Federal Trade Commission

Privacy Impact Assessment

for:

Web Customer Satisfaction Surveys

May 2012
2

1 SYSTEM OVERVIEW

The Federal Trade Commission uses customer satisfaction surveys to get feedback about 

our websites so we can evaluate the websites and make improvements. These surveys allow 

the FTC to measure overall satisfaction with the site and get specific feedback about elements 

such as navigation, look and feel, and content. Using data from these surveys, the FTC can 

determine what specific information and resources our visitors want and whether or not the 

sites are helping them complete their tasks. Because hundreds of government agencies also

use the American Customer Satisfaction Index (ACSI) survey, the FTC can compare our results 

with federal benchmarks and other federal websites. 

The FTC uses a contractor, ForeSee Results, to collect and store survey data. The surveys 

are not intended to ask for nor collect personally identifiable information from respondents.

Currently, the FTC plans to implement customer satisfaction surveys on three of its 

websites: ftc.gov, ftccomplaintassistant.gov, and OnGuardOnline.gov.

2 INFORMATION COLLECTED AND STORED WITHIN THE SYSTEM

2.1 What information is to be collected, used, disseminated, or maintained by the 

system?

The customer satisfaction survey system creates and maintains a random “SurveyID” for 

each visitor who agrees to participate in a survey (“respondent”) and then collects answers to 

survey questions. Respondents are asked about their overall satisfaction with the site and its 

elements, such as navigation, content, and look and feel. Respondents also may be asked for

suggestions about how to improve the site. In addition, the survey asks for basic information 

about the respondents, such as their age group, their reasons for visiting the site, and their role 

(i.e., consumer, business person, lawyer, etc.).

In addition to survey responses, the system collects how many pages each visitor to the 

website has viewed; what page the visitor was viewing when the survey appeared; what 

language, browser and operating system the visitor is using; the referring website; and any 

search terms that brought the visitor to the website. 

The system does not collect IP addresses, and is not intended to collect name, e-mail or 

home address, phone, or any other personally identifiable information that would allow the FTC 

to associate a survey response or SurveyID with an individual survey respondent. Some survey

questions allow respondents to type their own answers into an open comment field or other 

text field (rather than select a multiple choice answer). Because respondents can type their 

own answers, it is possible that they could include personally identifiable information about

themselves. The survey instructions expressly discourage respondents from including 

personally identifiable information, but the system cannot prevent respondents from doing so. 
3

2.2 What are the sources of the information in the system?

The survey respondents provide survey answers voluntarily. (The system generates a 

random number for each respondent.) 

Single-session cookies are used to gather information about each visitor to the website, 

such as how many pages a particular visitor has viewed; what page the visitor was viewing 

when the survey appeared; what language, browser and operating system the visitor is using; 

the referring website; and any search terms that brought the visitor to the website. A 

persistent cookie is used to prevent respondents from receiving survey invitations if they have 

recently completed a survey. Neither type of cookie collects personally identifiable information 

or IP addresses. (See 5.1 for more information). 

2.3 Why is the information being collected, used, disseminated, or maintained?

The FTC collects this information to measure the effectiveness of our websites and to 

plan improvements to the sites.

2.4 How is the information collected?

User feedback and other information concerning use and effectiveness of the site are

collected through an online survey. A certain percentage of site visitors are invited to take the 

survey. If they agree to do so, the survey will appear in a pop-up screen when they close the

browser or leave the site. Each survey respondent is assigned a randomly generated 24-

character identifier called the “SurveyID.” The SurveyID is associated with the responder’s 

answers and the date and time the survey was completed. 

In addition, information about each visitor’s use of the site is collected through singlesession cookies, as explained in 5.1. No information about the user is collected by the 

persistent cookie, but its presence on a user’s computer signals that the user has taken the 

survey within the last 30 days.

2.5 How will the information be checked for accuracy and timeliness?

The information will not be checked for timeliness or accuracy. It is opinion-based and 

provided directly by the survey respondents. 

2.6 Is the system using technologies in ways that the FTC has not previously employed 

(e.g., monitoring software, Smart Cards, etc.)? If so, how does the use of this technology 

affect individuals’ privacy?

The FTC has used these surveys on a limited portion of its site since August 2009. The 

surveys will now appear on the ftc.gov site more broadly. The use of the technology should 
4

have a minimal effect, if any, on individuals’ privacy because the survey is voluntary and is not 

meant to collect any personally identifiable information.

2.7 What law or regulation permits the collection of this information?

The FTC Act authorizes the FTC to prevent unfair and deceptive acts and practices in 

interstate commerce and, in furtherance of this mission, to gather, compile, and make 

information available in the public interest. See 15 U.S.C. 45, 46(a), (f). In addition, the Office of 

Management & Budget (OMB) Memorandum (June 13, 2011) on implementing Executive Order 

13571, Streamlining Service Delivery and Improving Customer Service, calls on agencies to 

solicit timely feedback in order to improve the quality of services.

The U.S. Department of the Interior’s Federal Consulting Group, which procures

ForeSee Results services and technology on behalf of federal agencies, has obtained clearances 

from the Office of Management and Budget for customer satisfaction surveys under the 

Paperwork Reduction Act. 

2.8 Considering the type of information collected and sources of collection, what privacy 

risks were identified and how were these risks mitigated?

It is possible that survey respondents could, despite instructions to the contrary, include 

personally identifiable information in their responses to questions that allow the respondents 

to type their own answers. Respondents occasionally include contact information or other 

personally identifiable information in these fields. The FTC will not share or disseminate any 

personally identifiable information that survey respondents choose to share. If the FTC 

discovers that a survey respondent has included sensitive personal information (i.e., a Social 

Security number, credit card number, etc.), then the FTC will work with the contractor to delete 

that information from the system. 

The survey uses session cookies to ensure that visitors have sufficiently browsed the site 

to answer the survey adequately and, if a visitor agrees to take the survey, to record survey 

answers. Individuals who agree to complete the survey will receive a persistent cookie, which is 

used to prevent respondents from receiving additional survey requests for 30 days. Both the 

single session and persistent cookies present a low privacy risk because they do not collect any 

personally identifiable information and will not be used to track visitors once they leave the 

site. Furthermore, the session cookie is automatically deleted after the visitor closes the 

browser, and the persistent cookie is automatically deleted after 30 days. In addition, a 

respondent may manually delete the persistent cookie from his or her computer at any time 

before it expires automatically.
5

3 USE AND ACCESS TO DATA IN THE SYSTEM

3.1 Describe how information in the system will or may be used.

The information will be used to evaluate FTC websites and to make improvements to 

these sites. Survey results are provided to the FTC through an online portal in aggregated 

reports that can be created spontaneously. For example, the agency can ask for website 

satisfaction scores for the last three months for survey respondents who self-reported that they 

were lawyers between the ages of 40 and 50. The contractor will also provide monthly reports 

and quarterly presentations that analyze the survey results. The FTC also has the ability to view 

each survey response. 

3.2 Which internal entities will have access to the information?

Website managers will have access to the information through an online portal and may 

share this information with others in the agency in aggregate and anonymous forms.

3.3 Which external entities will have access to the information? 

The contractor, ForeSee Results, collects and stores the information on behalf of the 

FTC. ForeSee Results’ analysts and other staff will have access to the information. 

4 NOTICE AND ACCESS FOR INDIVIDUALS

4.1 How will individuals be informed about what information is collected, and how is this 

information used and disclosed?

A percentage of site visitors will receive invitations to take the survey and can choose 

either “No, thanks” or “Yes, I’ll take the survey.” Those who say “yes,” will be presented with 

the survey and can review the questions. If a visitor declines to take the survey or if a 

respondent abandons the survey before completing it, any information collected from him or 

her will be discarded when he or she closes his or her browser. An explanation of how and why 

the information is collected and used will be included in the survey invitation and on the survey 

itself.

4.2 Do individuals have the opportunity and/or right to decline to provide information?

Yes; when visitors receive the survey invitation, they can select, “No, thanks.” If they

initially say “yes,” but later choose not to take the survey, they can abandon it at any time and 

their answers and any session cookie data will be discarded. The system will not generate a 

persistent cookie if a visitor declines to take the survey or abandons it before completion.
6

4.3 Do individuals have the right to consent to particular uses of the information? If so, 

how would an individual exercise this right?

No; by completing a survey, respondents agree to have their answers included in the 

survey data and cannot choose particular uses of the information. However, the FTC will only 

share survey data in aggregate or anonymous forms.

4.4 What are the procedures that allow individuals to gain access to their own 

information?

Because the survey data is collected through an anonymous process, users will not be 

able to gain access to their information after it has been submitted.

4.5 Discuss the privacy risks associated with the process of providing individuals access to 

their own records and how those risks are mitigated.

Because respondents will not be able to access their responses after submission, there 

are no associated privacy risks.

5 WEB SITE PRIVACY ISSUES

5.1 Describe any tracking technology used by the Web site and whether the technology is 

persistent or temporary (e.g., session cookie, persistent cookie, Web beacon). 

The survey uses session cookies to track information such as: how many pages a 

particular visitor has viewed; what page the visitor was viewing when the survey appeared; 

what language, browser and operating system the visitor is using; the referring website (i.e. 

Google); and any search terms that brought the visitor to the website. Single-session cookies 

do not collect personally identifiable information or IP addresses. The contractor collects this 

data to ensure that a visitor has sufficiently browsed the site in order to adequately answer the 

survey. Occasionally, this information may also be used for site quality and administration 

purposes. The session cookies are deleted automatically when the visitor closes his or her 

browser.

The survey uses a persistent cookie to ensure that survey respondents do not receive 

multiple FTC surveys within a specified time frame (30 days). This cookie does not collect any 

personally identifiable information or IP address from users, nor will the cookie be used to track 

visitors once they have left the site. Based on prior visitor feedback, we understand that 

respondents do not want to get survey invitations once they have a completed a survey, so the 

use of this persistent cookie will improve respondents’ site experiences.
7

5.2 If a persistent tracking technology is used, ensure that the proper issues are 

addressed.

The persistent cookies in the survey do not collect personally identifiable information 

and therefore the FTC has determined that the cookies are permitted without the special 

approval or comment processes described in OMB Memorandum M-10-22, Guidance for Online 

Use of Web Measurement and Customization Technologies (June 25, 2010).

5.3 If personal information is collected through a Web site, page, or online form accessible 

through the Internet, is appropriate encryption used? If not, explain.

Even though the survey is not intended to collect personally identifiable information, 

the contractor uses 128-bit SSL encryption when collecting data through the survey.

5.4 Explain how the public will be notified of the Privacy Policy. 

The survey invitation and the survey itself will link to the Privacy Policy. 

5.5 Considering any Web site or Internet issues, please describe any privacy risks 

identified and how they have been mitigated.

Survey data is available to FTC employees through an online portal. The online portal 

requires a login (username and password). Only a limited number of FTC staff have login 

credentials. The online login and portal uses SSL encryption. 

5.6 If the Web site will collect personal information from children under 13, or be directed 

at such children, explain how it will comply with the Children’s Online Privacy Protection Act 

(COPPA).

Generally, FTC websites are not intended for children under 13, and the survey is not 

intended to collect any personally identifiable information from children under 13. If the FTC or 

the contractor discovers that we have inadvertently gathered any such information for a child 

under 13, the FTC will work with the contractor to delete it immediately. 

6 SECURITY OF INFORMATION IN THE SYSTEM

6.1 Are all IT security requirements and procedures required by federal law being 

followed to ensure that information is appropriately secured?

Yes; the applicable contract between the Federal Consulting Group and the FTC

provides that collecting, analyzing, and reporting of the data will be conducted in full 

compliance with the Privacy Act of 1974. The Federal Consulting Group is also responsible for 

ensuring compliance with all other applicable IT security requirements and procedures.
8

In addition, the contractor, ForeSee Results, recognizes that the European Union has 

established strict protections regarding the handling of EU Personal Data, and ForeSee Results 

therefore has elected to adhere to the US-EU Safe Harbor Privacy Principles with respect to 

such EU Personal Data and Personal Data that it receives in the United States.

6.2 Has a Certification & Accreditation (C&A) been completed for the system or systems 

supporting the program?

No; per FTC policy, systems that have a FIPS 199 categorization of Low and are 

considered minor applications do not require a full C&A (i.e., formal security controls 

assessment and authorization).

6.3 Has a risk assessment been conducted on the system?

Yes.

6.4 Does the project employ technology that may raise privacy concerns? If so, please 

discuss its implementation.

Yes; and the FTC has addressed risks and vulnerabilities as described elsewhere in this

document. See, e.g., Section 2.8.

6.5 What procedures are in place to determine which users may access the system and 

are they documented?

FTC staff will have access to the system only as needed. Only individuals tasked with 

retrieving or analyzing the data to measure the effectiveness of the FTC websites and to plan 

improvements to the sites will have access to the survey data. Program managers may share 

information from the system but only in anonymous or aggregate forms.

At ForeSee Results, access to survey data is limited to the Client Services Department. 

Client Services staff can review all survey data from all of the company’s clients. 

6.6 Describe what privacy training is provided to users either generally or specifically 

relevant to the program or system. 

FTC staff complete annual FTC privacy training, and those who use this system must 

demonstrate a thorough understanding of the privacy implications of the system.

ForeSee Results staff completes privacy training annually during company-wide security 

training. There are additional trainings on a semiannual basis for Satisfaction Research Analysts

(SRA) on how to handle client’s data. This is defined in ForeSee Results procedures /policies 

documentation. 
9

6.7 What auditing measures and technical safeguards are in place to prevent the misuse 

of data?

Each FTC system administrator will have a unique login and password and will not share 

login credentials with anyone else. We will use strong passwords and will change them on a 

regular basis in accordance with FTC policy. 

The system also validates survey submissions to make sure that they come from 

approved URLs and survey code. 

6.8 To whom should questions regarding the security of the system be addressed?

Any questions regarding the security of the system should be directed to the FTC’s 

Information Assurance Manager.

7 DATA RETENTION

7.1 For what period of time will data collected by this system be maintained?

The data will be retained and disposed of in accordance with applicable schedules 

issued or approved by the National Archives and Records Administration (NARA). The data will 

be available through the online portal for as long as ForeSee Results continues to provide 

services to the FTC. The FTC plans to compare customer satisfaction over time and to keep 

records of these changes.

7.2 What are the plans for destruction or disposal of the information?

All data will be deleted/destroyed in accordance with Office of Management and 

Budget, NARA, and National Institute of Standards and Technology regulations and guidelines. 

The FTC will work with ForeSee Results to have sensitive personal information deleted 

immediately, if respondents choose to provide such information despite instructions to the 

contrary.

7.3 Describe any privacy risks identified in the data retention and disposal of the 

information, and describe how these risks have been mitigated.

See Section 2.8 for information regarding the privacy risks identified in the data 

retention. Because the survey is not intended to collect personally identifiable information, 

there are no significant privacy risks associated with the disposal of survey data.
10

8 PRIVACY ACT

8.1 Will the data in the system be retrieved by a personal identifier?

No.

8.2 Is the system covered by an existing Privacy Act System of Records notice (SORN)?

N/A

9 PRIVACY POLICY

9.1 Confirm that the collection, use, and disclosure of the information in this system has 

been reviewed to ensure consistency with the FTC’s privacy policy.

The collection, use, and disclosure of the information in this system has been reviewed 

to ensure consistency with the FTC privacy policy.
11

10. APPROVAL AND SIGNATURE PAGE 

Prepared for the Business Owners of the System by:

_________________________________ Date: __________

Nat C. Wood, Assistant Director

Division of Consumer and Business Education

Review:

__________________________________ Date: __________

Alexander C. Tang

Office of the General Counsel

__________________________________ Date: __________

Peter Miller

Acting Chief Privacy Officer

__________________________________ Date: __________

Jeffrey Smith

Information Assurance Manager

__________________________________ Date: __________

Jeffrey Nakrin

Records and Filings Office

Approved:

__________________________________ Date: __________

Jeffrey Huskey

Chief Information Officer