten businesses that start up fail. This 
means that businesses are starting often. Their accounting 
rules have changed and now we have discovered they do not have 
as much money as they thought they did, but people are still 
into it. It is driving the economy and it is a very good thing 
for America and for the world.
    But again, all it takes is a couple of startups that do not 
have the money or the time or cannot afford the lawyers to be 
able to put that proper notification on. All the good work that 
you enforce or lay out self-regulatory or we lay out other 
rules for is gone. The 2 percent can undo the 98 percent 
because once they sell it to the third-party purchaser or they 
have bought it from a third-party purchaser, it is all gone.
    That point needs to be made. That is why I think this is a 
very different level of problem than talking about online-
offline.
    The third thing I want to say is that this is a wonderful 
set of circumstances into which to introduce minutia which 
distracts, but which is nevertheless important as you listen to 
it. Witness: Somebody comes in my office yesterday, they do not 
like what Senator Hollings and I are doing, and so they say, 
but if you get into access, that means that the consumer might 
be, as we used to say, a deadbeat dad, until we started getting 
all the letters from dads who did not consider themselves that 
way. They go in and then they change information to protect 
themselves from having to do what they need to do. Or criminals 
also can access and change their records.
    In other words, there are a thousand ways you can come at 
this to nitpick, to show that there is no perfect software, 
there is no perfect system. What that does is it tends to throw 
us on the defensive and say, oh, we cannot do that. We cannot 
have deadbeat dads changing their records so they do not have 
to pay child support. Let us just back off and do nothing.
    Again, I come back to my original point. We do not have 
that luxury. I think that is why, Mr. Chairman, you come down 
with the line of we have to do better. And I think you want to 
do online and offline together, but my question is are they 
really of the same dimension? Do they move at the same speed? 
Do they have the same consequences, offline as online? I think 
that you would agree with me that they do not.
    Mr. Pitofsky. I do agree with you, Senator. I think the 
online threats to the privacy of consumers is greater than 
offline because of the way in which information can be 
gathered, marshalled, sorted out, accumulated, and then sold. 
So it is different. But I do not know about very different. 
There are threats to privacy that occur in the offline world 
that deserve our attention.
    I know the bill that you are sponsoring suggests that the 
FTC take a look at that and report back to Congress, and I 
think that is the right way to go. We did not report on it on 
this occasion, because we really had not investigated it.
    The Chairman [presiding]. Thank you.
    Senator Bryan.
    Senator Bryan. Mr. Chairman, if I might just followup on 
that. You are not suggesting, however, that because in your own 
thought process as you describe the evolution of the 
significance of offline privacy invasion, that we should hold 
up on these recommendations in terms of developing these base 
standards of notice, choice, access, and enforcement? I want to 
be clear on that.
    Mr. Pitofsky. Yes, Senator, exactly right, I am not.
    Senator Bryan. Mr. Swindle, if I might ask you a couple of 
questions. I believe you were a dissenter in the report that 
the majority filed. As I understood the thrust of your 
testimony, you believe that self-regulation ought to be given 
an opportunity to work its course before we embark upon a 
legislative course of action. Is that a fair statement of your 
position, sir? I do not want to mischaracterize it.
    Mr. Swindle. Yes, sir, that is a fair description of it, 
but it goes further than that. My concerns with the report were 
that the report is a misconstruing of information and data. It 
is the basis for making the recommendation that we have this 
very broad, all-encompassing legislation on virtually every Web 
site that exists. And, I think the data is used in a misleading 
manner and that leads to a recommendation which is illogical. I 
think we are on the wrong track.
    Senator Bryan. Do you support the concept that consumers 
ought to be given a notice of what the privacy policies are of 
online providers?
    Mr. Swindle. Yes, sir.
    Senator Bryan. Well, let me ask you to respond. Ms. Anthony 
had an example which she shared with us, where you have got to 
be referred from one page to another and several hundred 
intervening words. Our Chairman cited an example of one which I 
think any fair-minded person would say is not effective notice. 
I believe that Senator Kerry used the word ``obfuscation.'' I 
would say that it triumphs form over substance.
    Now, why should we not have some legislative standard that 
requires meaningful notice if this kind of action is being done 
by some of the major online providers in the country?
    Mr. Swindle. Senator Bryan, I think you will perhaps 
recall, in commenting to Senator McCain's comments, I said 
these things are so ridiculous that I do not even read them. I 
just click them off.
    Senator Bryan. I apologize, I think I had to leave.
    Mr. Swindle. I am in the same group, and I think some form 
of clear and conspicious notice would be most appropriate. I 
also made the statement that, in effect, our survey indicates 
that in excess of 90 percent of Web sites now provide some form 
of notice already. It is not the best of notices because some 
of them are Yahoo versions and some of them probably do not say 
anything other than, ``we have a privacy policy.'' So the 
quality of that statement, if it were prepared and put into 
very clear and precise, easy to understand form, would be a 
very good thing to do.
    I think choice naturally follows from being able to 
understand what is before you. It is like going into a store, 
it costs a dollar for this ball. If I want to pay a dollar for 
the ball, I pay it. If the privacy notice says, we want to 
collect this information if you want to come into our site, 
then you make a choice. You go or do not go.
    Senator Bryan. I am sure there are other examples other 
than those that were cited for the record. The notices are 
misleading and confusing, and I think you are saying that you 
agree that in effect those are not real notice. Do we not need 
to have some type of a legislative response that says, look, 
notice cannot be just some game in which the consumer is moved 
from one link to another on a web page. It has got to be 
meaningful.
    Is there anything wrong with a legislative standard that 
requires notice to in fact be----
    Mr. Swindle. No, sir.
    Senator Bryan. So you would agree with that?
    Mr. Swindle. My disagreement is with the all-encompassing 
nature of the recommendation. We are not talking about the same 
thing here.
    Senator Bryan. So you would have no problem with 
legislation that talks about notice in a meaningful sense?
    Mr. Swindle. Yes, sir. And I think in my statement or my 
dissent I said if the Congress believes we must legislate, let 
us go no further than notice.
    Senator Bryan. Notice. Let me ask about an aspect of 
enforcement. Mr. Chairman, this is my last question. You have 
been patient, but I do not think I have belabored the point.
    We had a situation with Chase Manhattan, one of the major 
banks in America. Those of us that serve on the Banking 
Committee know. Their privacy policy indicated a course of 
action in terms of how they would deal with consumer 
information, with private information. In point of fact, they 
violated their own consumer policy and sold to third party 
telemarketers. They received a 24 percent commission for each 
sale that was ultimately consummated as a result of that third 
party, the telemarketer, negotiating with the customer.
    Now, ultimately what occurred, as you know, is the Attorney 
General in New York brought suit. But that deals with an 
enforcement issue. I mean, I do not know the law of every state 
in the country, and I certainly do not know the particular 
circumstances of the New York law. But, clearly, that is such a 
blatant violation of a stated policy there has got to be some 
enforcement.
    Would you agree with that point, Mr. Swindle?
    Mr. Swindle. Yes, sir, and we can do that under Section 5 
of the Federal Trade Commission Act. I made reference earlier 
to Geocities, which is exactly that case. We would not be 
involved in the banking industry, as the Senator knows. But in 
the case of Geocities they had a privacy statement, they said 
we will do A, B, and C, and we found out later, alleged that 
they did A, B, C, D, E, and F and did a similar thing, they 
sold the information to third parties. And we have the power 
today to take enforcement action against them.
    Senator Bryan. So I take it from your response that it 
would be within your jurisdiction. Maybe we need to look at 
that; that is a separate issue. So you would certainly favor a 
regulation that would clearly provide some sanction for 
violation of a stated privacy policy such as that?
    Mr. Swindle. We have that authority today under existing 
law.
    Senator Bryan. Mr. Chairman, thank you very much.
    I appreciate your response, Mr. Swindle.
    The Chairman. Thank you.
    I would like to tell the witnesses I appreciate their 
patience. I apologize for the break while we had a couple of 
votes. I thank you for helping us address these very difficult 
issues. We will be in communications with you. In fact, we may 
ask you to come back if and when there is some proposed 
legislation concerning this very, very important issue.
    So thank you very much.
    Mr. Pitofsky. Thank you, Mr. Chairman.
    The Chairman. The next panel is: Ms. Jill Lesser, Vice 
President of Domestic Public Policy, America Online; Ms. 
Christine Varney, senior partner of Hogan and Hartson, 
testifying on behalf of the Online Privacy Alliance; Mr. Jason 
Catlett, President of the Junkbusters Corporation; Mr. Jerry 
Berman, Executive Director, Center for Democracy and 
Technology; and Mr. Daniel Weitzner, who is Technology and 
Society Domain Leader of the World Wide Web Consortium.
    I would ask those who are departing to expedite their 
departure and those who are witnesses to please come forward as 
quickly as possible so we can continue the hearing.
    I want to thank all the witnesses for their patience. 
Obviously, your complete statement will be made a part of the 
record. Welcome, Ms. Lesser.

STATEMENT OF JILL A. LESSER, VICE PRESIDENT OF DOMESTIC PUBLIC 
                  POLICY, AMERICA ONLINE, INC.

    Ms. Lesser. Thank you, Chairman McCain, and I will try to 
be brief. Chairman McCain----
    The Chairman. Could I emphasize, of course, we want you to 
be brief, but it is most important that we receive the 
information you have to impart. If there is any appearance of 
impatience on the part of the chairman and members of the 
Committee, please disregard that. The most important thing----
    [Laughter.]
    Ms. Lesser. I will take that under advisement.
    The privacy report issued this week by the Federal Trade 
Commission shows in many ways that we have reached a crossroads 
in the development of the online medium. It is clear that the 
Internet is revolutionizing our society, dramatically changing 
the way we learn, communicate, and do business. People are 
migrating to the Internet to meet their commerce and 
communications needs at an extraordinary rate because it is 
convenient and fast and offers unprecedented selection of 
information, goods, and services.
    Yet, despite this enormous growth the Internet has enjoyed 
over the past few years, or perhaps because of it, we have seen 
a heightened awareness of online privacy and security issues, 
consumer protection, and a whole host of issues related to 
online safety. And even though the medium continues to grow at 
an enormous rate, online companies are realizing that it is 
their responsibility to address these issues for their 
consumers.
    Of course--and I think this has perhaps been 
underemphasized today--this medium offers to users an ability 
unprecedented to customize and personalize their experiences. 
Consumers can, and do on a regular basis, communicate specific 
preferences that will allow them to receive information 
tailored to their own interests.
    No other commercial or educational medium has ever afforded 
such tremendous potential for personalization, and we are 
seeing consumers take advantage of these opportunities at an 
incredible rate. But we know that the power of the Internet can 
only be fully realized if consumers feel confident that their 
privacy is properly protected when they take advantage of these 
benefits, and therefore we, along with many other companies, 
are protecting privacy. We view it as an essential aspect to 
earning their trust, and this trust is, in turn, essential to 
building the medium.
    That is why we and other companies have devoted so much 
time and energy to creating strong policies that provide 
meaningful protection. As we have discussed much this morning, 
there are several important elements of those policies and I 
believe many, particularly the industry leaders, have policies 
that address all of those elements.
    Our own commitment is based on the lessons we have learned 
and the input we have gotten from consumers, policies that 
clearly notify our users what information will be collected, 
why, how it will be used, and the opportunity to exercise 
choice and disclosure. Indeed, we intend to fully implement 
those notice and choice principles across all of our brands 
when we hope our merger with Time-Warner is finally 
consummated.
    We also make sure that our policies are well understood 
with respect to our employees, and I think this is an important 
point as well. Implementation throughout a company of a privacy 
policy is critical to making sure that it is really truly 
within the ethos of all of our companies.
    We do try to keep users informed about the steps they can 
take. That is, do not give out your password and certainly do 
not give information out to companies or anybody you do not 
know and you do not trust.
    Finally, with respect to children, we have worked with many 
of you, Senator Bryan and Senator McCain in particular, 
supporting the Online Privacy Act related to children in the 
105th Congress and do believe it was an area where additional 
steps were needed.
    In adopting and implementing our own policies, we are 
committed to fostering best practices within the industry, and 
you will hear from the Online Privacy Alliance and many other 
trade associations and others we have worked with, and we have 
done a lot to make sure that our business partners are also 
following important privacy policies.
    So after all of that background, where are we now? The FTC 
report concludes that, despite this progress, industry has not 
done enough and that broad privacy legislation is necessary in 
order to ensure that consumers are protected. Does this mean in 
their view that self-regulation is a failure, and what are we 
as industry therefore supposed to do?
    As the Committee and other Congressional leaders begin to 
sift through the FTC's recommendations, I would just like to 
offer a few thoughts as you do that. First, it is important for 
all of us in industry and government to stop thinking about 
this issue as a zero sum game, as self-regulation versus 
government regulation. Instead, we must remember that the crux 
of the issue is about consumer confidence, consumer protection, 
safety, and security, and since all of us have the same end 
goal, to ensure that consumers trust the online medium, we do 
not need to set ourselves up as opponents in a privacy battle.
    One way to approach this joint responsibility is to allow 
the market to lead, as it has, in developing up-to-date and 
innovative initiatives for protecting privacy, but give the 
government its important enforcement activities. Indeed--and I 
think this is important to note in light of all the numbers we 
have heard today--the government's existing enforcement powers 
are greatly expanded simply by the proliferation of privacy 
policies, now numbering almost 90 percent.
    If you look at the examples used by Chairman McCain, by 
Commissioner Anthony and others this morning about perhaps 
unfair or deceptive privacy policies, I would note that the FTC 
does have broad enforcement authority in those areas. So if you 
compare 90 percent of sites having privacy policies with the 
enforcement authority of the FTC, I think there is an enormous 
amount of coverage that we are underestimating.
    Second, I would say that it is critical that neither the 
government nor industry view this issue as simple. On the 
contrary, when we as businesses ask our consumers what they are 
most concerned about, we get a variety of different answers. 
For some consumers, it is really security rather than privacy--
identity theft, hacking--and certainly this is an area where 
the industry has every incentive to do the right thing, but the 
government must make clear that bad behavior is unacceptable.
    For other consumers, the primary concern relates to 
sensitive information, an issue we have talked about a lot this 
morning. Individuals want to take advantage of online health-
related services, for example, without worrying about 
embarrassing or compromising releases of their health 
information. Indeed, Congress has addressed these issues 
through financial services legislation enacted last Congress 
and the Health Insurance Portability and Accountability Act of 
1996, neither of which, I would note, have been fully 
implemented. So we do need to make sure we understand what is 
out there.
    Such examples and others underscore the intricacy of the 
privacy issue and the difficulty in pinpointing the actual 
problems that need to be addressed through industry or 
government action. Unfortunately, I would say the FTC's 
recommendation for a sweeping regulatory regime for online 
privacy does not take into account either the complex 
dimensions of this issue or the need for industry-government 
partnership on privacy.
    The Commission purports to recognize the important role 
that industry leadership on self-regulation has played, yet it 
recommends broad legislation with expansive regulatory 
authority that could actually discourage industry-led 
initiatives and market-driven solutions by outlawing consumer-
oriented methods of privacy protection and personalization.
    We would therefore simply ask that members of this 
Committee look at privacy with a high regard for the benefits 
of personalization and the efficacy of industry action to date. 
You may find there are gaps in industry enforcement where 
government must step in to ensure compliance. Nevertheless, it 
is clear that companies are responding to increasing 
marketplace demand for online privacy, and the tremendous 
growth of e-commerce reflects a positive trend on a variety of 
consumer protection issues, including privacy.
    The challenges that lie ahead will give us a chance to 
prove that industry and government can work together, but 
ultimately it is the consumer who will judge whether those 
efforts are adequate because, no matter how extraordinary the 
opportunities for e-commerce may be, the marketplace will fail 
if we cannot meet consumers' demands for privacy protection and 
gain their trust.
    We as a company are committed to doing the right thing. We 
believe our colleagues in the industry are as well. We 
appreciate the opportunity to discuss these important issues 
with you this morning. Thanks.
    [The prepared statement of Ms. Lesser follows:]

        Prepared Statement of Jill A. Lesser, Vice President of 
              Domestic Public Policy, America Online, Inc.

    Chairman McCain, Senator Hollings, and Members of the Committee, I 
would like to thank you, on behalf of America Online, for the 
opportunity to discuss online privacy with you today. My name is Jill 
Lesser, and I am the Vice President for Domestic Policy at AOL.
    The privacy report issued this week by the Federal Trade Commission 
shows that, in many ways, we have reached a crossroads in the 
development of the online medium. It is clear that the Internet is 
revolutionizing our society--dramatically changing the way we learn, 
communicate, and do business. People are migrating to the Internet to 
meet their commerce and communications needs at an extraordinary rate 
because it is convenient and fast, and offers an unprecedented 
selection of information, goods and services. AOL subscribers can sign 
on to our service and do research, shop for clothing, obtain health 
information, and buy airline tickets--all in a matter of minutes. And 
every day we are seeing new online opportunities arise, and new users 
flocking to take advantage of these opportunities.
    Yet despite the enormous growth that the Internet has enjoyed over 
the past few years--or maybe because of it--we have seen a heightened 
awareness of online privacy and security issues. Every day we are faced 
with new reports, studies, and statistics--many of which seem to 
contradict each other--about how Internet users feel about the medium 
and how online privacy is, or isn't, being protected. And even though 
the medium continues to grow at an incredible rate, online companies 
are realizing that they have to sit up and pay attention to privacy if 
they want to stay in business.
    Of course, one of the most attractive benefits that this medium 
offers to users is the ability to customize and personalize their 
online experience. Consumers can communicate specific preferences 
online that will allow them to receive information tailored to their 
own interests. For instance, AOL members can set their online 
preferences to get sports scores or stock quotes, read news stories 
about their own hometown, or receive notices about special discounts on 
their favorite CDs. No other commercial or educational medium has ever 
afforded such tremendous potential for personalization, and we are 
seeing customers take advantage of these opportunities at an incredible 
rate--through our own services and through countless other business 
models for personalization, from online bookclubs to discount ticket 
agencies to special offers from the local supermarket.
    But we know now that the power of the Internet can only be fully 
realized if consumers feel confident that their privacy is properly 
protected when they take advantage of these benefits. If consumers do 
not feel secure online, they will not engage in online commerce or 
communication--and without this confidence, our business cannot 
continue to grow. For AOL, therefore, protecting our members' privacy 
is essential to earning their trust, and this trust is, in turn, 
essential to building the online medium. That's why AOL and other 
companies have devoted so much time and energy to creating strong 
privacy policies that provide meaningful protection and are backed up 
by compliance and enforcement programs.
    AOL's own commitment is based on the lessons we've learned over the 
years and the input we've received from our members. We've created 
privacy policies that clearly explain to our users what information we 
collect, why we collect it, and how they can exercise choice about the 
use and disclosure of that information. AOL's current privacy policy is 
organized around 8 core principles:

   We do not read your private online communications.

   We do not use any information about where you personally go 
        on AOL or the Web, and we do not give it out to others.

   We do not give out your telephone number, credit card 
        information or screen names, unless you authorize us to do so. 
        And we give you the opportunity to correct your personal 
        contact and billing information at any time.

   We may use information about the kinds of products you buy 
        from AOL to make other marketing offers to you, unless you tell 
        us not to. We do not give out this purchase data to others.

   We give you choices about how AOL uses your personal 
        information.

   We take extra steps to protect the safety and privacy of 
        children.

   We use secure technology, privacy protection controls and 
        restrictions on employee access in order to safeguard your 
        personal information.

   We will keep you informed, clearly and prominently, about 
        what we do with your personal information, and we will advise 
        you if we change our policy.

    We give consumers clear choices--which are easy to find and easy to 
exercise--about how their personal information is used, and we make 
sure that our users are well informed about what those choices are. For 
instance, if an AOL subscriber decides that she does not want to 
receive any tailored marketing notices from us based on her personal 
information or preferences, she can simply check a box on our service 
that will let us know not to use her data for this purpose. Because we 
know this issue is so critically important to our members and users, we 
make every effort to ensure that our privacy policies are clearly 
communicated to our customers from the start of their online 
experience, and we notify our members whenever our policies are changed 
in any way.
    We also make sure that our policies are well understood and 
properly implemented by our employees. We require all employees to sign 
and agree to abide by our privacy policy, and we provide our managers 
with training in how to ensure privacy compliance. We are committed to 
using state-of-the-art technology to ensure that the choices 
individuals make about their data online are honored, and that such 
data is protected and secured.
    And we try to keep users informed about the steps they can take to 
protect their own privacy online. For instance, we emphasize to our 
members that they must be careful not to give out their personal 
information unless they specifically know the entity or person with 
whom they are dealing, and we encourage them to check to see whether 
the sites they visit on the Web have posted privacy policies and to 
review those policies.
    Furthermore, AOL takes extra steps to protect the safety and 
privacy of children online. One of our highest priorities has always 
been to ensure that the children who use our service can enjoy a safe 
and rewarding online experience, and we believe that privacy is a 
critical element of children's online safety.
    We have created a special environment just for children--our ``Kids 
Only'' area--where extra protections are in place to ensure that our 
children are in the safest possible environment. In order to safeguard 
kids' privacy, AOL does not collect personal information from children 
without their parents' knowledge and consent, and we carefully monitor 
all of the Kids Only chat rooms and message boards to make sure that a 
child does not post personal information that could allow a stranger to 
contact the child offline. Furthermore, through AOL's ``Parental 
Controls,'' parents are able to protect their children's privacy by 
setting strict limits on whom their children may send e-mail to and 
receive e-mail from online.
    As you know, AOL supported legislation in the 105th Congress to set 
baseline standards for protecting kids' privacy online--precisely 
because of the unique concerns relating to child safety in the online 
environment. We worked with Senator Bryan, Senator McCain, the FTC, and 
key industry and public interest groups to help bring the Child Online 
Privacy Protection Act (COPPA) to fruition. We believe the enactment of 
this bill--which took effect last month--was a major step in the 
ongoing effort to make the Internet safe for children.
    In addition to adopting and implementing our own policies, AOL is 
committed to fostering best practices among our business partners and 
industry colleagues. One of the strongest examples of this effort is 
our ``Certified Merchant'' program, through which we work with our 
business partners to guarantee our members the highest standards of 
privacy and customer satisfaction when they are within the AOL 
environment. AOL carefully selects the merchants we allow in the 
program, and requires all participants to adhere to strict consumer 
protection standards and privacy policies. The Certified Merchant 
principles are posted clearly in all of our online shopping areas, 
thereby ensuring that both consumers and merchants have notice of the 
rules involved and the details of the enforcement mechanisms, which 
help to foster consumer trust and merchant responsiveness.
    Through our Certified Merchant program, we commit to our members 
that they will be satisfied with their online experience, and we have 
developed a money-back guarantee program to dispel consumer concerns 
about shopping online and increase consumer trust in this powerful new 
medium. We believe that these high standards for consumer protection 
and fair information practices will help bolster consumer confidence 
and encourage our members to engage in electronic commerce.
    We at AOL are proud of the steps we've taken to create a privacy-
friendly environment online for our members and encourage our industry 
colleagues to do the same. But we haven't done these things to prove a 
point or to discourage government regulation--we've done them because 
we must do them, because our business, more than ever, requires us to 
respond to consumer demands and take privacy seriously in order to 
build more consumer trust in the medium. And we know that many other 
online businesses feel exactly the same way. That's why AOL joined with 
other companies and associations two years ago to form the Online 
Privacy Alliance (OPA), about which you will hear more this morning 
from another witness. And that's why through NetCoalition, a group 
representing some of the largest and most active online companies, we 
recently sent a letter to 500 CEOs encouraging them to post good 
privacy policies on their Web sites that contain the key fair 
information principles, and to fully implement these policies within 
their companies. The progress that industry has made is real--one thing 
the FTC report clearly shows is that the proportion of commercial Web 
sites posting privacy policies has skyrocketed in less than three years 
from less than 14% to over 90%--unbelievable progress for an industry 
that barely existed just a few years ago and which today is 
demonstrating the most rapid growth in the history of media.
    So where are we now? The FTC report concludes that, despite this 
progress, industry hasn't done enough, and that broad privacy 
legislation is necessary in order to ensure that consumers are 
protected. Does this mean that self-regulation is a failure? What are 
we supposed to do next?
    As the Commerce Committee and other Congressional leaders begin to 
sift through the FTC's recommendation and face the issue of whether to 
take action in this area, I would like to offer just a few thoughts on 
how you might approach answering these difficult questions:
    First, it is important that all of us in industry and government 
stop thinking about the privacy issue as a ``zero sum game''--as self-
regulation versus government regulation. Instead, we must remember that 
the crux of the issue is really consumer confidence, consumer 
protection, safety and security. And since all of us have the same end 
goal--to ensure that consumers trust the online medium--we do not need 
to set ourselves up as opponents in a privacy ``battle.'' Clearly the 
industry has an enormous incentive to make consumer protection a 
fundamental part of doing business, but there is also an important role 
for government in protecting consumers. One way to approach this joint 
responsibility is to allow the market to lead the way in developing up-
to-date and innovative initiatives for protecting privacy, but let the 
government step up its enforcement activities. Indeed, the government's 
existing enforcement powers are greatly expanded simply by the 
proliferation of privacy policies, now numbering 90 percent. This type 
of partnership allows for maximum flexibility and technological 
innovation, so that the ``good guys'' can set the stage for best 
practices while the ``bad guys'' pay the price for bad behavior.
    Second, it is critical that neither the government nor industry 
view privacy as a simple issue with a simple answer. On the contrary, 
when we as businesses ask our consumers what it is they are most 
concerned about we get a variety of different answers:

   For some consumers it is security rather than privacy that 
        is the greatest concern. They care more about whether their 
        credit cards can be safely ``submitted'' online than about 
        whether their ISP will send them a tailored advertisement. In 
        reality, the risks of identity theft may actually be greater in 
        the offline world than in the online world, where fewer humans 
        actually touch or handle an individual's credit card, for 
        example. Yet the prospect of personal information being 
        compromised through hacking and theft is likely keeping many 
        consumers from going online. This is certainly an area where 
        the industry has every incentive to do the right thing but the 
        government must make clear that bad behavior is not acceptable.

   For other consumers, the primary concern relates to 
        sensitive information like health and financial data. 
        Individuals want to take advantage of online health-related 
        services, for example, without worrying about embarrassing or 
        compromising releases of their health information. For these 
        types of information, industry and government will need to 
        determine what privacy standards need to be in place for 
        particular businesses to succeed, and indeed Congress has 
        already addressed these issues through financial services 
        legislation enacted last Congress and the Health Insurance 
        Portability and Accountability Act of 1996, neither of which 
        have yet been fully implemented.

   Still another group of consumers is concerned about whether 
        their online behavior is being ``tracked.'' Yet when the 
        technologies behind such activity are explained and consumers 
        are able to understand that there are both positive and 
        negative uses of these types of tools, it may turn out that 
        consumers simply want to know what a particular Web site is 
        doing so they can make their own decisions about how to use 
        these services.

    Such examples underscore the intricacy of the privacy issue and the 
difficulty in pinpointing the actual problems that need to be addressed 
through industry or government action.
    Unfortunately, the FTC's recommendation for a sweeping regulatory 
regime for online privacy does not take into account either the complex 
dimensions of this issue or the need for an industry-government 
partnership on privacy. The Commission purports to recognize the 
important role that industry leadership on self-regulation plays in any 
privacy solution; yet the report recommends broad legislation that 
would provide ``flexibility to the implementing agency in promulgating 
its rules or regulations . . . [that could] define . . . fair 
information practices with greater specificity.'' Such expansive 
regulatory authority could actually discourage industry-led initiatives 
and market-driven solutions by outlawing consumer-oriented methods of 
privacy protection and personalization. Furthermore, such sweeping 
legislation would not take into account all of the more targeted 
proposals that have either been enacted or are pending--from the new 
children's privacy law, to rules for health and medical data, to 
financial privacy regulations.
    We at AOL would therefore ask the Members of this Committee to 
develop its policies in the privacy area with high regard for the 
benefits of personalization and the efficacy of industry action to 
date. You may find that there are gaps in industry enforcement where 
government must step in to ensure compliance. Nevertheless, it is clear 
that companies are responding to the increasing marketplace demand for 
online privacy, and that the tremendous growth of e-commerce reflects 
positive trends on a variety of consumer protection issues, including 
privacy. Sweeping regulatory action could very likely curb such market 
innovation and competition and discourage creative and flexible 
approaches to privacy protection.
    The challenges that lie ahead will give us the chance to prove that 
industry and government can work together to promote online privacy. 
But ultimately, it is the consumer who will be the judge of whether 
these efforts are adequate. Because no matter how extraordinary the 
opportunities for electronic commerce may be, the marketplace will fail 
if we cannot meet consumers' demands for privacy protection and gain 
their trust.
    We at AOL are committed to doing our part to protecting personal 
privacy online. Our customers demand it, and our business requires it--
but most importantly, the growth and success of the online medium 
depend on it. We appreciate the opportunity to discuss these important 
issues before the Committee, and look forward to continuing to work 
with you on other matters relating to the Internet and electronic 
commerce.

    The Chairman. Ms. Varney, welcome.

   STATEMENT OF CHRISTINE VARNEY, SENIOR PARTNER, HOGAN AND 
               HARTSON, ON BEHALF OF THE ONLINE 
                        PRIVACY ALLIANCE

    Ms. Varney. Thank you, Chairman. It is a pleasure to be 
here. Thank you for inviting me. Mindful of your admonition, I 
am just going to talk for a few minutes. I have got longer 
remarks that we have submitted for the record and I would like 
to address some of the issues that have been raised this 
morning.
    First of all, we can sit here all day and argue about 
numbers--88 percent, 60 percent, 40 percent, back out access, 
back out security, whatever. I think that it is fairly clear 
that there has been enormous progress. If you look over time, 
the increase in the numbers of Web sites that are making some 
type of privacy disclosures, providing some types of choices, 
is going up. I think that is something that this Congress can 
take a lot of credit for because they have shown a lot of 
leadership in working with the industry on it.
    The complexity that we get to, that Commissioner Anthony 
and others have mentioned, when you read these notice policies 
should not be underestimated. Both Yahoo and Doubleclick have 
very large, very complex businesses and, Chairman, both those 
companies have been working very hard in the last month to 
completely revamp their privacy policies and make them easier 
to use, easier to read, and both those companies would like to 
come and talk to you, perhaps next week if you have time, to 
show you what they are planning on doing and get your feedback 
and your thoughts about it.
    The Chairman. I would be glad to do that.
    Ms. Varney. Thank you.
    If privacy policies, if notices are misleading, I think as 
Ms. Lesser said, the FTC has the authority. Maybe what they 
need is more resources. They ought to prosecute those people. 
To put a statement up that says we protect your privacy policy 
and somewhere in the statement say we do whatever we deem 
reasonable with your data and you do not get any choice about 
it, I think is deceptive on its face and it ought to be 
prosecuted.
    Senator Kerry talked a lot----
    The Chairman. Yahoo? Yahoo ought to be prosecuted?
    Ms. Varney. Well, Yahoo's is not deceptive, Senator. 
Yahoo's is complex. Yahoo is a very large company with an 
enormous Web site offering a wide array of services and 
products. When I read Yahoo's privacy policy, what I think they 
tried to do was be completely comprehensive, tell you 
everything. And it is not easy to read, they will agree with 
you.
    The Chairman. Why do you have to be comprehensive? Can you 
not just say, this information will be private? What is the 
comprehensiveness?
    Ms. Varney. You may absolutely say, we will never disclose 
this information to anyone under any circumstances, if that is 
what you do. When you run a Web site where you have content 
provider partners, where you have chat rooms that you link to 
that are run by other companies, where you have ask-a-doctor 
questions, where you e-mail a doctor who does not work for a 
company but works for somebody else, that information is in 
fact going to someone else.
    It might be clear to you, it might not be clear to you. But 
to say we never give your information to anyone under any 
circumstances is flat out deceptive, unless that is precisely 
what you do. I would submit to you, Senator, unless you are 
dealing with a very small Web site, that is not the case today.
    These Web sites, why are they so complex and 
comprehensive----
    The Chairman. So we need a how many sentence----
    Ms. Varney. I think that what you see----
    The Chairman. Ms. Varney, that is not appropriate. It is 
not appropriate for most Americans not to be able to understand 
a Web site's privacy policy.
    Ms. Varney. I agree, I agree.
    The Chairman. Now, can you understand the Yahoo statement?
    Ms. Varney. I do not think that is a fair test, Senator.
    The Chairman. Well, we just had a university professor who 
could not.
    Ms. Varney. I will leave that one.
    I think that you are right, it is too complicated, and the 
companies are really working on how to make it less complex. 
Why is it so complicated? Because they are big companies with 
lots of business units. They are publicly traded companies that 
face shareholder lawsuits if they are not completely accurate 
in every regard. That is not to say that they cannot do it 
better and that they should not and that they will. I think 
they all will, which goes to my next point.
    The Chairman. I apologize for interrupting you, by the way.
    Ms. Varney. Not at all. Always better to have an exchange, 
I think, a dialog than a monologue.
    What you have seen, what you have identified here this 
morning, I think is a real problem in making these notices easy 
to find, read, and understand. How do you do that? That is a 
problem we ought to address and perhaps ultimately it may need 
to be addressed legislatively.
    Do you need to delegate what I consider to be broad, 
sweeping regulatory authority to the FTC to do that? No. This 
Congress has not delegated to any Federal agency broad 
regulatory authority over the Internet and I do not think this 
is the time to start.
    Senator Kerry mentioned the financial data, data related to 
health and medical information, data related to kid-sensitive 
data. That may need a more complex regulatory scheme. In fact, 
as Ms. Lesser said, you passed the Financial Services 
Modernization Act. Now, we can argue about whether or not the 
privacy protections in that are adequate, but you passed it and 
it is just now going into effect.
    You passed the Health Insurance Portability and 
Accountability Act. Those regulations dealing with privacy are 
not even done yet. We need to look at them. We need to figure 
out if there is loopholes. We have to give Americans the 
highest level of protection for their health and medical data.
    The kids law, the Children's Online Privacy Protection Act, 
which this Committee birthed, has been wildly successful in my 
view, but it has had some unintended consequences, maybe not 
bad but unintended. Let us take a look and see where the gaps 
are.
    The question I think is, whether it is 80 percent or 90 
percent or 60 percent, how do you get this last mile to get 
every Web site that is collecting personal information to tell 
consumers in a straightforward way what they are doing and what 
their choices are? I do not believe the answer is delegating 
broad regulatory authority to the Federal Trade Commission at 
this time.
    Thank you, Senator.
    [The prepared statement of Ms. Varney follows:]

   Prepared Statement of Christine Varney, Senior Partner, Hogan and 
           Hartson, on Behalf of the Online Privacy Alliance

Mr. Chairman:

    Thank you very much for inviting me to testify this afternoon on 
behalf of the Online Privacy Alliance. My name is Christine Varney. I 
am a former Federal Trade Commissioner and am currently a partner at 
Hogan & Hartson where I chair the Internet Practice Group. In addition, 
I am an advisor to the Online Privacy Alliance--a coalition of over 100 
industry and trade associations who came together two years ago to 
formulate and advocate for best privacy practices online. With your 
permission I have submitted for the record extensive descriptions of 
privacy practices developed by the Online Privacy Alliance that can be 
used for future reference. I would like to take a few minutes here to 
discuss the FTC's report and the Commission's call for regulatory 
authority.
    First, let me congratulate and thank the Commission for their 
ongoing work in examining the issues of privacy in the information age. 
It was not that long ago when I was a Commissioner in 1995 and I was 
told by some of my colleagues, none of whom are still at the FTC, that 
privacy was not a consumer protection issue. I think we have all come 
to realize that privacy is the consumer protection issue of the 
information age.
    It is important to remember that the FTC's study is not and cannot 
be considered an evaluation of the state of privacy on the Internet. 
The FTC's analysis that only 20 percent of Web sites comply with all 
four fair information practices, and therefore, provide inadequate 
privacy is fundamentally flawed. As Commissioner Leary points out in 
his statement, the Commission's own Internet privacy policy does not 
meet the Commission's own test for an adequate privacy policy. In fact, 
in many many Web sites, both commercial and otherwise, some of the fair 
information practice elements, such as choice, security, or access, may 
not be at all relevant.
    Let me give you a few examples as to when or why some of these 
criteria may not be relevant. If a site only uses your data only to 
complete a transaction, no choice is necessary. A site that does not 
disclose its security precautions doesn't mean they don't exist. Many 
experts testified in front of the Federal Trade Commission's Advisory 
Committee on Security and Access that security measures and precautions 
should not be disclosed on Web sites as it can lead to increased 
attempts at unauthorized access. Finally, the FTC's own Advisory 
Committee could not come to any agreement on what, if any, level of 
access is appropriate for non-sensitive data, under what circumstances, 
and at what costs.
    While the FTC report does provide metrics, it clearly does not nor 
should it be interpreted as evaluating the state of privacy on the 
Internet. Thus, I entirely disagree with the conclusion that privacy in 
cyberspace is woefully inadequate and that legislation is necessary to 
empower the Federal Trade Commission to regulate data practices in e-
commerce.
    Two years ago, close to 10% of all Web sites posted some type of 
privacy policy or described their privacy practices in some way. Today 
that number is close to 90%. That is astonishing! Consumers are now 
better able than ever to determine whether a Web site's data practices 
match their own preferences. The ability of consumers to make 
meaningful privacy choices likewise doesn't guarantee privacy on the 
Net. We clearly need to do more work to make those choices clear and 
easy.
    When asked ``do you care about your privacy?'' an overwhelming 90% 
of Americans will respond that yes, they do. But when you push down on 
those numbers, what you find out is that Americans care deeply about 
the abuse and misuse of their personal financial information, personal 
medical or health information, and information about their children. 
Additionally, Americans are very concerned about identity theft and 
credit card fraud on the Internet. In each of these arenas, Congress 
has either already acted or the FTC already has sufficient authority to 
enforce existing law. You have dealt with collection of data, from or 
about children in the Children's Online Privacy Protection Act which 
went into effect just last month. Last year, you passed the Financial 
Services Modernization Act. While we may argue about the adequacy of 
the financial privacy protections in the Act, clearly the Congress has 
begun addressing financial privacy in that Bill and the FTC has, just 
last week, released its regulations implementing that Act. The 
regulations implementing the Health Insurance Portability and 
Accountability Act are still being drafted. These regulations clearly 
address health and medical privacy. Credit card fraud and identity 
theft are already illegal and should be prosecuted to the fullest 
extent.
    Thus, I believe the FTC's conclusion that privacy on the Internet 
is inadequate is not supported by the facts in their report. That is 
not to say that we, industry and government, can't do a better job 
empowering consumers to protect privacy on the Internet. What is 
needed, I believe, is a commitment by government and industry to 
continue the work started several years ago to make privacy policies 
easy to find, read and understand. To make the promise of meaningful 
choice and control over personal data real--whether through technology 
solutions like P3P, software solutions like Privida and Privaseek, 
enforcement actions under existing law, or filing specific legal gaps. 
What we do not need are sweeping regulations governing the collection 
and use of data, the conditions and methods under which that data use 
can be consented to, the dimensions of access that must be provided to 
data and the level and design of web security. Rather, what I would 
suggest is that Congress continue its work with consumers and industry 
representatives in order to determine how best to reach the last 10 
percent of Internet sites that do not disclose their data practices and 
perhaps begin consideration of a means to create a coherent and simple 
standard for privacy disclosures across all Internet sites. Congress 
has wisely refrained from delegating to any agency enormous regulatory 
authority over the Internet. When Congress has seen a problem, it has 
specifically addressed the problem. If there is any problem with 
privacy for non-sensitive data on the Internet, it is the lack of 
ubiquity in the posting of privacy policies and inconsistent and often 
complicated disclosure statements. Neither of these problems is 
successfully addressed through an enormous regulatory undertaking. 
Whatever solutions Congress, industry and consumers come to that will 
make privacy choices on the Internet ubiquitous, the solutions must be 
technology neutral, market driven, and hospitable to the online 
environment.
    Those who sit before you and talked about self-regulation as a 
failure and legislation as the answer, or self-regulation as a panacea 
and legislation as repugnant, are in my view, clearly missing the 
point. The point in the information age has to be how can American 
consumers, whether they are consuming medical information, financial 
information, or other commercial information, protect themselves and 
their privacy desires. In some instances, there will be technological 
solutions. In some instances, there may be best practices, and in other 
instances, there may be loopholes in existing law that need to be 
closed or an absence of law altogether that must be filled.
    Too often the privacy debate has been polarized between those who 
wish to prohibit the use of personal information for any and all 
purposes, and those who wish to exploit the use of personal information 
for any and all purposes. Neither of these postures addresses the 
increasing concerns of Americans regarding the protection of their 
personal privacy while allowing for its beneficial use. Neither of 
these polar positions realizes that there are benefits and limits to 
the use of personal information. Neither of these positions frankly can 
bring a balanced economically viable and societally appropriate 
conclusion to the privacy debate.

    The Chairman. Thank you very much.
    Mr. Catlett, for the benefit of the Committee perhaps you 
could tell us what Junkbusters is about.

        STATEMENT OF JASON CATLETT, PRESIDENT AND CHIEF 
        EXECUTIVE OFFICER, JUNKBUSTERS CORPORATION, AND 
 VISITING SCHOLAR, COLUMBIA UNIVERSITY DEPARTMENT OF COMPUTER 
                            SCIENCE

    Mr. Catlett. I would be pleased to, Senator. Junkbusters is 
a Web site where people go for information about how to stop 
junk communications, such as junk e-mail, junk telemarketing 
calls, junk faxes, unwanted junk mail, and so forth.
    The Chairman. It sounds to me like you are doing the Lord's 
work, Mr. Catlett.
    [Laughter.]
    Mr. Catlett. Thank you, sir.
    Senattor Burns. Maybe we do not have to pass the spamming 
bill then?
    Mr. Catlett. I strongly recommend that you do pass 
something like H.R. 3113 without the provision of labeling. I 
think that is very much needed.
    There are those who say that technological solutions for, 
for example, filtering out junk e-mail will suffice. But I can 
tell you, after running this Web site for 4 years and 
publishing software to help people protect their privacy, 
publishing information about how to remove cookies, how to stop 
junk phone calls and so forth, I can tell you that technology 
is not going to stop the death of privacy in this country.
    Furthermore, self-regulation is also not alone or with 
technology going to stop the erosion of privacy. It is 
necessary to have laws that give individuals the right to 
protect their own interests.
    The Chairman. You do not believe that the FTC has existing 
authority?
    Mr. Catlett. I do not believe they have sufficient 
authority to require sites to, for example, stop selling your 
telephone number to telemarketers when you tell them if the 
site's policy is stated as they will do that or they do not 
state that. There is nothing you can do, and we get e-mail at 
Junkbusters from harassed mothers in West Virginia who say, how 
can I get these telemarketers to stop calling me?
    Mere notice is not enough. The doctrine that all actions 
can be taken on the basis of fraud is simply mistaken, I think.
    There has been a lot of discussion about online and offline 
worlds and I would like to relate a little experience when I 
used to work at AT&T Bell Labs. I came here in 1992 to work on 
research on marketing and data bases. That work was governed by 
very strict laws about what could be done with people's phone 
call records. Suppose that Congress had not passed those laws 
to protect the privacy of people when they use the phone 
system.
    Well, we would have a situation similar to what we have 
today on the Internet, where we are reading headlines about the 
terrible things that phone companies are doing. Instead of 
Doubleclick, it would be some company--I will fictionally call 
it Orwell Long Distance--that is spying on the phone customers.
    For example, it might have speech recognition technology 
that listens to the key words that you speak in your phone 
conversations with business and uses them to target more 
interesting telemarketing calls to you. It might analyze the 
telephone numbers that you call, look them up in the Yellow 
Pages categories, and see what kind of categories of products 
you are interested in, and sell that information to 
cataloguers.
    Now, if they did that people would be outraged and it would 
be simply illegal. But analogous practices on the web are 
prevalent from companies such as Doubleclick.
    The Federal Trade Commission's report has been criticized 
by some people as understating the amount of progress that has 
been made. But if you look at the analysis of, say, Forrester 
Research, an independent industry analysis firm, they actually 
paint a much bleaker picture of the amount of privacy 
protection that has been provided by industry. Forrester called 
many of these policies a joke and said that they serve to 
protect the interests of the companies rather than consumers. 
The Electronic Privacy Information Center has also done a 
series of excellent reports that come to the same conclusion.
    So to my mind the FTC's conclusion that legislation is 
necessary is absolutely unassailable. We need legislation. What 
kind of legislation is needed? Well, the Online Privacy 
Alliance's four principles are not sufficient. Merely having 
notice, offering choice, some sort of weak access, and some 
sort of security is not enough. What is needed is in many cases 
to ask the consent of the person concerned before using his or 
her information.
    That is one of the great principles of the bill before you, 
the Consumer Privacy Protection Act. It furthermore 
establishes, would establish, standing institutions that look 
to the privacy issue beyond the trade issue. Most importantly, 
it gives individuals a private right of action so that they can 
defend their own interests when their privacy is violated.
    My own major criticism of the bill is that it preempts 
State law. I think it is entirely proper to allow the States 
their traditional role of laboratories of legislative 
innovation.
    Privacy is a fundamental human right and Congress with this 
bill now has the opportunity to head off the demise of that 
right. It is really clear to me that, looking at the U.S. as 
someone who was not born here, that the world looks to the U.S. 
as a Nation that deeply respects human rights and individual 
liberties, and the citizens of this country do not have enough 
rights to defend their own privacy in cyberspace.
    So I think that you all bear a great responsibility for 
determining whether the United States' leadership will extend 
into cyberspace and whether American citizens' rights will be 
preserved into the twenty first century.
    Thank you.
    [The prepared statement of Mr. Catlett follows:]

  Prepared Statement of Jason Catlett, President and Chief Executive 
   Officer, Junkbusters Corporation, and Visiting Scholar, Columbia 
               University Department of Computer Science

    My name is Jason Catlett, and I am President and CEO of Junkbusters 
Corp., a for-profit dot com company working to promote privacy. I'm 
very grateful to the Senate for this opportunity to discuss with you 
how to protect privacy in the Internet age.
    I came to this country from Australia eight years ago to join the 
computer science research staff at AT&T Bell Laboratories. Since I 
founded Junkbusters in 1996, the company has published advanced 
software and provided services and information to help people defend 
their own privacy. These resources have been used by hundreds of 
thousands of Americans. Based on feedback from people across this 
country, and my own investigations, I have been led to the conclusion 
that technical solutions to the challenges of privacy will not prevent 
the death of American privacy online. It is clear to me that 
legislation is appropriate and necessary to protect privacy on the 
Internet.
    My work in marketing and databases at AT&T Bell Labs was governed 
by strict laws to protect the privacy of telephone subscribers. The 
Internet still has few corresponding laws, so companies are engaging in 
practices that would be regarded as unacceptable and illegal on a phone 
network.
    Collectively, this commercial surveillance is having the tragically 
perverse consequence of scaring off consumers from the entire medium 
rather than attracting them to a particular site. The Harris/Business 
Week polls and many others since 1998 have found that fear for privacy 
is a major or primary reason consumers give for not going online, and 
for not participating in e-commerce. Their 2000 poll showed a strong 
majority of Americans favoring new privacy legislation. Forrester 
Research, a highly regarded firm of technology analysts whose 
reputation has been built by providing accurate research and advice to 
companies, has harshly criticized the poor standards of privacy 
protection online, finding in September 1999 that 90 percent of Web 
sites fail to comply with basic privacy principles. Forrester called 
most privacy policies ``a joke'' and concluded that ``the vast majority 
of such policies, like those of the Gap, Macy's and JC Penney, use 
vague terms and legalese that serve to protect companies and not 
individuals.'' These are not the words of some bleeding heart privacy 
advocate, but of hard-nosed analysts working for a company whose long-
term success heavily depends on understanding and promoting the growth 
of Internet commerce. In October 1999 Forrester published a report 
finding that ``Nearly 90% of online consumers want the right to control 
how their personal information is used after it is collected. This 
desire for online anonymity cuts across consumers from a broad range of 
demographic backgrounds, including gender, income, and age. 
Surprisingly, these concerns change very little as consumers spend more 
time online.'' It is not ignorance that is causing Americans to worry. 
It is a rational assessment of the lack of control over their personal 
information, and the paucity of recourse available to them if it is 
misused.
    This privacy problem will not go away by itself because the 
economic incentives of individual companies work against it. As an 
example, providing customers with an opt-out from a list of phone 
numbers being sold to telemarketers means both forgoing future revenue 
and incurring a capital cost to set up an opt-out system. Companies can 
ill afford to unilaterally jump ahead of their competitors, even though 
the sums of money are minor compared to the increase in participation 
that would result from a market where privacy rights are widely 
respected. The idea that consumer demand will force companies to offer 
privacy protections is naive and simply not supported by empirical 
evidence in surveys. What company is going to produce advertising copy 
like the following? ``Buy books from us and we will give you a choice 
in whether we sell your phone number to telemarketers.'' As 
Commissioner Anthony wisely observed in a statement Monday, legislation 
of the kind recommended by the FTC ``would reward those sites that have 
offered real privacy protections and require all others to meet basic 
privacy standard.''
    We are facing a tremendous loss of both economic opportunity, and 
of our fundamental human right to privacy. The only way to stop this 
tragedy is to require all companies to respect the privacy of their 
customers and prospects. And that is an entirely proper thing for the 
federal government to do.
    On the Internet this loss is particularly acute, but is obscured by 
technical complexity. Let me describe one example by analogy.
    Online advertisers build up profiles based on where people go, what 
they look for, and how they behave on the Net. Imagine if Congress had 
not passed laws to protect the privacy of telephone users. The 
headlines would be full of the kind of privacy horror stories we see 
today about the Internet. We might see a telco that I will fictionally 
name Orwell Long Distance using speech-recognition technology to spot 
keywords in your conversations with businesses in order to target you 
with more interesting telemarketing calls. OLD might look up the yellow 
pages categories of the numbers you frequently call, and sell that 
information to junk mailers to decide the kinds of catalogs you're less 
likely to throw away. This sounds absurd to us now, but on the Web, 
equivalent practices abound, unrestrained.
    Banner ad companies get to see the specific Web pages people visit, 
plus the keywords they type into search engines and other forms. They 
track individual PCs using unique identifiers called ``cookies'' placed 
on Web browsers. Most people haven't heard these companies' names, but 
some of them have started identifying people by name. Large profiles 
that were previously gathered with just an anonymous identifier are 
being linked to a street address, and phone number, and e-mail address.
    If Orwell Long Distance were unencumbered by present phone privacy 
laws, its lobbyists would be telling Congress that any attempt to 
restrict the free flow of information on the international phone system 
would be futile, and could result in the collapse of toll-free 
ordering. But you would wisely dismiss that claim and judge that the 
greater economic good requires that people have confidence that their 
privacy is protected by law when they do business by phone.
    It would be silly to expect consumers to defend themselves from 
Orwell Long Distance by using their own voice scramblers and payphones, 
or indeed technology from OLD itself. Suppose OLD designed a device 
that could be held up as a technological solution to the privacy 
concerns of phone subscribers. The result might be rather like a caller 
ID box, but in addition to displaying to the name and number of the 
calling party, it would indicate the degree of privacy being offered by 
the various carriers involved in the call. The called party would then 
supposedly be given ``choice'' on whether to pick up and speak to her 
mother for example, or have her call automatically rejected because it 
doesn't meet her daughter's privacy ``preferences.'' This scheme would 
not protect privacy on the phone, and its Internet equivalent, P3P, 
will not protect privacy online.
    What people need are simple, predictable standards, not more 
complexity, just as businesses need simple predictable copyrights. Both 
privacy and copyright law accommodate more complex arrangements 
whenever needed, with the consent of the parties involved.
    The comparison with copyright is useful in dismissing many 
commonly-heard objections to privacy legislation. ``We mustn't impede 
the free flow of information, so privacy/copyright laws are bad.'' On 
the contrary, such laws promote participation in the information 
economy, by protecting the rights of the participants. ``The Internet 
is international, so privacy/copyright laws are useless.'' On the 
contrary, that is no reason to permit domestic abuses, and 
international treaties can be developed. ``Technology changes quickly, 
so copyright/privacy laws are useless.'' On the contrary, such laws 
should be technology-independent; it is the data that needs protecting, 
not the means of transmission. ``It's impossible to enforce copyright/
privacy laws completely, so we shouldn't have them.'' Of course 
incidental violations will occur, but organizations will not base their 
businesses on piracy/privacy violation, or at least not for long.
    Finally, imagine if Recording Industry Association of America were 
assessing the results of a fictional survey by the Department of 
Commerce showing that more than 80% of U.S. households do not infringe 
music copyrights, and concluding that copyright law should therefore be 
repealed. Preposterous, the RIAA would say. Even 95% of households 
respecting copyright would still leave 5% free to infringe copyrights. 
We must have a law. Won't new technology for preventing the 
unauthorized duplication of CDs provide the answer, a lobbyist against 
one-size-fits-all legislation might ask? No, the RIAA would say. We 
need a law, and we need substantial criminal and civil penalties. The 
Digital Millennium Copyright Act of 1998 was Congress's response to 
this issue.
    In general, information technology produces many more opportunities 
for enabling undesired uses of information than it does for preventing 
it. As someone who has personally designed, coded, documented and 
published privacy-enhancing software, I would be the last to try to 
impede such technologies. The argument by some lobbyists that 
legislation would dampen technological innovation to protect privacy is 
specious. On the contrary, legislation would give companies an 
incentive to adopt technologies that promote privacy. Services for 
assuring anonymity become more valuable in a world where data 
protection is required, because anonymity is an infallible way of 
obviating the misuse of personal information.
The Report and Recommendation of the Federal Trade Commission
    The FTC's report has been criticized by some trade associations as 
understating the level of privacy protection being provided by major 
Internet sites. I believe exactly the opposite is the case. Three years 
of surveys by the Electronic Privacy Information Center plus 
Forrester's assessment in September provide far stronger evidence that 
the average site provides substandard privacy. As an illustration, take 
the issue of access by consumers to information collected about them. 
The Online Privacy Alliance's spokesperson Christine Varney said in a 
press release Tuesday that ``There is no agreed-upon standard for 
access, so how can the FTC measure it?'' They can't. The answer was on 
page 23 of the FTC's report: ``With respect to Access, a site received 
credit if it offers the ability to review, correct, or delete at least 
one item of personal information it has collected--oftentimes simply an 
opportunity to update an e-mail address--without regard to what other 
information a site may have actually collected or compiled.'' Plainly 
the FTC can measure access, and they did. It is significant that the 
FTC were very easy graders, and yet most sites still failed. As to the 
consumer's view of access, a study in April 1999 by AT&T Laboratories 
asked respondents about ``importance of whether the site will allow me 
to find out what info about me they keep in their databases.'' 57% 
replied saying it was very important, 27% somewhat important, 4.2% not 
important, with the rest not responding. The FTC's conclusion that 
legislation is needed to improve consumer confidence in a world where 
most sites are not providing sufficient privacy is simply unassailable. 
What is remarkable is that the majority of Commissioners waited so long 
before recommending legislation.
    The four privacy principles of the Online Privacy Alliance and the 
FTC (namely notice, choice, access and security) are necessary but not 
sufficient to adequately protect privacy. Orwell Long Distance, for 
example, would post a privacy policy (notice), offer an 800 number 
where people can opt out of surveillance (choice), let consumers fill 
out their own change-of-address forms (access), and deliver all its 
lists to telemarketers encrypted (security). Missing are affirmative 
consent and purpose specificity: not using information gathered for one 
purpose (to complete the phone call) for another purpose (to give to 
telemarketers) without gaining affirmative permission. These are among 
the principles endorsed the OECD in 1980 and used as the basis of 
privacy laws in most developed countries, including recently Canada.
The Consumer Privacy Protection Act of 2000
    The Consumer Privacy Protection Act from Senator Hollings and his 
colleagues is a landmark work, making giant strides towards the wide 
application of all these principles, across technologies and across 
market sectors, within a legal framework that will really protect 
privacy in this country.
    The CPPA addresses the problem that privacy policies have become 
``moving targets'' that are constantly subject to change. Requiring 
consent for material changes in use an important part of the principle 
of purpose specificity. In line with this goal, the requirement for 
notice might be waived when the policy change merely narrows the 
purposes to which information is put, rather than widening them.
    The CPPA moves toward addressing the urgent need for standing 
institutions that consider privacy and security policy issues not 
merely in the context of commerce, but also of government, society and 
human rights.
    Very importantly, the bill provides a private right of action, 
which is essential if people are to have the means to protect their own 
interests. Some, but not all enforcement power should vest in agencies 
such as the FTC. Experience with the Telephone Consumer Protection Act 
of 1991 dispels the scare mongering claim that a vast government 
bureaucracy would be needed to curtail privacy violations. The FTC has 
restricted its enforcement actions to cases of fraud (which are indeed 
widespread and severe in that industry). State Attorneys General 
occasionally take action. But it is the precious few individuals who 
file suit in small claims court that have done the most to discourage 
the telemarketing industry from routinely violating the law.
    Finally, to allow further progress, federal laws should not preempt 
state law. A good federal law that allows state Attorneys General 
sufficient enforcement powers will reduce the need for new state-
specific legislation, but the states should not be deprived of their 
traditional role as laboratories of legislative innovation.
    Congress now has before it a comprehensive proposal to head off the 
demise of privacy in this country. It is time for each member of 
Congress to decide whether the right to privacy is worth defending, or 
whether it should be allowed to lapse into a 20th century memory.
    Throughout this nation's history, the world has looked to the 
United States as a bastion of liberty, and to its elected governments 
as defenders of individual rights. Congress now bears a great 
responsibility for determining whether that leadership will extend into 
cyberspace, and whether the American citizen's right to privacy--a 
fundamental liberty--will endure into the 21st century.
    I appreciate the opportunity to speak before you today. I would be 
pleased to answer your questions.
    [A list of references is available at http://www.junkbusters.com/
testimony.html on the Web.]

    The Chairman. Thank you, Mr. Catlett.
    Mr. Berman.

   STATEMENT OF JERRY BERMAN, EXECUTIVE DIRECTOR, CENTER FOR 
                    DEMOCRACY AND TECHNOLOGY

    Mr. Berman. Thank you, Mr. Chairman and Members of the 
Committee. It is a privilege to be here.
    My organization is a civil liberties organization, but also 
an Internet policy organization, and we are trying to maximize 
the democratic potential of the Internet to build a bill of 
rights in cyberspace. We have worked with all of you on 
different issues affecting the Internet, whether it is 
objectionable content and indecency and how to protect the 
rights of adults versus how to protect our children, 
encryption, communications privacy, and here data privacy.
    In every one of those areas we have recognized that the 
Internet is a different paradigm, it is global, it is 
decentralized, and that we need to focus in every one of those 
areas on empowering users and caretakers to protect their 
rights. That is the thrust of every model piece of legislation.
    There is consensus between Senator Burns' effort with 
Senator Wyden a year ago, and the Boucher and Goodlatte effort 
that something needs to be done. All four chairs of the 
Internet Caucus who share that vision of the Internet are 
supporting privacy legislation.
    It is very important to understand that none of that 
legislation is saying government takes over the Internet. All 
the thrust of that legislation is to empower users to protect 
their rights on the Internet. And users cannot protect their 
rights if they have a crazy quilt of notice and obfuscation on 
the net where they do not know what the information policies 
are of those nets, of those Web sites, and they cannot exercise 
the right to choose or opt-in or opt-out of particular 
practices, and there has to be flexibility in that area.
    The legislation I see that has been introduced not only 
provides that baseline information, that information will not 
be provided by 100 percent of the sites until Congress acts, 
because everyone can be a publisher on the Internet. There are 
so many net sites that do not know that privacy is even an 
issue. It is not the last mile, as Christine Varney says, 
because if Yahoo does not know what notice is required and they 
may be suffering from a potential prosecution over their eight 
pages, what about the little Web site?
    Is it not important for the government to set some standard 
so that people on the Internet, the Web sites and consumers, 
know where they are? That is the key part of this legislation.
    You do not have to rely on the heavy hand of government, 
particularly in trying to figure out on the web what notice 
means. You can also rely on self-enforcement and some of the 
web, TrustE and BBBOnLine, they can become safe harbors under 
the legislation. But to move it from 8 percent takeup by the 
industry to 100 percent is going to require some push that they 
know that is a safe harbor, and only Congress can do that.
    If Congress does not act in this area, you are facing 270 
bills in the States, and we have recognized in many areas that 
a crazy quilt of State laws is counterproductive, a burden on 
the Internet, a burden on commerce, a burden on speech, and not 
in the interest of the Internet.
    I think that the companies like AOL and IBM and Microsoft 
and others that we have worked with on their online privacy 
guidelines have done a terrific job and they have moved forward 
and they should be commended for it. But they cannot bear the 
burden and they do not have the resources or the time to drag 
the other Web sites along or to subsidize them or to pick them 
up. That is a role for government, and it is balancing and 
making their practices the best practices as part of 
legislation which will build legislation which maps onto the 
decentralized Internet and preserves and protects and enhances 
the values that we share.
    Thank you.
    [The prepared statement of Mr. Berman follows:]

  Prepared Statement of Jerry Berman, Executive Director, Center for 
                        Democracy and Technology

    Mr. Chairman and members of the Committee, the Center for Democracy 
& Technology (CDT) is pleased to have this opportunity to speak to you 
about the important subject of privacy on the Internet. CDT is a non-
profit, public interest organization that is dedicated to developing 
and implementing public policies to protect civil liberties and 
democratic values on the Internet. CDT has been at the forefront of 
efforts to establish and protect the very high level of constitutional 
protection that speech on the Internet has been afforded by the United 
States Supreme Court in the Reno v. ACLU \1\ decision, and to develop 
sound public policies and technical solutions to protect individual 
privacy.
---------------------------------------------------------------------------
    \1\ American Civil Liberties Union v. Reno, 929 F. Supp. 824, 844 
(E.D. Pa. 1996), aff'd, Reno v. American Civil Liberties Union, 521 
U.S. 844 (1997).
---------------------------------------------------------------------------
    Mr. Chairman, the Internet is at a critical junction in its 
evolution. Although as a popular mass medium the Internet is less than 
ten years old, it is already entering into a period of significant 
transformations. Ensuring privacy on the Internet requires a multi-
faceted approach that draws upon the strengths of technology, self-
regulation, and legislation to deliver to the American public the 
ability to exercise control over their personal information.
    I wish to emphasize four key points this morning:

   Privacy is not a partisan issue. Privacy is a deeply held 
        American value. It is broadly supported by the American public 
        and has frequently been the subject of bi-partisan legislative 
        efforts.

   Privacy and the Internet are ill served by a crazy quilt of 
        standards. Consistency is critical to consumers, businesses, 
        and the character of the Internet. In an environment where 
        everyone is a publisher and a business it is impossible to 
        develop a consistent standard for privacy without legislation. 
        While self-regulatory efforts, auditing, and self-enforcement 
        schemes work for some businesses, on its own it will result in 
        an inconsistent framework of privacy protection.

   Industry leaders should not ignore or carry bad actors or 
        outliers, but rather participate in a system of self-regulation 
        and legislation that ensures a level playing field and 
        predictable standards. Industry leaders would be ill advised to 
        ignore the cost to privacy of bad actors and newcomers. Bad 
        actors will not self-regulate: the clueless or new on the scene 
        may not have the resources or wherewithall to participate in 
        regulating their own behavior. Law is critical to spreading the 
        word and ensuring widespread compliance with fair, privacy 
        protective standards. By building a system of self-regulation 
        and legislation we can create a framework of privacy and 
        instill consumer trust.

   Legislation can and should support self-regulation and 
        technical developments. The tired debate over self-regulation 
        versus legislation does not serve our mutual interest in 
        privacy protection. It is our collective task to develop a 
        legislative privacy proposal that fosters the best industry has 
        to offer through self-enforcement and privacy enhancing tools. 
        Realizing privacy on the Internet demands that we develop a 
        cohesive framework that builds upon the best all three of these 
        important tools offer.

                               I. Privacy

    The critical starting point on the privacy questions is the current 
state of privacy (and citizens' expectations of privacy) and the ways 
in which the evolution of the Internet may threaten privacy principles.
    CDT believes that a key privacy consideration should be 
individuals' long-held expectations of autonomy, fairness, and 
confidentiality, and policy efforts should ensure that those 
expectations are respected online as well as offline.\2\ These 
expectations exist vis-a-vis both the public and the private sectors. 
By autonomy, we mean the individual's ability to browse, seek out 
information, and engage in a range of activities without being 
monitored and identified. Fairness requires policies that provide 
individuals with control over information that they provide to the 
government and the private sector. In terms of confidentiality, we need 
to continue to ensure strong protection for e-mail and other electronic 
communications.
---------------------------------------------------------------------------
    \2\ For a fuller exploration of these issues see, e.g., Testimony 
of Deirdre Mulligan, Staff Counsel of the Center For Democracy & 
Technology, Before the Subcommittee on Communications of the Senate 
Committee on Commerce, Science, and Transportation, July 27, 1999.
---------------------------------------------------------------------------
    As it is evolving, the Internet poses both challenges and 
opportunities to protecting privacy. The Internet accelerates the trend 
toward increased information collection that is already evident in our 
offline world. The trail of transactional data left behind as 
individuals' use the Internet is a rich source of information about 
their habits of association, speech, and commerce. When aggregated, 
these digital fingerprints could reveal a great deal about an 
individual's life. The global flow of personal communications and 
information coupled with the Internet's distributed architecture 
presents challenges for the protection of privacy.

II. The Expectation of Fairness and Control Over Personal Information: 
                     What the FTC's Report Reveals

    When individuals provide information to a doctor, a merchant, or a 
bank, they expect that those professionals/companies will collect only 
information necessary to perform the service and use it only for that 
purpose. The doctor will use it to tend to their health, the merchant 
will use it to process the bill and ship the product, and the bank will 
use it to manage their account--end of story. Unfortunately, current 
practices, both offline and online, foil this expectation of privacy. 
Much of the concern with privacy in electronic commerce stems from a 
lack of robust privacy rules in various sectors of the economy, such as 
financial and health, that handle a treasure trove of sensitive 
information on individuals. Whether it is medical information, or a 
record of a book purchased at the bookstore, or information left behind 
during a Web site visit, information is routinely collected without the 
individual's knowledge and used for a variety of other purposes without 
the individual's knowledge--let alone consent.
    The online environment facilitates the collection of information 
about consumers that offline entities can only dream of. To paraphrase 
Chairman Pitofsky, ``Not only do they know I ordered the steak, but 
they know I considered the salmon and how long it took me to make up my 
mind.'' Recent months have witnessed detail reports, investigations, 
and law suits about the surreptitious collection of personal 
information by businesses--some completely unknown and invisible to the 
consumer. From network advertisers to fraud detection systems, 
profiling Web site visitors is routine. Using a mix of ``cookies,'' 
``web bugs,'' and other monitoring techniques consumers are routinely 
being watched, their activities assessed, and their experience of the 
Internet altered.
    The FTC report released on Monday is the third study to assess the 
state of privacy on the World Wide Web. This year's report is by far 
the most comprehensive study of consumer privacy online. Not only did 
the FTC tally raw numbers, but also, finally, the FTC explored the 
important question of whether improved numbers equal improved privacy 
for consumers. The good news is that progress, in terms of sheer 
numbers, continues. The disappointing news is that the sum is less than 
the parts.

 The head count is improving.
    The constant call by industry, the FTC, and consumers for privacy 
policies has been heeded. Today, consumers are more likely than not to 
find a privacy statement of some sort at Web sites. The number of sites 
sporting a ``privacy policy''--a comprehensive description of a Web 
site's information practices that is located in one place--has risen 
from 2% in 1998 to 62% in 2000. Similarly, more Web sites are providing 
consumers with some information about how they use information 
(referred to as ``information practice statement'' or ``privacy 
disclosure''). In 1998 only 14% of surveyed sites made any statement 
about their use of personal information. This year 79% of the surveyed 
sites posted at least one information practice statement. While 
progress was more modest in other areas, every area witnessed some 
improvement over previous years.

 Notice, choice, access, and security remain the exception not 
        the rule.
    While progress continues, the Web has not witnessed the widespread 
implementation of the Fair Information Practice principles of notice, 
choice, access, and security. (The principles are set forth in detail 
in Appendix A.) While the number of sites meeting this standard has 
doubled--from 10% in 1999 to 20% in 2000--the number represents a small 
portion of total Web sites. It is troubling to note that even at those 
sites that sport a privacy seal from a self-regulatory program 
adherence to these four fair information practices hovers at 52%. And 
of the sites surveyed, 8% participate in a seal program--leaving the 
critical area of self-regulatory enforcement unsettled.

 A lack of clear rules has led to the proliferation of 
    confusing privacy notices that are beyond the reading comprehension 
    skills of the majority of the American public.

    This year the FTC delved into the difficult realm of substantive 
analysis of privacy policies. What they found mirrors CDT's 
experience--and based on reports and e-mail those of consumers as well. 
(Appendix B* includes several examples of Web site privacy policies 
that contain confusing and contradictory statements.) Privacy policies 
can be exceedingly difficult to decipher. Several articles have 
documented the difficulties faced by consumers seeking to understand 
the protections a Web site affords them by reading privacy policies.\3\ 
As Chairman Pitofsky stated in a recent USATODAY.com story, ``Some 
sites bury your rights in a long page of legal jargon so it's hard to 
find them and hard to understand them once you find them. Self-
regulation that creates opt-out rights that cannot be found (or) 
understood is really not an acceptable form of consumer protection.'' 
\4\
---------------------------------------------------------------------------
    * Appendix B has been retained in the Committee files.
    \3\ See, Will Rodger, ``Privacy isn't public knowledge: Online 
policies spread confusion with legal jargon,'' USATODAY.com, May 1, 
2000 /www.usatoday.com/life/cyber/tech/cth818.htm>; The Industry 
Standard, March 13, 2000, at 208-9.
    \4\ Will Rodger, ``Privacy isn't public knowledge: Online policies 
spread confusion with legal jargon,'' USATODAY.com, May 1, 2000. 
/www.usatoday.com/life/cyber/tech/cth818.htm>
---------------------------------------------------------------------------
    While some sites may be actively attempting to confuse consumers--
for example CDT identified several privacy policies that use common 
terms in a misleading fashion and others that contain contradictory 
statements. In general, we believe that Web sites are in the unenviable 
position of trying to assuage legitimate public concern with privacy 
and ensure their attorneys that in doing so they will not 
unintentionally create a liability disaster. The rock and the hard 
place that many Web sites find themselves in creates a tendency toward 
legalese, over and under disclosure, and hedging. When doing the right 
thing creates liability that those who sit still don't face, notices 
resemble legal disclaimers rather than vehicles for consumer education 
and empowerment.
    Regardless of the intent, consumers interests are ill served by 
policies that are written in complex, vague language. Guidelines on the 
essential elements for inclusion in a notice would help both consumers 
and businesses. It would likely result in shorter more direct 
statements for consumers, and, for businesses, it would take some of 
the risk out of the process of writing a privacy policy notice.

 Surreptitious data collection techniques continue to grow.
    Over the past twelve months privacy concerns surrounding the use of 
technology to track and profile individuals has taken center stage. 
From the joint FTC and Department of Commerce workshop on Online 
Profiling, to the massive online consumer protest of Doubleclick's 
withdrawn proposal to tie online profiles to individuals' offline 
identities, to the private lawsuits against Realnetworks, to State 
Attorneys' General actions against Doubleclick--it is clear that 
policy-makers and the public are concerned with the use of technology 
to undermine privacy expectations.
    There is reason for concern. Third-party cookies, as the FTC Web 
sweep reports, are routinely found at commercial Web sites. In fact, 
consumers visiting 78% of the 100 most popular Web sites will be 
confronted with cookies from entities other than the Web site. While 
the growth of third-party cookies continues, less than 51% of the top 
100 sites that set third-party cookies tell consumers about this 
practice.
    Similarly, the use of ``web bugs'' or clear gifs--invisible tags 
that Internet marketing companies use to track the travels of Internet 
users--has grown exponentially over the past year. Richard Smith, a 
well-known computer security expert, in his presentation to the 
Congressional Privacy Caucus stated that in January 2000 approximately 
2000 ``web bugs'' were in use on the Web (according to a search using 
Alta vista), but in just 5 months that number multiplied ten-fold to 
27,000.\5\ While the FTC did not look for ``web bugs'' or for 
statements about them, it is unlikely that Web sites are telling 
consumers about this new tracking device.
---------------------------------------------------------------------------
    \5\ Richard M. Smith, Statement at the Congressional Privacy Caucus 
briefing, May 18, 2000. See, http://www.tiac.net/users/smith for 
additional information on ``web bugs'' and other privacy and security 
issues.
---------------------------------------------------------------------------
                 III. Bringing Privacy to the Internet

    Privacy as discussed above is a complex concept. It encompasses our 
right to withhold information, our interest in maintaining confidences 
in information we willingly choose to disclose, as well as our right to 
walk--or surf--the streets without having every step captured, analyzed 
and tied to our identity forevermore. Protecting these three 
interests--autonomy, fairness, and confidentiality requires a wise use 
of resources in the public and private sector. Of utmost importance it 
demands that we empower individuals with the information, tools, and 
protections necessary to exercise meaningful control over their 
personal information. To deliver privacy we must build a program of 
self-regulation and legislation, and support the widespread deployment 
of privacy enhancing technology.

A. Enforceable Fair Information Practices are Essential in the Online 
        Marketplace

    The Federal Trade Commission's latest report confirmed what 
advocates, industry representatives and the public knew: privacy on the 
Internet is far from a reality. The Federal Trade Commission's five 
year focus on privacy has raised the level of attention and concern, 
but has not delivered anything close to comprehensive compliance by 
businesses operating online. Despite commendable efforts such as BBB 
Online and TrustE, judged by the full set of agreed upon privacy 
principles the overwhelming majority of Web sites have not delivered 
privacy to the marketplace.
    Numerous surveys have documented the public's overwhelming concern 
with privacy online. Many responsible industry actors are engaged in 
efforts to craft privacy rules; unfortunately many other companies have 
yet to take the actions necessary to protect privacy. We have the 
opportunity to develop privacy rules that establish strong protections 
for individuals, a fair baseline for a competitive marketplace, and a 
framework of trust for electronic commerce. Embedding these rules in 
federal legislation will not be easy, but it can, and ultimately must, 
be done.
    If Congress fails to act on the FTC's recommendation, there is no 
doubt that the states will fill the gap. At last count over 200 privacy 
bills were introduced at the state level. While many do not directly 
deal with online privacy, several do. The states have become 
increasingly active in protecting consumer privacy and if left with a 
vacuum it is likely that they will step in. A strong federal law is in 
the interest of consumers, industry and the Internet. If the rules 
provide strong protections for privacy, consumers and businesses would 
both benefit from the certainty that a federal approach affords. In 
addition, the borderless nature of communication and commerce on the 
Internet is best approached with common rules. A patchwork of 
inconsistent and conflicting standards could increase consumer 
confusion, burden businesses, and interfere with the relatively 
seamless operation of the Internet.

B. Delivering on Technology's Promise: Ubiquitously Available, Tools 
        that Empower Consumers to Make Real-Time, Flexible Decisions 
        About Their Personal Information.

1. Technology is critical to consumer privacy on the Internet.
    The specifications, standards, and technical protocols that support 
the operation of the Internet offer a new way to implement policy 
decisions. By building privacy into the architecture of the Internet, 
we have the opportunity to advance public policies in a manner that 
scales with the global and decentralized character of the network. As 
Larry Lessig repeatedly reminds us, ``(computer) code is law.''
    Accordingly, we must promote specifications, standards and products 
that protect privacy. A privacy-enhancing architecture must 
incorporate, in its design and function, individuals' expectations of 
privacy. For example, a privacy-protective architecture would provide 
individuals the ability to ``walk'' through the digital world, browse, 
and even purchase without disclosing information about their identity, 
thereby preserving their autonomy and ensuring the expectations of 
privacy. A privacy-protective architecture would enable individuals to 
control when, how, and to whom personal information is revealed. It 
would also provide individuals with the ability to exercise control 
over how information once disclosed is subsequently used. Finally, a 
privacy-protective Internet architecture would provide individuals with 
assurance that communications and data will be technically protected 
from prying eyes.
    While there is much work to be done in designing a privacy-
enhancing architecture, some substantial steps toward privacy 
protection have occurred. Positive steps to leverage the power of 
technology to protect privacy can be witnessed in tools like the 
Anonymizer, Crowds, and Onion Routing, which shield individuals' 
identity during online interactions, and encryption tools such as 
Pretty Good Privacy that allow individuals to protect their private 
communications during transit.
    The World Wide Web Consortium's Platform for Privacy Preferences 
(``P3P'') is also a promising development. The P3P specification will 
allow individuals to query Web sites for their policies on handling 
personal information and to allow Web sites to easily respond. While 
P3P does not drive the specific practices, it is a standard designed to 
promote openness about information practices, to encourage Web sites to 
post privacy policies, and to provide individuals with a simple, 
automated method to make informed decisions. Through settings on their 
Web browsers, or through other software programs, users will be able to 
exercise greater control over the use of their personal information.
    An important milestone is June 21. On that day, major Internet 
companies will offer the first public demonstration of a new generation 
of Web-browsing software based on P3P, designed to give users more 
control over their personal information online. We are hopeful that P3P 
products will provide consumers with increased control over their 
personal information. Technologies must be a central part of our 
privacy protection framework, for they can provide protection across 
the global and decentralized Internet where law or self-regulation 
alone may prove insufficient.

2. Tools must reflect the diversity of consumers' privacy needs.
    Privacy is not the same as secrecy. Tools must support individuals' 
needs to shield their identity, reveal certain information to a limited 
set of entities, ensure information is not compromised in transit, and 
protect information stored on their own computer. While tools are 
coming to market that reflect consumers' varied needs for privacy, 
there is much work to be done.
    The Internet Engineering Task Force (IETF) is undertaking a 
critical privacy effort. IETF is working on two standards that would 
create new guidelines for the appropriate use of cookies. While cookies 
are helpful for Web sites looking to maintain relationships with 
visitors, they have been implemented in ways that give users very 
little control and have been used by some to subvert consumers' 
privacy. On most browsers, users are given only the option to either 
accept or reject all cookies or to be repeatedly bombarded with 
messages asking if it is OK to place a cookie.
    The IETF is considering two complementary ``Internet drafts'' that 
would encourage software makers to design cookies in ways that give 
users more control. These drafts lay out guidelines for the use of 
cookies, suggesting that programmers should make sure that:

   the user is aware that a cookies is being maintained and 
        consents to it,

   the user has the ability to delete cookies associated with a 
        Web visit at any time,

   the information obtained through the cookie about the user 
        is not disclosed to other parties without the user's explicit 
        consent, and

   cookie information itself cannot contain sensitive 
        information and cannot be used to obtain sensitive information 
        that is not otherwise available to an eavesdropper.

    The drafts say that cookies should not be used to leak information 
to third parties nor as a means of authentication. Both are common 
practices today. The IETF is expected to make its decision to move 
forward with these, and perhaps other cookie specifications, before the 
end of the summer and will invite public comments at that time.\6\
---------------------------------------------------------------------------
    \6\ The draft can be found at: http://www.ietf.org/internet-drafts/
draft-iesg-http-cookies-03.txt and http://www.ietf.org/internet-drafts/
draft-ietf-http-state-man-mec-12.txt.
---------------------------------------------------------------------------
    The recent report of the Federal Trade Commission's Advisory 
Committee on Online Access and Security recommended that steps be taken 
to improve security. The Committee's report highlighted the need for 
Internet businesses to develop robust security practices that protect 
data from both internal and external threats and protect customer data 
during both transit and storage. Specifically the Advisory Committee 
recommended that:

   Each commercial Web site should maintain a security program 
        that applies to personal data it holds.

   The elements of the security program should be specified 
        (e.g., risk assessment, planning and implementation, internal 
        reviews, training, reassessment).

   The security program should be appropriate to the 
        circumstances. This standard, which must be defined case by 
        case, is sufficiently flexible to take into account changing 
        security needs over time as well as the particular 
        circumstances of the Web site--including the risks it faces, 
        the costs of protection, and the data it must protect.

    It is critically important that standard setting bodies support the 
development of privacy enhancing technologies and robust security 
standards. It is equally important that businesses bring these 
important developments to the mainstream market in products that are 
accessible and user-friendly for individual consumers and the myriad of 
small shop-keepers establishing Web sites.

3. Tools must be widely available and easy to use.
    In the area of child protection, industry and the public interest 
community have collaborated on efforts to bring tools and information 
to consumers through common resources, educational campaigns and other 
efforts. Similarly, privacy enhancing tools must be widely deployed if 
they are to truly benefit all consumers. While experienced Internet 
users may avail themselves of today's tools, it is unlikely that 
newcomers can find them, let alone use them effectively. As privacy 
enhancing technologies come to market ensuring their wide-spread 
availability and use should be a priority.

  IV. Conclusion: Protecting Privacy on the Internet Requires a Multi-
    pronged Approach that Involves Self-regulation, Technology, and 
                              Legislation.

    On self-regulation, we must continue to press the Internet industry 
to adopt privacy policies and practices, such as notice, consent 
mechanisms, and auditing and self-enforcement infrastructures. We must 
realize that the Internet is global and decentralized, and thus relying 
on legislation and governmental oversight alone simply will not assure 
privacy. Because of extensive public concern about privacy on the 
Internet, the Internet is acting as a driver for self-regulation, both 
online and offline. Businesses are revising and adopting company-wide 
practices when writing a privacy policy for the Internet. Efforts that 
continue this greater internal focus on privacy must be encouraged.
    On the technology front, while the Internet presents new threats to 
privacy, the move to the Internet also presents new opportunities for 
enhancing privacy. Just as the Internet has given individuals greater 
ability to speak and publish, it also has the potential to give 
individuals greater control over their personal information. We must 
continue to promote the development of privacy-enhancing and empowering 
technology, such as the World Wide Web Consortium's Platform for 
Privacy Preferences (``P3P''), which will enable individuals to more 
easily read privacy policies of companies on the Web, and could help to 
facilitate choice and consent negotiations between individuals and Web 
operators.
    On the public policy front, we must adopt legislation that 
incorporates into law Fair Information Practices--long-accepted 
principles specifying that individuals should be able to ``determine 
for themselves when, how, and to what extent information about them is 
shared.'' \7\ Legislation is necessary to guarantee a baseline of 
privacy on the Internet, but it is not one-size-fits-all legislation. 
Congress must do more to protect privacy in key sectors such as privacy 
of medical records. For consumer privacy on the Internet--and we 
believe more broadly--there needs to be baseline standards and fair 
information practices to augment the self-regulatory efforts of leading 
Internet companies, and to address the problems of bad actors and 
uninformed companies. We also stress that legislation is needed to 
raise the standards for government access to citizens' personal 
information increasingly stored across the Internet, ensuring that the 
4th Amendment continues to protect Americans in the digital age.\8\
---------------------------------------------------------------------------
    \7\ Alan Westin. Privacy and Freedom (New York: Atheneum, 1967) 7.
    \8\ See, Testimony of Deirdre Mulligan, Staff Counsel of the Center 
for Democracy & Technology, before the Subcommittee on Courts and 
Intellectual Property of the House Committee on the Judiciary, March 
26, 1998, at 11-13 (concerning disclosure of subscriber information to 
the U.S. Navy).
---------------------------------------------------------------------------
    Several proposals are circulating in Congress today. Members of 
this Committee have introduced two important bills: Senator Hollings 
``Consumer Privacy Protection Act'' (S. 2606); and, Senators Burns and 
Wyden ``Online Privacy Protection Act'' (S. 809). We believe that the 
outlines of sound privacy protection for the online environment have 
taken shape and look forward to working with this Committee on these 
efforts.
    The history of the Internet is that policy regimes are first 
created by consensus among a broad cross section of the community. CDT 
is committed to participating in any process that helps to build a new 
social contract embodying democratic values in the emerging online 
world. The work of the Federal Trade Commission--through its public 
workshops, hearings, and its recent Advisory Committee on Online Access 
and Security--provides a model of how to vet issues and move toward 
consensus. We look forward to working with this Committee, as well as 
others, the industry and the public interest community to build a 
cohesive system of privacy protections for the online environment. 
Thank you for the opportunity to participate in this timely hearing.

                               Appendix A

    The Code of Fair Information Practices as stated in the Secretary's 
Advisory Comm. on Automated Personal Data Systems, Records, Computers, 
and the Rights of Citizens, U.S. Dept. of Health, Education and 
Welfare, July 1973:

        1. There must be no personal data record-keeping systems whose 
        very existence is secret.

        2. There must be a way for an individual to find out what 
        information about him is in a record and how it is used.

        3. There must be a way for an individual to prevent information 
        about him that was obtained for one purpose from being used or 
        made available for other purposes without his consent.

        4. There must be a way for the individual to correct or amend a 
        record of identifiable information about him.

        5. Any organization creating, maintaining, using, or 
        disseminating records of identifiable personal data must assure 
        the reliability of the data for their intended use and must 
        take precautions to prevent misuse of the data.

    The Code of Fair Information Practices as stated in the OECD 
guidelines on the Protection of Privacy and Transborder Flows of 
Personal Data http://www.oecd.org/dsti/sti/ii/secur/prod/PRIV_EN.HTM:

        1. Collection Limitation Principle: There should be limits to 
        the collection of personal data and any such data should be 
        obtained by lawful and fair means and, where appropriate, with 
        the knowledge or consent of the data subject.

        2. Data quality: Personal data should be relevant to the 
        purposes for which they are to be used, and, to the extent 
        necessary for those purposes, should be accurate, complete and 
        kept up-to-date.

        3. Purpose specification: The purposes for which personal data 
        are collected should be specified not later than at the time of 
        data collection and the subsequent use limited to the 
        fulfillment of those purposes or such others as are not 
        incompatible with those purposes and as are specified on each 
        occasion of change of purpose.

        4. Use limitation: Personal data should not be disclosed, made 
        available or otherwise used for purposes other than those 
        specified in accordance with the ``purpose specification'' 
        except: (a) with the consent of the data subject; or (b) by the 
        authority of law.

        5. Security safeguards: Personal data should be protected by 
        reasonable security safeguards against such risks as loss or 
        unauthorized access, destruction, use, modification or 
        disclosure of data.

        6. Openness: There should be a general policy of openness about 
        developments, practices and policies with respect to personal 
        data. Means should be readily available of establishing the 
        existence and nature of personal data, and the main purposes of 
        their use, as well as the identity and usual residence of the 
        data controller.

        7. Individual participation: An individual should have the 
        right: (a) to obtain from a data controller, or otherwise, 
        confirmation of whether or not the data controller has data 
        relating to him; (b) to have communicated to him, data relating 
        to him: within a reasonable time; at a charge, if any, that is 
        not excessive; in a reasonable manner; and, in a form that is 
        readily intelligible to him; (c) to be given reasons if a 
        request made under subparagraphs (a) and (b) is denied, and to 
        be able to challenge such denial; and, (d) to challenge data 
        relating to him and, if the challenge is successful to have the 
        data erased, rectified completed or amended.

        8. Accountability: A data controller should be accountable for 
        complying with measures which give effect to the principles 
        stated above.

    The Chairman. Thank you, Mr. Berman.
    Mr. Weitzner. Is that the proper pronunciation?

STATEMENT OF DANIEL J. WEITZNER, TECHNOLOGY AND SOCIETY DOMAIN 
               LEADER, WORLD WIDE WEB CONSORTIUM

    Mr. Weitzner. That is exactly correct.
    The Chairman. Welcome, Mr. Weitzner.
    Mr. Weitzner. Thank you, Chairman McCain. It is an honor to 
be here and I am very pleased to be part of this discussion.
    My testimony, which I have submitted and I will not read 
all of, makes three very basic points. First, and I think based 
on the discussion we do not even have go to through this any 
further, the increasing sophistication of web technology 
enables the collection of large volumes of personal 
information, both directly from users and in the background in 
some way or another. Some characterize it as surreptitious, 
others characterize it as convenient. But there is an 
increasing volume of information collected.
    Second, the World Wide Web Consortium, the organization I 
work for, which is the group that sets technical standards for 
the web and includes over 420 members from industry, academia, 
research, consumer organizations all around the world, 
recognized the increasing consumer concern over privacy and we 
therefore launched a project called P3P, the Platform for 
Privacy Preferences, which will enable the marketplace to 
deliver software tools and services that enhance users' 
knowledge of Web sites' information practices and give users 
more control over their personal information.
    Finally, I hope that we can dispense with the false 
dichotomies, the false choices, presented between law, 
regulation, technology, industry practices, or self-regulation. 
I think it should be clear to us that some balance of all of 
those factors is needed. No one of those is going to solve the 
problem--not law, not self-regulation, not technology. So we do 
not need to worry about any one of them being sufficient. I 
think we should all just stipulate that we need to find the 
right combination.
    I am going to----
    The Chairman. You are saying right combination of 
legislation and regulation? Is that what you are saying?
    Mr. Weitzner. Well, I suppose that is a further distinction 
that I would probably leave to you. I think we need some kind 
of legal baseline. Whether that is implemented solely in 
statute or through regulation is something I would leave to 
you. But I think we need a legal framework in which to operate 
here along with technology tools and responsible industry 
practices.
    Let me dispense with the discussion of all the myriad ways 
that information, personal information, can be collected online 
because I think there is a general appreciation for that point, 
and I want to talk directly about W3C's efforts to build 
technology tools that will help enhance users' privacy 
experiences and particularly, given all the discussion we have 
had, we have heard already, about the complexity of privacy 
policies, the difficulty of finding them, the number of words 
that one has to get through to get to the bottom line of the 
policy, let me talk in a little bit more detail about W3C's 
Platform for Privacy Preferences.
    Through this project, which is really a project to develop 
technical standards that address privacy, we hope to enable the 
development of a variety of tools and services, produced by the 
marketplace, that give users greater control over personal 
information and thereby enhance trust between web services and 
individual users.
    P3P enables services, whether they are in web browsers, in 
web servers, in other pieces of software or services that users 
come across, that will enhance user control by putting privacy 
policies where users can find them, by presenting the policies 
in a form that users can understand, and, most importantly, by 
enabling users to act on the policies that they see more 
quickly.
    For e-commerce services there are benefits as well. P3P can 
be used to make the browsing experience more seamless. Any web 
designer who is concerned about offering a product or a service 
to someone who visits their site has a difficult balancing 
task, even if they want to provide the maximum information 
about their privacy policy to that user. It is not easy to 
present, and I think it is a fair point that it is sometimes 
complicated to articulate in prose, especially prose readable 
to the non-experts out there, exactly what information 
practices sites are engaged in, and I think it is quite fair to 
say that, whether it is Yahoo or any of the other really 
sophisticated, exciting services, they do a lot of different 
things with your personal information in a lot of different 
places, and to try to catalogue all that in one single place is 
bound to be complex.
    So with P3P what we have tried to do is to enable the 
association of particular web pages and privacy policies that 
apply to what is going on at that point on the web, so that 
when you are asked to fill out a form right there your browser 
will be able to tell you, not necessarily in prose terms but 
with graphical icons or some other means, exactly what is going 
to happen there when you submit that form data.
    Think if you will for a minute about the experience we have 
had with security on the web. Several have referred to the fact 
that there was great concern about providing credit card 
numbers on the web by a number of users. How was that concern 
alleviated? In some part it was alleviated by, I think, a very 
broad education campaign. In some part, though, it was 
alleviated because browsers added tools that told users that 
their transaction was secure.
    No one on this Committee may know the acronym SSL. That is 
the technology that secures the communication between a user 
and a Web site. But I think vast numbers of people who use the 
web recognize the little lock or the little key icons and know 
when that lock or that key is closed they should feel 
comfortable putting their credit card number onto that page.
    We are looking to do the same kind of thing for privacy, to 
be able to represent to users exactly what is going on at 
exactly the point in the Web site they are at, rather than 
forcing them to go back and read through the Web site and click 
through. I was amused at the description of the number of 
clicks. I have never actually counted them, and the number of 
words, but I think that is exactly the problem that we are 
trying to address with P3P.
    Finally, P3P can help to assist with three of the four 
information practices that the FTC report has outlined. 
Obviously, notice; it provides a capable for presenting easy-
to-understand notice to users. It helps users to make a choice.
    Finally, it tells--it has the vocabulary to tell users 
exactly where they can go, what they have to do, to get access 
to their personal information. Security is dealt with in other 
parts of web standards, so we have not addressed it directly in 
P3P.
    I would say that the question of access is complex and P3P 
does not pretend to provide a mechanism to enable access, but 
we do provide a way for users to understand how to go and get 
access.
    I want to just close by saying that I think that this 
Committee does face very difficult questions regarding what 
legal or regulatory framework, if any, is best to address 
privacy on the web. There are obviously a variety of options 
before you and I am not here to support or oppose any 
particular approach. I would urge, though, that with or without 
legislation, with or without regulation, web users both in the 
United States and around the world need more powerful technical 
tools to give them greater control over their online privacy 
relationships and greater information about what kinds of 
relationships they enter into.
    Even with the most stringent privacy laws in place, I would 
submit, so much of individual users' practical privacy rights 
on a day to day basis depends on being able to make 
individualized choices about what they want done with their 
personal information in a particular interaction. The web is 
getting so complex that we are going to need technology tools 
to help with that.
    We certainly also need some way or another to encourage and 
in some cases most likely require Web sites that offer those 
choices. But we are going to need the tools to make those 
choices effective choices and make sure that they are not 
buried four or five clicks and thousands of words down in some 
policy.
    So I hope that, whatever action this Committee takes, it 
will be consistent with encouraging the development of these 
tools and unleashing the innovative forces in the marketplace 
which, whether or not they have an incentive to provide privacy 
regulation, privacy protection, the innovation that we see in 
this marketplace can help to solve these problems and we should 
make sure that it is able to do that.
    Thank you very much.
    [The prepared statement of Mr. Weitzner follows:]

Prepared Statement of Daniel J. Weitzner, Technology and Society Domain 
                   Leader, World Wide Web Consortium

    Introduction

    Good Morning. My name is Daniel J. Weitzner. I thank the Committee 
for holding this hearing on online privacy and am honored to be able to 
contribute to your consideration of this critical issue. I am head of 
the World Wide Web Consortium's (W3C) Technology and Society 
activities, responsible for development of technology standards that 
enable the Web to address social, legal, and public policy concerns. 
W3C, an international organization made up of over 420 members from 
industry, academe, users organizations and public policy experts, is 
responsible for setting the core technical standards for the World Wide 
Web. W3C was founded in 1994 by Tim Berners-Lee, inventor of the Web, 
who serves as the Director of the Consortium. In addition to my work at 
W3C, I also hold a research appointment at MIT's Laboratory for 
Computer Science, teach Internet public policy at MIT, and am a member 
of the Internet Corporation for Assigned Names and Numbers (ICANN) 
Protocol Supporting Organization Protocol Council.
    Today I will touch on three major points:

   The Online Privacy Environment: Increasing sophistication in 
        Web technology enables the collection of large volumes of 
        personal information, sometimes with the explicit knowledge of 
        the user, and sometimes in the ``background.'' While this 
        information may often be collected for purposes considered 
        positive by the user, most users are unable to exercise 
        meaningful control over data collection and in many cases will 
        have little control over subsequent use of personal 
        information.

   The Platform for Privacy Preferences (P3P): W3C's P3P 
        project will enable the marketplace to deliver software tools 
        and services that enhance users knowledge of Web sites' 
        information practices and give users more control over their 
        personal information. A wide cross-section of the Web community 
        has contributed to the development of P3P and is now beginning 
        to test early implementations of the draft standard.

   Balancing Law, Technology, and Industry Practice: All three 
        of these elements are required to give users the privacy 
        protections they need in the online environment. Whatever the 
        mix of law and self-regulation, we should assure that it 
        creates an environment that encourages the development of 
        innovative privacy-enhancing tools.

I. The Online Privacy Environment
    The Internet and the World Wide Web have put extraordinary power 
over information in the hands of people and institutions around the 
world. With unprecedented ability to both publish and access 
information in the hands of hundreds of millions of people, centuries 
old barriers to knowledge and exchange of ideas have vanished. Yet this 
same interactivity, the bi-directional ability to exchange information 
from any point to any other point on the Net has brought about 
significant threats to individual privacy. For the same communications 
mechanisms that give individuals the power to publish and access 
information can also be used, sometimes without the user's knowledge or 
agreement, to collect sensitive personal information about the user and 
his or her information usage behavior. At W3C, our goal is to use the 
power of the Web, and enhance it where necessary with new technology, 
to give users and site operators tools to enable better knowledge of 
privacy practices and control over personal information.
    Urban legends of the Web's imagined surveillance capabilities 
abound. Nevertheless, Web technology has evolved quite sophisticated 
data collection techniques which have caused alarm and distrust among 
many users. State-of-the-art Web sites are able to collect personal 
information about users both directly, by presenting online forms to be 
filled out by users, and in the background, through use of various 
technologies such as access logs, cookies and, in some cases, the 
placement of small programs that run on users computers collecting 
information and delivering it back to the site. The background 
techniques are often used to offer more customized, personalized and 
easy-to-use services, many of which users appreciate. Yet, all but the 
most technologically sophisticated users have no practical ability to 
understand what sort of background data collection is taking place on 
their computers, much less limit such collect when they wish.
    Powerful data collection techniques, users inability to know what 
is being collected or how to stop it, together with occasional highly 
publicized abusive privacy practices, all combine to generate a 
significant level of fear and distrust on the part of many Web users. 
Three of the most notable online privacy incidents in the last year 
illustrate how strongly users and the general public react when users 
discover that data collected about them may be used for a dramatically 
different purpose, or that personal information will be disseminated 
without their control.

   Intel Processor Serial Number: Just before it released its 
        new Pentium III processor, Intel had to turn off access to the 
        unique serial number inside each processor because users 
        objected to the inability to block transmission of this serial 
        number to Web sites. Though Intel believed this ID would actual 
        enhance security by providing better transaction verification, 
        users felt that it would be used to track their browsing and 
        buying habits without giving sufficient control to users.

   Doubleclick personally-identifiable web usage tracking: 
        Widespread outcry arose earlier this year when Doubleclick 
        announced plans to use user information previously collected to 
        track surfing habits of users for the purpose of targeting 
        banner ads. User objected to the fact that information 
        previously collected was to be used for a different and more 
        invasive purpose, and because it was not clear to many people 
        how to opt-out of such tracking. Doubleclick has subsequently 
        withdrawn the tracking plans and mounted an education campaign 
        to inform users, among other things, how to control the 
        information collected by Doubleclick.

    W3C and its members became concerned about privacy on the Web 
because people won't use the Web to its full potential if they have to 
face such uncertainty. The majority of users are perfectly willing to 
share some information on the Web. At the same time, basic human 
dignity demands the we have meaningful control over which information 
we chose to expose to the public. Our goal is to include in the basic 
infrastructure of the Web the building blocks of tools that can provide 
each user this basic control.

II. P3P Enables Greater User Control
    To help address growing concerns about online privacy, W3C launched 
the Platform for Privacy Preferences (P3P) project to enable the 
development of a variety of tools and services that give users greater 
control over personal information and enhance trust between Web 
services and individual users.
    P3P-enable services will enhance user control by putting privacy 
policies where users can find them, present policies in a form that 
users can understand them, and, most importantly, enable users to act 
on what they see in policies more easily. For e-commerce services and 
other Web sites, P3P can be used to offer seamless browsing experience 
for customers without leaving them guessing about privacy. Moreover, 
P3P will help e-commerce services develop comprehensive privacy 
solutions in the increasingly complex value chain that makes the 
commercial Web such a success. On today's Web, when a consumer buys a 
product or service from one Web site, completing the transaction may 
well involve numerous individual services linked together, each of 
which has some role in the ultimate delivery to the user and each of 
which has some responsibility for honoring the privacy preferences 
expressed by the user at the beginning of the transaction.
    Consider all of the steps involved in the increasingly common 
processing, printing, distributing, and archiving a digital photo. 
After the user takes a digital image with a common digital camera, one 
site may be the point to which the photo is first uploaded, from there 
the user follows a link to another site that performs special image 
processing, after which the next site created prints, which are then 
delivered by yet another service to family members. Finally, yet 
another site may offer archival services for the photos. At each step 
along the way, these sites are dealing with sensitive information (the 
names of the people in the photos, their location, etc.).
    Setting the stage where such flexible combinations of services can 
be offered to users requires widespread agreement on standards, 
including the means of communicating from one service to another about 
how personal information should be handled. Standards have a vital role 
in the operation of the Web in general. The Web is not run by any 
single organization, but it does enable people to share information 
around the world because everyone who operates a piece of the Web 
agrees to follow shared technical standards. In the same was as the 
HTML standard ensures that everyone who looks at a Web page will see it 
as the author intended it to look, regardless of what computer or 
software is used, the P3P standard will enable every user and site 
operator on the Web to communicate in a common language about privacy.
    Can users find P3P in their browsers today? Not yet, as the 
standard is only just being completed. P3P has been under development 
over the last two years at the World Wide Web Consortium in a design 
effort that has included software vendors, large commercial users, 
privacy advocates, and government data protection commissioners from 
around the world. Participants in the effort include

   America Online/Netscape
   American Express
   AT&T
   Center for Democracy and Technology
   Commission Nationale de l'Informatique et des Libertes
   Citibank
   Electronic Frontier Foundation
   Microsoft
   NCR
   NEC
   Nokia
   Information and Privacy Commission/Ontario, Canada
   PrivacyBank
   Privacy Commissioner of Schleswig-Holstein, Germany
   Phone.com
   Geotrust

    With the standard definition nearly complete, we are now entering 
the testing and implementation phase. Our last step in finalizing the 
design of the standard is to host a series of interoperability testing 
events, one in June and one in September. We are encouraged that a 
number of large Web software developers as well as innovative smaller 
services have committed to implementing P3P in their products. 
Following this testing phase, we will issue a final standard for the 
Web community.

III. Conclusion: Role of Law, Technology Tools, and Industry Practice 
        in Privacy Protection
    This Committee faces hard questions regarding what regulatory 
framework, if any, will best address the serious privacy issues on the 
Web today. Congress may choose to enact a general privacy baseline, or 
may consider targeted legislation focused on certain sensitive sectors, 
such as has already been done with respect to children's privacy. Or, 
those who seek more time for self-regulatory efforts may take hold. I 
am not here to support or oppose any particular approach, but rather to 
suggest that with or without legislation, Web users in the United 
States and around the world need more powerful technical tools to give 
users greater control over their online privacy relationships. 
Similarly, e-commerce service providers need tools to enable them to 
build innovative, flexible, customizable services that respect users' 
privacy rights and preferences.
    Even with the most stringent privacy laws one might imagine, so 
much of practical privacy rights depends on users being able to make 
individualized choices about the privacy relationships that want to 
have with the growing number of Web-based services with which the 
interact. Effective exercise of informed choice, whether under 
legislative mandate or enlightened self-regulation, can only be 
accomplished in the increasingly complex Web of personal information 
with the help of tools that users can use. So whatever the final 
outcome of this debate, we should all be committed to see that the 
innovative and entrepreneurial energy that abound in the Internet are 
able to develop innovative tools to help users and vendors.

    The Chairman. Thank you.
    Ms. Lesser, Ms. Varney, do you have a response to Mr. 
Catlett's allegations?
    Ms. Lesser. Well, I would say the following. Obviously, we 
sort of fundamentally disagree with Mr. Catlett on approach, 
but we fundamentally agree with Mr. Catlett on the need to 
protect consumers' privacy.
    The Chairman. Do you disagree when he says that there is no 
technology that will solve this problem nor does the FTC have 
sufficient authority?
    Ms. Lesser. Let me take the first and then the second. On 
the technology question, I think it is certainly not technology 
alone. As Mr. Weitzner has laid out, there are lots of efforts 
going on in terms of technological development in helping 
consumers and businesses have that conversation and making it 
easier for consumers to get notice and make choices, and that 
is critical.
    However, in order for technology to solve some of these 
problems, you have to rely on implementation and in many ways 
you need to rely on how businesses are going to deal with their 
consumers. So I would say, in answer to some of the questions 
raised about whether there are large companies or small 
companies having complicated, incomplete, misleading privacy 
policies, I would submit, based on our own data with our 
customers, those companies will not ultimately succeed in 
getting consumers' trust and they will see a decrease in their 
business.
    So I do not think that technology can do it alone, but we 
have never relied on technology to do anything alone. It needs 
to be coordinated with good business practices.
    In terms of legislation, I think that, as I said, it is not 
a zero sum game. There may be areas where we need to see 
standards set by this Committee to guide the industry and to 
make sure that we are all headed in the right direction, 
particularly those of us who are not at this particular point. 
However, we need to do this in a deliberative way and make sure 
that we have identified what issues need to be addressed and 
who best to address them.
    I strongly believe that the FTC has an important role to 
play. I believe this Committee has an important role to play 
and that industry and consumers engaged in a dialog have an 
important role to play.
    I will say there is one important thing I disagree with in 
Mr. Catlett's remarks that I think it is important to 
emphasize, and that is the issue of preemption. However you 
folks begin to look at this issue, it is critical as we look at 
this medium, which we know is national but we also know is 
global, that we do not seek out a multiplicity of confusing and 
inconsistent standards, that whatever road we go down we make 
sure that companies, every single company, be it the smallest 
company in any of the States represented here, go online and 
serve customers, they may be serving customers from all 50 
States very quickly and from all over the world, and they 
simply, both large and small companies, cannot comply with a 
multiplicity of laws that are inconsistent around the globe and 
around this country.
    So I would strongly urge you, as you look at standards, to 
think clearly about the need to respect the global and national 
nature of the Internet online medium.
    The Chairman. Ms. Varney.
    Ms. Varney. Yes, Senator. As to the second question, the 
FTC authority, clearly the Federal Trade Commission has the 
authority to prosecute anybody who posts a privacy policy that 
is deceptive or misleading, and they should do it and perhaps 
they need more resources to do it.
    Do they have the authority to compel Web sites that do not 
post privacy policies to do so? Probably not. Do they have the 
authority to compel Web sites to post privacy policies using 
certain language or in a certain way? Probably not.
    The Chairman of the Federal Trade Commission and I, as a 
former Federal Trade Commissioner, have had a longstanding 
argument, which I think you have heard before, about whether or 
not the FTC's unfairness authority, as opposed to their 
deception authority, would be a sufficient basis for them to 
prosecute those who collect and use personal information for 
purposes other than it was provided without adequate notice and 
consent.
    The Chairman believes he does not have--that the Section 5 
unfairness standard does not give him that authority. I think 
it does. But he is a professor and a former dean of a 
university and he is the Chairman.
    The Chairman. Mr. Catlett.
    Mr. Catlett. Thank you, sir. On the issue of preemption, if 
Congress moves promptly and passes a good law that gives strong 
rights to individuals, then the States will not need to move in 
to address particular needs of their citizens.
    As to the question of inconsistent legislation, companies 
deal globally with this problem all the time. For example, 
Doubleclick does not set cookies in Germany because of laws 
that relate to privacy. Therefore Germans are getting better 
privacy protection from an American company than Americans are. 
So companies do deal with these large differences and a nation 
gets the level of privacy protection that it demands.
    The Chairman. Mr. Berman.
    Mr. Berman. I think some companies can deal with the crazy 
quilt of regulations. One of the arguments for legislation is 
to get away from that and to have some uniformity. I agree with 
Jason that it ought to be a high standard--and a standard that 
protects privacy, but it also has to protect the free flow of 
information over the Internet. And if our companies or our 
small Web sites have to figure out the laws and design their 
sales and their approaches to be consistent with every country 
in the world, I think that will be an enormous burden on 
commerce.
    So one of the reasons why I think that it is important for 
the United States and for us to work these things out now is to 
establish we are a leader in the Internet and what the 
regulatory regime that makes sense for the Internet makes sense 
also internationally. A traditional large regulatory role over 
every Web site, which some Europeans advocate, I think is 
inconsistent with the way the web is designed and will not 
work. So it is part of providing leadership.
    One last point. These issues are complex and I think that 
in order to work them out it does require drilling down on what 
do we mean by notice, what do we mean by access, what do we 
mean by a remedy. What is fair when L.L. Bean sends your shoe 
size to the wrong company? Do they go to jail? Those are not 
easy questions, what access do you have and what is the 
security, those issues.
    But--and I think that in order--and a regulatory agency 
should not be given an enormous amount of discretion. In order 
to limit that discretion, one of the things that Congress can 
do is when it writes its legislation, which is to make clear in 
legislative history and go and really use staff time and drill 
down on how its legislation is going to work, the explain to 
the FTC and explain to the public and to the companies what 
they have in mind.
    That is not easy legislation, but it is absolutely I think 
critical in this area or you will see too much discretion and 
you will not have the confidence of the Internet community.
    The Chairman. So, Mr. Catlett, along those lines, I like 
many others buy books online. Now when I go on one of these Web 
sites they say: Hi, John; we just got in a new biography of 
Napoleon we know you would like--which is true. They know, they 
know what my preferences are. So actually they are helping me 
by informing me of books that I would like to read. What is 
wrong with that?
    Mr. Catlett. That is a wonderful service, sir, and I use it 
myself.
    The Chairman. You know what I am getting at here, OK. Where 
does the line stop where they are informing me and helping me 
and they are invading my privacy?
    Mr. Catlett. Everybody wants the benefits of personalized 
technologies and the Internet is wonderful at providing that, 
provided that the personal information is treated fairly. That 
means several things: only using the information for the 
purpose that they collected it for, in the case of say making 
book recommendations, and not for selling to, giving to 
journalists who want to get a psychographic profile of the 
individual who buys the books.
    Second, the individual should have access to that complete 
profile that is built up so that they can be sure for 
themselves----
    The Chairman. Like a FOIA, like a Freedom of Information 
Act.
    Mr. Catlett. Precisely, sir. And those laws should apply 
very broadly to all commercial entities that maintain personal 
information. It is the right of people to determine information 
that is held about them. That information is being used by 
companies supposedly for their benefit and so people have the 
right to see that information.
    The Chairman. Do they now?
    Mr. Catlett. No, they do not, sir. You have the right to 
see your credit report, but you do not have the right to see 
the vastly greater profiles about you that marketing companies 
have.
    The Chairman. Is that fair, Ms. Lesser?
    Ms. Lesser. I think it is a fair articulation of the 
current law. I do not think it is necessarily a fair 
articulation of all business practices. So for example----
    The Chairman. Now wait a minute. Is it fair for me not to 
know what----
    Ms. Lesser. Oh, I am sorry, I misunderstood your question.
    The Chairman. Should I be able to see what Amazon.com's 
profile of me is?
    Ms. Lesser. I imagine that if Amazon.com is creating, is 
giving you, for example, as we do, an opportunity to have a 
member profile----
    The Chairman. Is it fair for me to know what the profile 
is, Ms. Lesser?
    Ms. Lesser. Sure, absolutely, it is fair for you to know.
    The Chairman. But right now I do not have that right.
    Ms. Lesser. You will probably be given a right to know what 
your profile says by a lot of companies, because it is smart 
business practice.
    The Chairman. But if they do not choose to----
    Ms. Lesser. Now, the level of--there is a difference 
between understanding access, i.e., do you access directly into 
the data base or do you have an ability to basically say----
    The Chairman. You are complicating the issue.
    Ms. Varney, do I have the right to know what profile is 
compiled on me by an Internet corporation?
    Ms. Varney. Do I get to ask you a question back, to further 
this?
    The Chairman. Yes.
    Ms. Varney. OK, thank you.
    The Chairman. Tragically, yes.
    [Laughter.]
    Ms. Varney. Do you want to know--the company is going to 
take what you have purchased on their Web site to develop their 
profile. Do you want access to everything that you have 
purchased?
    The Chairman. No, what their profile of me is.
    Ms. Varney. So you do not care about getting access to your 
past purchases? You want to see what they do with that 
information?
    The Chairman. I want to know what the profile is because 
obviously they are letting other people know that profile.
    Ms. Varney. Why are they letting other people know the 
profile?
    The Chairman. I do not know why. For profit and fun.
    [Laughter.]
    Ms. Varney. Not yours, Senator, I can assure you.
    The Chairman. I am sorry, Conrad.
    Ms. Varney. If they are not sharing the profile, does that 
matter to your question?
    The Chairman. Even if they are not sharing the profile. The 
FBI has a file on me and I hope they are not sharing it, and 
yet I have the ability--well, I do not care if they are.
    [Laughter.]
    The Chairman. Most citizens would not want that. So through 
the Freedom of Information Act I can find out, I can get my FBI 
file. Should I not be able to, through some kind of Freedom of 
Information Act, know the profile that is kept on me?
    Ms. Varney. Having been through the Senate confirmation 
process, I do have an FBI file and I have reviewed it, and what 
is in my FBI file are facts and summaries of conversations----
    The Chairman. Should every American have the same right as 
they do with the FBI file?
    Ms. Varney. But Senator, that is what I am getting at, what 
is in the FBI file. If the FBI has a psychographic profile on 
me, I have not seen it, I cannot see it.
    The Chairman. They may and they may not. I have seen all 
kinds of FBI files.
    Ms. Varney. Can you see what they have on me?
    The Chairman. You are evading my question. Should they have 
the right to know the profile--should I have the right to know 
the profile that is kept on me?
    Ms. Varney. Senator, I do not mean to be evasive. I am 
trying to----
    The Chairman. So you are not going to give me an answer?
    [Laughter.]
    Ms. Varney. I am going to give you an answer.
    The Chairman. Then say it.
    Ms. Varney. I am trying to draw a distinction----
    The Chairman. If you want to ask me a question, you have 
got to give me a yes or no answer.
    Ms. Varney. I will, I will. You will not let me, though. I 
am trying to draw a distinction between the data that is used 
by a company to create a profile and the profile. Obviously you 
have a right to all the data, the transactional data. What some 
of the companies will say back to you, whether or not you 
accept this argument, is: We spend a lot of time and a lot of 
money and hire a lot of people and do algorithms and all kinds 
of things to come up with what we think is the profile. It is 
our proprietary property.
    Is it good business sense to share it with you? Sure. Do 
you want to legislate it? Talk to the companies that do it. I 
do not know.
    The Chairman. So your answer is ``I do not know.'' Now, 
what is your question for me?
    Ms. Varney. I asked the question, whether you wanted access 
to the underlying data or to the profile that the data was used 
to generate.
    Mr. Weitzner. Well, my question is I want to see your 
profile.
    The Chairman. I think I should have access--very frankly, I 
think I should have access to any information that is collected 
about me and conclusions that are drawn about me. I think that 
is the right of citizens, and I do not understand how it could 
be--well, go ahead.
    Mr. Weitzner. Could I suggest we just take one step back. I 
do not have a quick answer to this question, but the right of 
access----
    The Chairman. By law I can have my credit profile.
    Mr. Weitzner. That is right, and the reason that you can 
have your credit profile is because important decisions are 
made affecting your life based on that credit profile. So you 
have a right to see it really in order to correct it if there 
are mistakes.
    The Chairman. Suppose that this company that makes a 
profile of me that portrays me as an axe murderer is then sold 
and distributed to others, all over the Internet. Is that good?
    Mr. Weitzner. I think that what you certainly have a right 
to know is what are they disseminating to others. I am not sure 
that I am comfortable with the notion that any single Web site 
that has any kind of commercial activity has to have a 
mechanism for disclosing all of the information that it 
compiles that is in some way personally identifiable. That 
really goes pretty far and I think, as the FTC Advisory 
Committee recently pointed out, you get into a whole other set 
of privacy problems.
    How does Amazon know that you are you when you are coming 
to look at your profile? A lot of people are going to be trying 
to figure out every Senator's password.
    The Chairman. They have got my credit card. They get my 
credit card when I make a purchase, so they are pretty darn 
sure that it is me.
    Mr. Weitzner. Well, they insure against the risk that it 
actually is not you and they protect themselves. And the credit 
card companies charge you whatever interest they charge you.
    The Chairman. They do not know that I like history books 
just because of one purchase.
    Go ahead, Mr. Berman.
    Mr. Berman. I think the answer is--I raised it before--this 
is not an easy question. There has been a committee now on 
access which has drilled down and made a distinction between 
proprietary information, information which you should have 
which might be exempt information. So it depends. That is one 
of the critical factors in writing legislation like this. In 
order to decide the access----
    The Chairman. You are making an argument we better be very 
careful about writing----
    Mr. Berman. You better be very careful and go through the 
hypotheticals about what you mean by access and who has access. 
You might also raise the question which we raise: If you have 
total commitment from the private sector to both only give you 
that profile and keep it for themselves and never use it for 
anyone else because they are the only ones that want to sell 
you Napoleon books, what is the right of the FBI to get access 
to that information, that profile?
    What we have done is we are making an enormous transfer of 
third party information, personal sensitive information, to the 
net without also examining what the government access standards 
are to that information. I mention the Monica Lewinsky example. 
A colleague of mine at CDT is testifying over in another----
    The Chairman. We try not to mention that.
    Mr. Berman.--committee dealing with government access. I 
would urge that at some point the committee try and look at 
them together because they are of a piece.
    The Chairman. Well, this is fascinating. This is a 
fascinating issue. I mean, it is really a remarkable issue, and 
I would argue that 5 years ago if we had said we would be 
having this kind of discussion, it simply was not on the 
screen. I believe that Mr. Catlett is right, though. I think 
this is a very rapidly growing issue rather than one that is 
diminishing.
    I apologize to my friend and colleague for the length of 
time I took, but it is a fascinating dialog.
    I thank the witnesses.
    Senator Burns. I have never missed a meal and I do not plan 
to.
    [Laughter.]
    Mr. Berman. You have never missed a meal while I have been 
up here.
    Senator Burns. In light of the conversation and the dialog 
with the Chairman, give me your assessment--and I would ask 
you, Jerry. Give your assessment of the safe harbor approach.
    Mr. Berman. Well, I think that the safe harbor approach 
offers a real opportunity in dealing with the Internet. One of 
the things that the FTC has built up is a considerable amount 
of experience in dealing with that there are a whole myriad--it 
is not one-size-fits all on the Internet. We want to encourage 
a lot of different experiments in enforcement and trying to get 
companies to do audits and so on.
    If the safe harbors encourage that experimentation so that 
good practices can find their way into that safe harbor, then 
after developing a data base and factual basis on how those 
work you can make decisions about whether you need to go 
further and deal with criminal penalties and all the other 
paraphernalia. But I would not start at that end, which is with 
big penalties and high standards for what is a safe harbor, 
because there is so much experimentation, so many new people on 
the Internet.
    But I think that what is the problem with the self-
regulatory regime now is not that people are not trying these 
experiments, but that they do not know what a safe harbor is. 
So they do not know what to spend, whether it is worth it, 
whether if they join E-Trust or BBBOnLine whether they are 
going to be safe from prosecution or safe from legislation. So 
I think that that uncertainty is something that your 
legislation begins to address. I mean, we need to work on it, 
and Senator Hollings----
    Senator Burns. In other words, we do not want to abandon 
the safe harbor approach?
    Mr. Berman. I do not think so.
    Senator Burns. Now let us go, let us go one step further 
then. Does the simple posting of privacy policy amount to 
actual privacy to the end user? I mean, once they make----
    Mr. Berman. It does not amount to privacy if the statement 
is not complete or it says in some circumstance we do this, in 
some circumstance, and it is conflicting. We have examples in 
our testimony. It has to be a complete statement covering the 
fair information practices. It has to give you adequate 
information so that you know what the scope of collection and 
use is.
    Senator Burns [presiding]. That is all I have today. I have 
listened to the testimony and the questions. I do not know what 
happened to the Chairman, but I will tell you this, that we 
thank you for coming today. There will be other Senators with 
questions. If you could respond to the individual Senators and 
to the Committee, that would be helpful.
    Right now, this hearing is adjourned. The record will 
remain open for 2 weeks.
    [Whereupon, at 12:51 p.m., the Committee was adjourned.]

                            A P P E N D I X

  Response to Question Submitted by Hon. Max Cleland to Jason Catlett
Question 1. As you know, I am a co-sponsor of S. 2606, which was 
introduced this week by Senator Hollings and nine other Senate 
colleagues. This bill allows for ``opt-in'' provisions for Web sites 
using and sharing personally identifiable information, and ``opt-out'' 
for non-personally identifiable information. I would like to get your 
thoughts on these provisions, specifically addressing the 
implemenatation of these provisions by Web sites and the possible 
effects it may have on online commerce.
    Answer. This responds to Senator Cleland's question to me about S. 
2606.

    I believe the bill makes broadly the right decision on both opt-in 
for personally identifiable information (PII) and opt-out for non-
personally identifiable information (non-PII), subject to the following 
qualifications.
    For PII, opt-in should certainly be required, since to have 
personal data distributed without the consent of the person concerned 
on a data transmission medium as powerful as the Internet would mean 
the death of privacy online. It may further be necessary to set and 
evolve a high standard to ensure that the consent is both well-informed 
and affirmative.
    For non-PII, at least an opt-out should certainly be required, but 
it is possible that in some cases that may arise in the future, the 
standard should be raised to opt-in. The use of pseudonymous identities 
is expected to greatly increase in the next few years, and it may be 
necessary to protect the privacy of these identities, even if they are 
not personally identified with any natural person.
    Accordingly, I would recommend proceeding with the broad standards 
as they are in this bill, but remove the language preempting state law. 
If changes become necessary following experience with the law, states 
should be free to act accordingly.
    On the implementation for Web sites, I can speak from direct 
experience, having operated for about four years a Web site that 
collects personal information on a purely opt-in basis. The Internet 
makes the process of opting-in and opting-out very inexpensive, at near 
zero marginal cost.
    This contrasts with the relatively high cost of processing opt-
transactions in the physical world. As to the cost of establishing the 
opt-processing systems, it would be only a very small percentage of the 
total development cost of a typical e-commerce site. It is entirely 
reasonable to require this.
    The major effect on e-commerce would be to increase consumer 
participation due to improved consumer confidence. This could be as 
much as 20 or 40 percent over several years, compared to the ugly 
scenario where no protections are in place, and consumer confidence 
continues to decline. People who are scared offline at their earliest 
encounters with the Internet may be reluctant to return.
    Online advertisers might complain that they have to ask people's 
permission before using or selling information about them, and that 
therefore they would have to forgo some revenue. This is a very poor 
reason to lower the standards proposed in the bill, because (i) online 
advertisers still have a fine business selling ads that are targeted 
not based on personal information, using the so-called old-fashioned 
``print model'' of putting ads for golf clubs in the sports section: 
this constitutes the vast majority of their existing revenues; (ii) 
online advertising is only a tiny percentage of e-commerce revenues; 
and (iii) it is unfair to permit the advertisers to maximize their 
revenues at the expense of reducing the total size of the market.
    If it is not out of place here, I would like to commend the Senator 
and his cosponsors on the Consumer Privacy Protection Act, and to 
express my admiration for the plain common sense of his remarks about 
online privacy during the hearing.
    If I can be of any further assistance to you or the Committee, 
please free to ask.

                                 ______
                                 
      Response to Written Questions Submitted by Hon. Max Cleland 
                           to Jill A. Lesser

Question 1. Do you believe people should be able to know what 
information is collected about them by third parties, how that 
information is used, and the ability to correct incorrect information?
    Answer. Yes. We at America Online believe strongly that ``notice'' 
and ``choice'' with respect to personally identifiable information are 
essential elements of online privacy protection. In other words, 
consumers should be given clear notice about what personally 
identifiable information is collected about them and why it is being 
collected, and should be given the opportunity to exercise choice about 
how such information is used. In addition, we believe that 
organizations that collect personally identifiable information from 
consumers should take steps to protect the security of that information 
and should establish a process for correcting inaccuracies in important 
information, such as account or contact information. AOL's privacy 
policy is based on these essential principles.

Question 2. As you know, there are several privacy seal programs that 
Web sites can earn by their privacy practices. Several of the ``good 
players'' attempt to influence their business partners to adopt 
stronger privacy protections and earn the endorsement of these seal 
programs. AOL works with its partner companies to ensure good privacy 
practices. However, how do you explain the fact that the FTC report 
found only 8% of randomly selected sites participate in these programs?
    Answer. AOL supports the development of privacy seal programs to 
help encourage good business practices, build public awareness, and 
increase consumer confidence in the online medium. AOL helps to promote 
sound privacy practices through its Certified Merchant Program, which 
requires AOL merchants to post a comprehensive privacy policy that is 
consistent with the principles outlined in AOL's privacy policy and the 
industry guidelines developed by the Online Privacy Alliance.
    While we do not know the precise reason for the low level of seal 
program participation found in the FTC report earlier this year, one 
factor may be simply that more public education is needed to make both 
consumers and businesses more aware of the importance of such programs. 
As public awareness about online privacy issues continues to grow, 
participation in these programs will likely increase. Furthermore, it 
is possible that the FTC survey focused narrowly on strict ``seal'' 
programs, and perhaps did not take into account the wide variety of 
compliance and certification programs that currently exist, such as 
AOL's Certified Merchant program, to help ensure good privacy practices 
and increase consumer confidence. We believe that the proliferation of 
all such programs will help to build consumer trust in the online 
medium.

Question 3. What evidence have you seen to indicate that the average, 
not necessarily Web-savvy, American Web surfer is knowledgeable about 
information-gathering practices of Web sites? Especially among groups 
coming online more and more, like older Americans?
    Answer. It is clear that online privacy issues have taken center 
stage in the public debate over the past year, and that Americans 
generally are more aware than ever before about both the tremendous 
benefits of electronic commerce and the potential privacy implications 
of doing business online with sites that do not protect their privacy. 
This year's FTC report shows a dramatic increase in the number of 
commercial Web sites that have posted privacy policies describing their 
information-gathering practices. Despite this incredible progress, we 
believe that the average user's knowledge and understanding of how his 
or her personal information is collected and used online is still not 
at the level where it needs to be in order to ensure that consumers' 
privacy is being fully protected.
    AOL believes, therefore, that companies doing business online have 
a responsibility to reach out to Internet users to help educate them 
about what they can do to protect their privacy online. AOL makes it a 
priority to clearly inform our members about our privacy policies and 
about the steps they can take to ensure that their personal information 
is protected wherever they go online. In addition, we have participated 
in a number of industry-wide efforts to raise public awareness about 
online privacy, such as the ``Privacy Partnership 2000,'' an ongoing 
grassroots initiative created by TrustE and leading online companies 
like AOL to promote privacy education on the Internet, as well as the 
recent media consumer education campaign sponsored by the members of 
Netcoalition.com, a public policy organization comprised of leading 
online consumer companies. We believe that industry, government, and 
consumer groups must continue to work together to promote public 
education about online privacy and bring consumer education to the 
level where it needs to be.

                                 ______
                                 
      Response to Written Questions Submitted by Hon. Max Cleland 
                    to the Federal Trade Commission
Dear Senator McCain:

    Thank you for transmitting Senator Cleland's post-hearing questions 
related to the Federal Trade Commission's report, Privacy Online: Fair 
Information Practices in the Electronic Marketplace (``Report''). The 
Commission's responses are as follows.\1\
---------------------------------------------------------------------------
    \1\ The Commission vote to issue this letter was 4-1, with 
Commissioner Swindle dissenting. His views are expressed in a separate 
letter, which is attached.

Question 1. Some people have called for the creation of a privacy 
commission to establish future privacy guidelines and ``add flesh'' to 
laws that may be passed by Congress. Do you feel as though this role 
could be effectively performed by the Federal Trade Commission? And, 
what is your opinion on the creation of such a commission?
    Answer. Yes, based on the proposals we have seen about the 
anticipated role of a privacy commission, we believe that the FTC could 
effectively perform the duties associated with such a commission. As 
you know, the FTC has been involved with data privacy issues since 
1995, and has in fact performed many of the same functions that a 
privacy commission would perform. The Commission has held a series of 
widely-attended public workshops, which included participation by 
industry, advocates, and academics, and has produced numerous reports 
focusing on a variety of privacy issues, including the collection of 
personal information from children, self-regulatory efforts and 
technological developments to enhance consumer privacy, consumer and 
business education efforts, and the tale of government in protecting 
online privacy. Moreover, at Congress's direction, the Commission has 
promulgated a well-received rule pursuant to the Children's Online 
Privacy Protection Act. The agency will continue to examine privacy 
issues and we believe the Commission could effectively fill the role of 
implementing any additional laws Congress may enact. Moreover, the FTC 
also has a competition mission that gives the agency a unique ability 
to consider the competitive implications of any privacy regulations.
    We generally believe that additional resources can be brought to 
bear on the evaluation and development of effective privacy protection 
for Americans. We are concerned, however, that the creation of a 
separate privacy commission might be inefficient given the FTC 
resources already devoted to privacy issues. Furthermore, a number of 
states are moving forward with their own form of online privacy 
legislation. Thus, such a commission also could have the counter 
productive effect of delaying thoughtful consideration and development 
of otherwise appropriate and timely legislation to protect privacy.

Question 2. Do you feel Internet business has the potential to grow 
with clear, concise privacy policies in effect?
    Answer. Yes. As described in our recent report, ``Privacy Online: 
Fair Information Practices in the Electronic Marketplace,'' (May 2000, 
available at http://www.ftc.gov/os/2000/05/index.htm#22), some survey 
research suggests that the vast majority of online consumers are 
concerned about the misuse of their personal information online, and 
that large numbers of consumers do not trust online companies to keep 
their personal information confidential. Alleviation of these concerns 
should prompt more consumers to use the Internet. Sites with clear and 
concise privacy policies that implement the fair information practices 
outlined in the Commission's Report have the potential to appeal to 
consumers who are concerned by providing a ``privacy-friendly'' 
marketplace in which consumers can shop. Moreover, a majority of the 
Commission believes that if Congress enacts legislation requiring a 
baseline of privacy protections, consumers could benefit from the 
knowledge that they would be entitled to at least a uniform level of 
protection wherever they visit online. This knowledge should also 
result in a concomitant increase in consumer confidence in the online 
marketplace.

Question 3. What evidence have you seen to indicate that the average, 
not necessarily web savvy, American Web surfer is knowledgeable about 
information gathering practices of Web sites? Especially among groups 
coming online more and more like older Americans?
    Answer. As noted in our recent Report, although consumers may not 
be conversant in the specific information-gathering practices of Web 
sites, survey evidence indicates that consumers are increasingly 
concerned about their privacy online. (Report at 2-3.) Some evidence 
also suggests that older Americans are concerned about shopping online 
because of their privacy concerns. (Report at 2 n.15, referring to AARP 
National Survey on Consumer Preparedness and E-Commerce: A Survey of 
Computer Users Age 45 and Older (March 2000), available at /
www.aarp.org/press/2000/nr033000.html>) The Commission unanimously 
believes that all consumers, including older Americans and others new 
to the online medium, would benefit from clear and conspicuous privacy 
disclosures online.
    In addition, consumer education about online information gathering 
is still badly needed. The FTC will continue its efforts to educate 
consumers about the online marketplace and its information practices 
and will encourage self-regulatory groups to focus on consumer 
education as well. Educating businesses about the need to implement 
privacy protections has and continues to be an important complement to 
these consumer education efforts.

Question 4. As you know, the Better Business Bureau and other companies 
have online ``seals'' for which Web sites can apply if the site 
believes it meets the privacy standards of those seal programs. The FTC 
report states that only 8% of the Random Sample of sites and 45% of the 
Most Popular sites in the survey display a privacy seal. Could each of 
you comment ou these seal programs and their influence on the Internet 
industry and its privacy practices?
    Answer. The Commission has long supported the development and 
implementation of seal programs as part of industry self-regulatory 
efforts. We believe online privacy seal programs can play an important 
role in advancing the implementation of fair information practices in 
the online marketplace. They educate both online businesses and online 
consumers about online privacy protections, and they can serve as a key 
enforcement component of industry self-regulation in this area. The 
established programs are to be commended for their efforts to date, and 
the emergence of several new, competing seal programs is a welcome 
development.
    If widely adopted, seal programs promise an efficient way to alert 
consumers to licensees' information practices and to demonstrate 
licensees' compliance with program requirements. Although the number of 
sites enrolled in seal programs has increased in absolute terms over 
the past year, with 45% of the Most Popular sites participating, the 
seal programs have yet to establish a significant presence on the Web. 
Therefore, their impact on online commerce remains limited. The 
Commission believes that seal programs' efforts would be bolstered by 
legislation requiring online companies to adhere to core fair 
information practice principles.

Question 5. Several Internet companies claim that privacy policies will 
``kill the goose that laid the golden egg'' by being too burdensome on 
this fledgling industry. The FTC report references concerns of FTC 
staff and the Advisory Committee an Online Access and Security that 
some of these recommendations to protect consumer privacy should not be 
overly burdensome to the company. Do you have any further guidelines on 
what is ``overly burdensome'' for the Committee?
    Answer. The Commission has specifically recognized that 
implementation of the fair information practices of Access and Security 
raise complex issues. As you note, many of these issues were 
highlighted in the Report of the Advisory Committee on Online Access 
and Security. The majority of the Commission does not believe that 
providing Access and Security would necessarily create unreasonable 
burdens or costs to online businesses.\2\ Furthermore, the issue of 
burden, particularly with respect to small businesses, could be fully 
and fairly addressed in a rulemaking proceeding. Such a proceeding, 
with input from online businesses and consumers would greatly assist 
any implementing agency in crafting a rule that implements online 
privacy protections in a flexible and reasonable manner.
---------------------------------------------------------------------------
    \2\ Commissioner Leary opposes mandated access and security at this 
time because he believes that the Commission has insufficient 
information about the relative costs to businesses and benefits to 
consumers in this area, and because, if notice is adequate, the 
competitive marketplace should provide a better solution than 
regulation.

    Please let me know if the Commission can provide any additional 
information on this important matter.
    By direction of the Commission.
                                   Robert Pitofsky,
                                                  Chairman.
                                 ______
                                 
      Response to Written Questions Submitted by Hon. Max Cleland 
                            to Orson Swindle
Dear Chairman McCain:

    Thank you for transmitting Senator Cleland's post-hearing questions 
related to the Federal Trade Commission's report, Privacy Online: Fair 
Information Practices in the Electronic Marketplace (``Privacy 
Report''). For the most part, I do not share the views expressed in the 
Commission majority's response to Senator Cleland's questions. 
Accordingly, for the Senator's consideration, I am providing my 
individual responses to his questions.

Question 1. Some people have called for the creation of a privacy 
commission to establish future privacy guidelines and ``add flesh'' to 
laws that may be passed by Congress. Do you feel as though this role 
could be effectively performed by the Federal Trade Commission? And, 
what is your opinion on the creation of such a commission?
    Answer. A Congressionally established privacy commission could add 
measurably to the general understanding of online privacy. A serious 
examination of all the issues surrounding online privacy should add 
significantly to a better understanding of the possible unintended 
consequences of the laws that may be passed for the online economy. 
Such an examination should look at the costs and benefits of various 
options, including legislation, industry self-regulation, government 
guidelines regarding industry best practices, etc. As I pointed out in 
my dissent from the Privacy Report, an analysis of this type should 
have preceded any recommendation of legislation by the FTC and 
certainly should precede enactment of legislation mandating privacy 
protections.\1\
---------------------------------------------------------------------------
    \1\ Privacy Report, Dissenting Statement of Commissioner Orson 
Swindle at 2, 21-24.
---------------------------------------------------------------------------
    Having some experience and certainly a reservoir of knowledge about 
privacy online, competitive issues, how to make clear and conspicuous 
disclosures online, and implementation of the Children's Online Privacy 
Protection Act, the FTC theoretically could perform this function. 
However, the recent FTC Privacy Report indicates to me that a more 
objective, probing analysis and less pro-regulatory bias are desirable. 
Perhaps it would be best for an independent, non-partisan commission to 
take on this task, in a manner similar to the Advisory Commission on 
Electronic Commerce.\2\
---------------------------------------------------------------------------
    \2\ This Commission was created by Congress when it enacted the 
Omnibus Appropriations Act of 1998, Pub. L. No. 105-277, to study and 
make recommendations about taxation on transactions using the Internet. 
The Commission's final report is available at http://www.e-
commercecommission.org/report.htm.

Question 2. Do you feel Internet business has the potential to grow 
with clear, concise privacy policies in effect?
    Answer. Yes, although it is obviously growing exponentially now 
with less than perfect privacy policies in effect. To my knowledge, no 
one has empirically established the impact of privacy policies on 
consumer behavior. Industry self-regulation is making good progress. I 
suspect that the degree to which privacy concerns are impeding the 
growth of online commerce has been vastly overstated. The FTC's efforts 
to evaluate online privacy have not included any empirical study of the 
effects on online commerce of the existence of privacy policies, 
whether consisting of simple notice or comprehensive statements 
implementing all four FTC-suggested fair information practice 
principles. Instead, the FTC, relying upon consumer opinion surveys 
showing that many consumers are concerned about online privacy, has 
asserted that online commerce will not reach its full potential without 
legislation ensuring full fair information practices.\3\ Consumer 
opinion polls showing a generalized concern about-privacy, however, 
should not be relied upon as the basis for concluding that legislation 
is required for the optimal growth of online commerce.\4\ There is no 
reason to conclude that legislation will necessarily increase consumer 
confidence in the online marketplace.
---------------------------------------------------------------------------
    \3\ Privacy Report at iv.
    \4\ See generally Concurring and Dissenting Statement of 
Commissioner Orson Swindle to Statement of the Federal Trade Commission 
on Online Profiling; see also Privacy Report, Dissenting Statement of 
Commissioner Orson Swindle at 10-16.
---------------------------------------------------------------------------
    For example, a study conducted by Jupiter Communications in mid-
1999,\5\ concluded that ``consumers do not see government regulation as 
the solution to the online privacy issue. The vast majority of 
respondents to a Jupiter Consumer Survey--86%--said that they would not 
trust a Web site with their privacy even if the government regulated 
it.'' \6\ The same study asked consumers to identify the top two 
factors that would increase their trust in Web sites regarding privacy. 
``The posting of privacy policies eased the concerns of 36 percent of 
consumers surveyed.'' \7\ Government regulation was ``not a popular 
option'' for increasing consumers' confidence: ``only 14 percent 
indicated that they would more likely trust a Web site on privacy 
issues if the site were subject to government regulation.'' \8\
---------------------------------------------------------------------------
    \5\ This study predates the noteworthy increase in the display of 
privacy policies online and in online sales in late 1999 and the first 
quarter of 2000.
    \6\ Michele Slack, Jupiter Communications, Proactive Online 
Privacy, Scripting an Informed Dialogue to Allay Consumers' Fears at 19 
(June 1999).
    \7\ Id. at 4.
    \8\ Id.

Question 3. What evidence have you seen to indicate that the average, 
not necessarily Web savvy, American Web surfer is knowledgeable about 
information gathering practices of Web sites? Especially among groups 
coming online more and more like older Americans?
    Answer. To my knowledge, the research cited in the Commission's 
Privacy Report does not directly address this issue. One study 
mentioned in the Report, a telephone survey of adult computer users 
conducted in March 2000 by Harris Interactive for Business Week, found 
that 40% of computer users had heard of cookies and, of these, 75% 
understood them to be ``files downloaded onto your computer that track 
your online habits.'' \9\ The Harris poll also found that 55% of 
computer users while surfing online had seen a privacy notice or other 
explanation of how personal information collected by a Web site will be 
used. Of those who had seen a privacy notice, 35% always read it, 42% 
sometimes read it, 18% rarely read it, and only 4% never read it.\10\
---------------------------------------------------------------------------
    \9\ Business Week Online, Business Week/Harris Poll: A Growing 
Threat (March 2000), available at /www.businessweek.com/2000/
0012/b3673010.htm>. Interestingly, of those computer users that are 
aware of cookies, many set their computers to reject them, either 
always (21%) or sometimes (21%), while an even larger group either 
never (43%) or only rarely (10%) did so.
    \10\ Id.
---------------------------------------------------------------------------
    Surveys that indicate that consumers are increasingly concerned 
about online privacy are not evidence that consumers are knowledgeable 
about the information gathering practices of Web sites. Simply stated, 
once again the FTC is presenting misleading interpretations of opinion 
survey results, including the AARP survey.
    The AARP report shows that the majority (54%) of older Americans 
who use the Internet make purchases online.\11\ Three out of four of 
these online purchasers describe themselves as either very or somewhat 
concerned about the privacy of the information, yet they make 
purchases.\12\ This confirms my sense that consumers who express 
concerns about privacy in the abstract find that their concerns are 
outweighed in practice by the convenience and other benefits of 
shopping online.
---------------------------------------------------------------------------
    \11\ AARP National Survey on Consumer Preparedness and E-Commerce: 
A Survey of Computer Users Age 45 and Over (``AARP Report'') at 32, 62 
(March 2000), available at /research.aarp.org/consume/e-
commerce_1.html>.
    \12\ Id. at 54.
---------------------------------------------------------------------------
    The Privacy Report, relying only on the press release and not the 
full AARP Report, cited the press release as support for the 
proposition that ``many consumers who have never made an online 
purchase identify privacy concerns as a key reason for their 
inaction.'' \13\ In fact, the AARP study itself does not permit any 
conclusions to be drawn about the degree to which privacy concerns or 
any other reason influenced consumers' decisions not to purchase 
online.
---------------------------------------------------------------------------
    \13\ Privacy Report at 2 n.I5.
---------------------------------------------------------------------------
    Instead, the study used an open-ended question followed by probing 
to determine why those respondents who stated that they never purchased 
over the Internet have not made such purchases).\14\ The resulting 
tabulation of reasons offered by consumers in response shows only how 
frequently these consumers identified particular reasons for not 
purchasing, not whether a particular reason was ``key'' to their 
decision not to purchase. Of the Internet users who have never made an 
online purchase, 43% ``simply are either not interested in online 
shopping (28%) or do not like online shopping (15%).'' \15\ Another 20% 
indicated that they like to shop and/or examine products in person. 
Twenty-four percent cited ``concerns about privacy'' and an additional 
6% stated they were concerned about ``safety of payment.'' \16\
---------------------------------------------------------------------------
    \14\ AARP Report at 64.
    \15\ Id. at 34.
    \16\ Id. A variety of other reasons are also identified in the AARP 
Report, but only reasons mentioned by at least 3% of those surveyed are 
reported.

Question 4. As you know, the Better Business Bureau and other companies 
have online ``seals'' for which Web sites can apply if the site 
believes it meets the privacy standards of those seal programs. The FTC 
Report states that only 8% of the Random Sample of sites and 45% of the 
Most Popular sites in the survey display a privacy seal. Could each of 
you comment on these seal programs and their influence on the Internet 
industry and its privacy practices?
    Answer. The ``seal programs'' are a good idea. However, the fact 
that a company does not use a seal program does not mean that it has 
unsatisfactory privacy policies and practices. No conclusions should be 
drawn from not belonging to a seal program. Seal programs are but one 
of many practices that can be used to give consumers confidence. 
Companies with good business practices that satisfy consumers 
accomplish that confidence-building without necessarily having to 
employ seal programs.
    I disagree with the majority's conclusion that seal programs have 
yet to establish a significant presence on the Web. As I mentioned in 
my dissent from the Privacy Report, seal programs are not the only 
enforcement mechanism that backs up self-regulation).\17\ In any event, 
45% of the most popular sites--the ones that attract the greatest 
number of individual visitors--use a privacy seal, and that is not an 
insignificant presence by any stretch of the imagination.
---------------------------------------------------------------------------
    \17\ Privacy Report, Dissenting Statement of Commissioner Orson 
Swindle at 9-10.

Question 5. Several Internet companies claim that privacy policies will 
``kill the goose that laid the golden egg'' by being too burdensome on 
this fledgling industry. The FTC report references concerns of FTC 
staff and the Advisory Committee on Online Access and Security that 
some of these recommendations to protect consumer privacy should not be 
overly burdensome to the company. Do you have any further guidelines on 
what is ``overly burdensome'' for the Committee?
    Answer. I do not know what privacy policies will be ``overly 
burdensome,'' although I suspect that mandating Choice, Access, and 
Security may be burdensome for many small Internet companies, as well 
as for larger companies whose business models rely on the sale or use 
of consumer information to offset the costs of providing benefits and 
services to consumers. No one, at the FTC or elsewhere, has made an 
assessment that answers your question. This was my sharpest 
disagreement with the majority's legislative recommendation in the 
Privacy Report.\18\ It is critical to look at the costs and burdens 
that proposed legislation might impose before imposing them, and it is 
just as critical to realistically assess the likely benefits of such 
legislation.
---------------------------------------------------------------------------
    \18\ Id. at 21-24.
---------------------------------------------------------------------------
    Regulations have a long history of not accomplishing their 
original, well-intended purposes, and unintended adverse consequences 
are a well known, oft-occurring fact of life. No one at the FTC has 
made a cost-benefit analysis of either the legislative/regulatory 
approach or the industry self regulation approach.
    In its response to this question, the majority basically says, as 
it did in the Privacy Report that, regardless of the costs of 
legislatively imposed privacy requirements, Congress should impose them 
anyway, and we will work out the problems later. This could have a 
chilling effect on the New Economy, and the damage could be difficult 
to repair.
    Please let me know if I can provide additional information on this 
important matter.
        Sincerely,
                                              Orson Swindle
                                 ______
                                 
                        Center for Democracy and Technology
                                  Washington, DC, September 8, 2000
Hon. John McCain,
Chairman,
Senate Committee on Commerce, Science, and Transportation,
Washington, DC.

Dear Chairman McCain,

    Thank you again for inviting the Center for Democracy and 
Technology (CDT) to testify at the May 25, 2000 oversight hearing on 
Internet privacy. We are happy to answer the Committee's additional 
question on CDT's view of current practices in Internet advertising.
    The ability to personalize and customize content for the individual 
is one of the main features drawing a vast number of individuals and 
businesses to the Internet. Individuals can be empowered by this 
personalization. For example, tailoring information to a person's needs 
could help a citizen more easily find details about their local 
elections or a consumer could aggregate advertisements in order to 
compare prices. In both of these cases, some sort of personal 
information or preference data may be needed. All of these and other 
similar activities should be encouraged, but in each case the companies 
providing the personalization service must make decisions about how 
they plan to protect the individual's privacy in the process. Too 
often, CDT has seen common Internet business practices that 
surreptitiously collect information. These practices should not be 
blamed on a particular technology, but on how tracking technologies are 
utilized.
    Simply put, individuals should be told when decisions are being 
made about them.
    CDT is not a business organization and therefore we cannot offer a 
comparison or analysis of the effectiveness of a particular business or 
marketing plan, but we can offer an assessment of ways to personalize 
while protecting privacy. Despite the polls showing that as many of 96% 
of Americans are concerned about privacy, many companies still do not 
take privacy into account or purposely ignore privacy when creating new 
business models. These companies are left to defend bad practices that 
could have been avoided at an earlier stage if privacy had been a 
consideration.
    The good news is that the tide has begun to turn. Everyday CDT 
meets with companies that want to make sure that they are protecting 
privacy or have created new privacy enhancing technologies that put 
users in control. Two members of the CDT staff have recently written a 
short article entitled ``Your Place or Mine: Privacy Concerns and 
Solutions for Client and Server Side Storage of Personal Information'' 
* detailing some of the legal and technical concerns that business 
should take into consideration when making decisions about how to 
personalize. I have also included a recent law review article with a 
broader overview.*
---------------------------------------------------------------------------
    * The information referred to has been retained in the Committee 
files.
---------------------------------------------------------------------------
    I would be happy to answer any remaining questions that you may 
have. Please feel free to contact me.
        Sincerely,
                                              Jerry Berman,
                                                Executive Director.
cc: Senator Max Cleland
                                 ______
                                 
                  Association of National Advertisers, Inc.
                                      Washington, DC, June 12, 2000
Hon. John McCain,
Chairman,
Committee on Commerce, Science, and Transportation,
United States Senate
Washington, D.C.

Dear Mr. Chairman:

    The Association of National Advertisers (ANA) commends you for 
holding the May 25th hearing on Internet privacy issues and the FTC's 
report on the most recent privacy ``sweep.'' We continue to believe 
that the most effective way to protect privacy in the online 
environment is through a combination of strong industry self-
regulation, consumer empowerment and strong FTC enforcement under 
existing legal authority. While much more remains to be done, we 
believe that industry self-regulation has made substantial progress in 
the past few years. Also, the FTC has been an active, effective ``cop 
on the beat'' in this area. Therefore, ANA believes it would be 
counterproductive and premature for Congress to adopt broad privacy 
legislation at this point.
    We would appreciate it if you would include these comments in the 
official record for the May 25, 2000 hearing.
    In last year's ``report card'' to Congress on the state of online 
privacy protection, the FTC stated: ``The Commission believes that 
self-regulation is the least intrusive and most efficient means to 
ensure fair information practices online, given the rapidly evolving 
nature of the Internet and computer technology.'' We agreed then and 
strongly believe now that those sentiments continue to be correct.
    The most recent FTC survey found significant progress in the number 
of sites that posted privacy policies, 88% of a random sample and 100% 
of the most popular sites. This is truly a major improvement from the 
FTC's first sweep in 1998, when only 14% of Web sites had any 
disclosure about privacy policies.
    We agree with you that the privacy disclosures on many Web sites 
are too long and complex. We have urged our member companies to take 
another look at their notices to make sure that, to the maximum extent 
possible, the disclosures are clear and conspicuous and in language 
that ordinary consumers can understand.
    According to the FTC report, only 20% of the busiest commercial 
sites implement all four of the fair information principles of notice, 
choice, access and security. We believe that the 20% finding must be 
placed in the proper context.
    While most sites have policies on notice and choice, many are still 
developing policies on the complex issues of access and security. These 
issues are very challenging, as demonstrated by the report of the 
Commission's Advisory Committee on Online Access and Security (ACOAS). 
Even the FTC admits in its report that it has not been able to 
establish clear standards on how to implement these policies. Yet the 
FTC's report graded down Web sites for not fully addressing access and 
security.
    Everyone agrees on the concepts of access and security, but these 
issues are the true Gordian Knot of privacy. Implementing these 
concepts is a difficult and complex process. Providing consumers with 
broad access to information, without adequate protections, poses 
potential severe security risks. Overly stringent security precautions 
can make access very difficult.
    Effective privacy protection is more than a numbers game. Even if 
100% of Web sites provided easy access to information, without 
stringent security precautions, 100% access may in fact diminish rather 
than enhance consumer privacy. It is thus not surprising that while 
most Web sites address notice and choice, many are still struggling 
with how best to address access and security. The online community is 
nevertheless committed to addressing these areas in a timely and 
effective manner.
    Though groups such as the Online Privacy Alliance (OPA), ANA and 
others in the business community have reached out to encourage all 
commercial Web sites to post privacy policies. There are now three 
major privacy seal programs in operation and numerous software programs 
available in the marketplace. Several tools are available that allow 
consumers to surf online completely anonymously. New technological 
solutions such as P3P are closer to implementation. A number of major 
marketers have refused to place advertising on Web sites that do not 
have strong privacy policies.
    These and other self-regulatory efforts can respond more quickly to 
changes in the marketplace than an overly restrictive regulatory 
regime. We must be careful not to impose regulations that would impede 
the growth of the Internet, rather than enhance it.
    While more must be done, we believe self-regulation is working and 
becoming stronger. ANA, several of our member companies and other 
industry groups are committed to taking major steps to accelerate these 
efforts. These steps will include improving privacy policies and making 
them more user-friendly, further development of technological tools to 
empower consumers to protect themselves, and a broad consumer education 
program.
    As you know, the FTC already has broad power to regulate the online 
marketplace under section 5 of the FTC Act. We believe that this 
authority, coupled with consumer education programs and enhanced 
technological tools, is the most effective and flexible approach to the 
rapidly changing online environment. Since the Internet is a global 
medium, there are real, practical limitations to the reach of national 
legislation and regulation. Therefore, effective self-regulation and 
consumer empowerment become more important in this environment.
    We remain committed to working with you to protect the privacy of 
online consumers. However, we believe that broad privacy legislation at 
this point would be premature and counterproductive.
    Thank you for your consideration of these views. Please feel free 
to contact me if you have any questions.
        Sincerely,
                                           Daniel L. Jaffe,
                                          Executive Vice President.
                                 ______
                                 
Prepared Statement of Hon. Robert G. Torricelli, U.S. Senator from New 
                                 Jersey

    Mr. Chairman and Members of the Committee, I am honored to have the 
opportunity to address online privacy, an issue that is of growing 
concern to the millions of Internet users all across the country and 
the world. It is estimated that over 100 million Americans have the 
ability to access the Internet. The rise in the use of the Internet has 
led to concerns regarding the privacy of personal information 
transmitted online, particularly, as more people use the Internet for 
transmitting sensitive financial and medical information and for 
shopping purposes. While some argue that given the Internet's global 
reach and constantly changing technology, industry self-regulation 
would best protect privacy, others advocate for strong legislative and 
regulatory protections. And, still others, such as the witnesses here 
before us today, recommend a multilayered protection consisting of 
self-regulatory efforts supplemented by legislation authorizing 
regulatory oversight. Today's hearing is an important way for Congress 
to gather the information necessary to thoughtfully consider the range 
of issues involved in the online privacy debate and to evaluate the 
proper way to address those issues.
    An Internet users' life is ``virtually transparent.'' \1\ This is 
in part due to the number of companies that fail to provide consumers 
with full disclosure regarding how the company may use personal 
information transmitted online. As the Federal Trade Commission's (FTC) 
May 2000 report ``Privacy Online: Fair Information Practices in the 
Electronic Marketplace'' reveals, only forty-one percent of Web sites 
in the random sample and sixty percent of the most popular sites 
provide the most critical of fair information practice: notice and 
choice.\2\ The notice that is provided is often densely worded and at 
times even misleading.
---------------------------------------------------------------------------
    \1\ Jeffrey Rosen, Why Internet Privacy Matters, The New York Times 
Magazine, April 30, 2000, at 52.
    \2\ FTC, Privacy Online: A Report to Congress, May, 2000 at 13.
---------------------------------------------------------------------------
    Even more troubling are the number of companies allowing online 
marketers to place third-party cookies on their Web sites. Without our 
consent or knowledge, programs known as ``cookies'' monitor and collect 
information regarding our Web browsing habits. Personal data is also 
extracted directly by Web sites whenever we transmit the information 
required to purchase a product or surf the Internet for a specific 
topic. The FTC survey found that fifty-seven percent of sites in the 
random sample and seventy-eight percent of the most heavily trafficked 
sites allow the placement of cookies by third parties and that the 
majority of these cookies are placed by advertising companies engaging 
in online profiling. The report further revealed that the majority of 
Web sites that allow third-party cookies do not disclose that fact to 
consumers.\3\
---------------------------------------------------------------------------
    \3\ Id. at 21.
---------------------------------------------------------------------------
    Our actions will be monitored and our information will be shared 
unless we specifically request that a company not do so, a process 
known as ``opting out'' Opting out requires a user to directly contact 
a site to decline disclosure. Online industries argue that by posting 
opt out features, they are, in fact, affording consumers a choice to 
protect their privacy. However, as a means of securing the right to 
online privacy, opting out is a burdensome solution that has proven 
itself largely ineffective. Opt out procedures are often confusing and 
obscured within a Web site. They are therefore rarely exercised. One 
leading marketing company that tracks eighty million online consumer 
profiles has revealed that it receives an average of only twelve opt 
out requests per day.
    This situation, while unsettling, is not inherently menacing. 
Marketing, both online and off, is a common and often beneficial 
practice occurring daily in other forms such as mailings and telephone 
surveys. Businesses benefit from online marketing through improved 
efficiencies resulting from a more detailed analysis of their markets. 
Many consumers also desire the information marketing provides about 
products and services that reflect their preferences and budgets. A 
healthy balance can and must be established that allows consumers and 
commerce to reap the benefits of these practices but in a way that is 
mindful of the public right to privacy. This balance has yet to be 
achieved. Unlike individuals choosing to partake in surveys and 
questionnaires, those of us participating in online marketing do so 
unwittingly and involuntarily, unable to hang up a phone or throw away 
an envelope.
    Disturbing examples such as these point to an immediate need to 
provide consumers with direct control over outside access to their 
online activities. Consumers must be given the right of consent prior 
to any disclosure of personal information. They must be afforded a 
clear choice to ``opt in'' to disclosure programs rather than the need 
to opt out of them. They must also be given clear and accessible 
knowledge of the extent of their privacy so that any choice they make 
will be fair and informed. Web sites must accept the burden of 
persuading consumers of the benefits and desirability of information 
sharing. If companies are successful in convincing consumers that these 
benefits are clear and substantial, consumers will readily agree to 
participate.
    Early this year, with these provisions in mind, I introduced S. 
2063, the Secure Online Communication Enforcement Act of 2000. This 
legislation was intended to establish a national dialogue to educate 
Americans about the challenges of cyberspace. In doing so, I hope it 
will intensify public participation in an emerging debate to determine 
the relationship of the Internet to our society and the role of our 
government in determining that relationship. This dialogue is also 
vital towards preserving and strengthening public confidence in the 
viability of the Internet as a secure medium for commerce and 
information exchange. Consumers are currently spending over fifty 
billion a year at over eleven million dot-coms.\4\ As ``The Industry 
Standard'' recently argued, customer relationships are the new currency 
of the Internet. And, if e-commerce companies place a greater value on 
the customer data they collect rather than on the customer 
relationships they are building, they risk squandering the enormous 
potential of the Internet, thereby relegating it to a secondary role in 
the American economy.\5\
---------------------------------------------------------------------------
    \4\ Saul Klein and Tara Lemmey, Customer Relationships: The Net's 
New Currency, The Industry Standard, Mar. 13, 2000, at 275.
    \5\ Id.
---------------------------------------------------------------------------
    The SECURE Act is mindful of the need to involve Congress in the 
issue of online privacy because of the industry's demonstrated 
inability to provide adequate and enforceable self-regulation. It is 
also mindful of the need to limit our involvement and shield the 
Internet from a system of rigid government regulations that would 
stifle its dynamic expansion and development. We must remember that 
during America's great economic revolutions, government has functioned 
best as a silent partner with industry, fostering growth, but also 
molding it in a socially responsible manner. Therefore, instead of 
regulating, the SECURE Act expands online freedom. It empowers 
consumers with the ability to protect themselves and make the informed 
choices that will render this legislation self-enforcing. It prevents a 
patchwork of state laws from miring the global growth of online 
commerce. And, it avoids the necessity to resort to extensive FTC 
oversight.
    The SECURE Act is a beginning of a national dialogue on online 
privacy and does not represent an end product in addressing this issue. 
Senator's Burns, Wyden, Leahy, Hatch and now Hollings have also 
introduced important contributions to the debate. I look forward to 
working with them in reaching a consensus on the most appropriate 
legislative response to the privacy issues raised by the new 
technologies of the information age. Although I believe that 
entrepreneurial and innovative practices online are best served by 
minimizing the government's regulatory authority over the Internet, the 
FTC's report is pivotal to the development of appropriate public policy 
regarding online privacy. I am pleased that the FTC has officially 
acknowledged the need for online privacy standards with a statutory 
basis.
    Again, I thank the Chairman for giving me the opportunity to 
participate in this hearing. I look forward to working with the 
Committee to reach conclusions that are balanced and fair and that give 
Americans a greater sense of confidence in the privacy of their 
personal information.


```