OMS II Web Measurement and Customization Technologies

Required Additions to the Agency Privacy Policy when

Web Measurement and Customization Technologies are Used

1

Use of Web Measurement and Customization Technologies

Office of Management and Budget (OMB) Memorandum 10-22 (M-10-22), “Guidance for Online Use of 

Web Measurement and Customization Technologies,” authorizes agencies to employ web measurement 

and customization technologies for the purposes of improving the Federal Government’s services and 

behavior online. OMB defines web measurement and customization technologies as technologies that 

are used to remember a customer’s online interactions with a website or online application in order to 

conduct measurement and analysis of usage or to customize the user’s experience.

OMB M-10-22 delineates the following three “tiers” of web measurement and customization 

technologies for the purposes of describing their functionality:

a. Tier 1—Single Session. This tier encompasses any use of single session web measurement and 

customization technologies.

b. Tier 2—Multiple Session Without Personally-Identifiable Information (PII). This tier 

encompasses any use of multi-session web measurement and customization technologies when no 

PII is collected (including when the agency is unable to identify an individual as a result of its use 

of such technologies).

c. Tier 3—Multiple Session With PII. This tier encompasses any use of multi-session web 

measurement and customization technologies when PII is collected (including when the agency is 

able to identify an individual as a result of its use of such technologies).

Agencies may use Tier 1 and Tier 2 web measurement and customization technologies without formal 

approval as long as they—(1) otherwise comply with M-10-22 and all other relevant policies; (2) provide 

clear and conspicuous notice in their online Privacy Policy citing the use of such technologies; and (3) 

comply with their internal policies governing the use of such technologies. 

Proposals to use Tier 3 web measurement and customization technologies, however, must use “opt-in” 

functionality and are subject to a review and approval process that requires each such proposed use to—

(1) be reviewed by the Senior Agency Official for Privacy; (2) be published for a 30-day public notice 

and comment period, unless exempted by the Chief Information Officer (CIO); (3) be reconsidered in 

light of any public comments received; and (4) receive explicit written approval from the CIO.

Within the Department of the Treasury, the Assistant Secretary for Management (ASM) serves as the 

Senior Agency Official for Privacy (SAOP) and the Deputy Assistant Secretary for Information Systems

also serves as the Department’s Chief Information Officer. Additionally, under current Department of 

the Treasury Directive (TD) 81-08, paragraph 2, the authority to approve the use of Tier 2 and Tier 3 

web measurement and customization technologies may only be granted by the Secretary of the Treasury. 

Because M-10-22 no longer requires an agency head to approve such uses, and because the ASM is the 

promulgating authority for TD 81-01, the ASM currently has the authority to grant an exception that 

would allow either the ASM or the CIO—rather than the Secretary of the Treasury—to approve the 

proposed uses herein. 

At the time of this notice, the Treasury SAOP has reviewed the proposed uses of Tier 3 web 

measurement and customization technology.
OMS II Web Measurement and Customization Technologies

Required Additions to the Agency Privacy Policy when

Web Measurement and Customization Technologies are Used

2

The purpose of the web measurement and/or customization technology. 

The United States Mint is replacing its Integrated Retail Information System, the system it currently uses 

to manage its numismatic products and services, with the Order Management System II (OMS II). OMS 

II is a next generation online retail sales and fulfillment system that will allow the United States Mint to 

continue to conduct its numismatic program in a productive, reliable and secure manner, while at the 

same time providing the online consumer an experience comparable to electronic commerce 

(eCommerce) retail industry standards. OMS II will use Tier 2 and 3 web measurement and 

customization technologies to maximize the marketing capabilities of the OMS II environment and to 

improve the functionality and shopping experience the United States Mint offers its customers. 

The nature of the information collected, tracking Tier, and technology used.

To maximize the marketing capabilities of the OMS II environment and to improve the functionality and 

shopping experience the United States Mint offers its customers in the online store, OMS II will employ

both Tier 2 and Tier 3 web measurement and customization technologies. There are four types of 

visitors to the United States Mint’s online store who will encounter OMS II’s web measurement and 

customization technologies: (1) Nonregistered Online Visitors; (2) Registered Online Shopping Account 

Customers; (3) Unregistered Online Single Transaction Customers; and (4) Online Visitors Who 

Subscribe to Email Communications from the United States Mint. For each type of visitor to the online 

store discussed below, the following information will be provided: (a) the nature of the information 

collected; (b) the web measurement and/or customization technology usage (Tier 2 or 3); and (c) the 

technology used to track the visitor’s information.

(1) Nonregistered Online Visitors (“Nonregistered Visitors”). These are individuals who visit the 

United States Mint’s online store, but do not register for an online shopping account, make any 

purchases or subscribe to receive emails (e.g., newsletters) from the United States Mint.

(a) The nature of the information collected. Certain information is automatically collected from 

all Nonregistered Visitors to the online store using cookies (files that are placed on a website 

visitor’s computer to track and collect information). If Nonregistered Visitors go to the 

online store (without first disabling first-party cookies) solely to read or download 

information—and do not, for example, send e-mail to the United States Mint or complete an 

online form or opt-in to certain data collections and uses (by purchasing online, creating an 

account or subscribing to a newsletter)—the United States Mint collects and stores only the 

following information:

 Networking: the domain used to access the Internet and connection speed;

 When/Where: the date, time, and region from which the online store was accessed;

 Content: pages visited and files downloaded in the online store;

 Referrer: the Internet address of a website that may have referred or linked the visitor to 

the online store; and

 Device/Browser: the user’s browsing and purchasing behaviors while in the online store 

(but not on the rest of the United States Mint’s website or other sites to which the user 
OMS II Web Measurement and Customization Technologies

Required Additions to the Agency Privacy Policy when

Web Measurement and Customization Technologies are Used

3

navigates after leaving the online store), and other technical information about the 

computer or device used to access the online store (e.g., operating system, screen 

resolution and color, Flash/Java support, language). 

When Nonregistered Visitors navigate to the United States Mint online store without first 

disabling first-party cookies, they are assigned an auto-generated visitor identifier to track 

their browsing and purchasing behavior while they remain in the online store (the tracking 

ends if the Nonregistered Visitor leaves the online store and navigates to other parts of the 

United States Mint site or to other sites). The United States Mint automatically collects the 

geo-location data contained in the first six digits of the internet protocol (IP) address 

(“truncated” [not the full] IP address) and device settings. IP addresses allow a website (e.g., 

the United States Mint’s online store) to recognize the device when the device owner visits 

the site. Because the truncated IP address reveals only broad geo-location data (i.e., a 

particular region), it is not PII. This information is collected whether or not an individual 

who navigates to the online store is a Registered Customer (see below) or has logged into his 

or her customer profile.

(b) The web measurement and/or customization technology usage Tier. Generally, Nonregistered

Visitors will only encounter Tier 2 tracking (no PII associated with their browsing and 

purchasing behavior). They will not encounter Tier 3 tracking (association of their OMS II 

stored PII with their browsing and purchasing behavior) unless they opt in to the use of these 

technologies by becoming Registered Customers, Single Transaction Customers, or Email 

Subscribers. 

(c) The technology used to track the visitor’s information. A Tier 2 session cookie will be used 

to track the Nonregistered Visitor’s information. This means that as soon as the 

Nonregistered Visitor leaves the online store to navigate to another website (even other parts 

of the United States Mint’s website), the tracking ends (and only begins again the next time 

they visit the online store without first disabling first-party cookies).

(2) Registered Online Shopping Account Customers (“Registered Customers”). The United States 

Mint provides customers the option of creating a registered account. These Registered 

Customers are individuals who visit the United States Mint’s online store, register for an account 

and make purchases online. 

(a) The nature of the information collected. During registration, Registered Customers must 

provide: name (first and last), physical address, phone number, email address, login name, 

password, product and communication preferences, billing and delivery address (including 

country, city, county, state and zip code), order history and credit card payment information. 

In accordance with the online store’s Terms of Service, by providing this PII, the customer is 

also warranting that he or she is 18 years of age or older. Registered Customers are also 

required to select and answer one of many security questions available (the responses to 

which contain PII). 

(b) The web measurement and/or customization technology usage Tier. Registered Customers 

only encounter tier 2 web measurement and customization technologies (not linked to their 
OMS II Web Measurement and Customization Technologies

Required Additions to the Agency Privacy Policy when

Web Measurement and Customization Technologies are Used

4

PII) during their visits to the online store that predate their registration. If customers wish to 

register to create an online shopping account, the United States Mint also requires that they 

explicitly agree (i.e., opt in) to the use of their full IP address (not merely the truncated [geolocation] version collected for online store Nonregistered Visitors) to track their browsing and 

purchasing behavior within the online store using a Tier 3 persistent cookie. This Tier 3

cookie is used to associate Registered Customers’ browsing and purchasing behavior with 

other information they provide to the online store. The full IP address is PII because it can 

conceivably be traced to an individual when combined with other information (e.g., 

information from the Internet service provider regarding the account holder from whom the 

IP address originated, plus additional information from the owner of the account). 

(c) The technology used to track the visitor’s information. The Registered Customer’s browsing 

and purchasing behaviors are tracked using a persistent cookie that associates the customer’s 

PII (name, billing and shipping address, phone number, email address, payment, birth month

(if provided), and credit card information, product and communication preferences and order 

history) with his or her browsing and purchasing behavior (e.g., pages in the online store 

visited, products viewed and purchased etc.).

For United States Mint customers who already have an existing online shopping account 

when the United States Mint launches OMS II, the United States Mint will invite each of 

these customers to confirm his or her registration. During the confirmation process, 

preexisting customers will be asked to agree to become a Registered Customer in OMS II by

explicitly opting in to the use of persistent cookies to monitor their online store browsing and 

purchasing behavior and have it associated with their other account information. They will 

also be required to create a new password to maintain access to their account and account 

services. To do this, existing customers will need the answer to their security question that 

they provided when they first registered for an account on the online store.

(3) Unregistered Online Single Transaction Customers (“Single Transaction Customers”). 

Customers do not need to create an online shopping account to make an online purchase. 

(a) The nature of the information collected. To make an online purchase of any kind (Registered 

Customer or Single Transaction Customer), the United States Mint requires information such 

as the customers’ credit card data, telephone number, name, and e-mail and postal addresses 

for customers or the gift recipient. In accordance with the online store’s Terms of Service, by 

providing this PII, the customer is also warranting that he or she is 18 years of age or older.

(b) The web measurement and/or customization technology usage Tier. Single Transaction

Customers only encounter Tier 2 web measurement and customization technologies (not 

linked to their PII) during their visits to the online store that predate their making an online 

store purchase or subscribing to United States Mint email communications. When Single 

Transaction Customers make a purchase, they are opting-in to certain collections and uses of 

their browsing and personal information. Single Transaction Customers must explicitly agree 

(i.e., opt in) to have their full IP address (not the truncated version collected for NonRegistered Visitors) and their browsing and purchasing behavior tracked within the online 

store and associated with other information they provide to the online store. 
OMS II Web Measurement and Customization Technologies

Required Additions to the Agency Privacy Policy when

Web Measurement and Customization Technologies are Used

5

(c) The technology used to track the visitor’s information. Single Transaction Customers’

browsing and purchasing behaviors are tracked using a persistent cookie that associates their 

PII (First name, last name, telephone number, email address, billing address, shipping 

address, credit card information, [including expiration date and security code] credit card 

data) with their browsing and purchasing behavior. A customer’s browsing and purchasing 

behavior will be associated with additional types of PII if the Single Transaction Customer

also conducts other transactions in the online store (e.g., becomes an Email Subscriber).

(4) Online Visitors Who Subscribe to Email Communications from United States Mint (“Email 

Subscribers”). Online store visitors have the option of becoming Email Subscribers to receive email communications (promotional/informational newsletters) from the United States Mint with 

general information about its products and services. Email Subscribers can (but need not) be 

customers who purchase products and services from the United States Mint. Therefore, these 

visitors can also be Single Transaction Customers or Registered Customers.

(a) The nature of the information collected. When an online store visitor becomes an Email 

Subscriber, the United States Mint collects information including the Email Subscriber’s 

name, e-mail address, birth month, and browsing and purchasing (if any) behavior. In 

accordance with the United States Mint online store’s Terms of Service, by providing this PII, 

the customer is also warranting that he or she is 18 years of age or older. 

(b) The web measurement and/or customization technology usage Tier. Email Subscribers who 

are neither Registered Customers nor Single Transaction Customers at the time they 

subscribe to email communications from United States Mint only encounter Tier 2 web 

measurement and customization technologies during their visits to the online store that 

predate their email communication subscription or online registration or purchase. Email 

Subscribers must explicitly agree (i.e., opt in) to allow their browsing and purchasing 

behavior to be tracked using a Tier 3 persistent cookie which is associated with other 

information they provide to the United States Mint online store. 

(c) The technology used to track the visitor’s information. Email Subscribers’ browsing and 

purchasing behavior is tracked using a Tier 3 persistent cookie that associates their PII (name, 

e-mail address, and birth month) with their browsing and purchasing behavior. Email 

Subscribers’ browsing and purchasing behaviors will be associated with additional types of 

PII if the Email Subscriber also conducts other transactions in the online store (e.g., becomes 

a Registered Customer or Single Transaction Customer ).

The purpose and use of the information collection.

31 U.S.C. sections 5111(a)(3) and 5136 authorize the Secretary of the Treasury to prepare and distribute 

numismatic items and establishes the United States Mint Public Enterprise Fund from which the United 

States Mint may draw funds for the purpose of bureau operations and programs, including the 

production, administration, distribution, marketing, purchase, sale, and management of coinage and 

numismatic items. Information collected by OMS II Tier 2 and Tier 3 web measurement and 
OMS II Web Measurement and Customization Technologies

Required Additions to the Agency Privacy Policy when

Web Measurement and Customization Technologies are Used

6

customization technologies is used to support United States Mint operations and programs and will be 

used solely for the purposes of such operations and programs.

Information collected through the use of Tier 2 web measurement and customization technologies will 

provide the United States Mint with insights necessary to enhance online customers’ browsing 

experiences and effectively focus marketing efforts to optimize customer engagement. Information 

collected through the use of Tier 3 web measurement and customization technologies will improve 

online store navigation for customers who create a registered customer account by allowing them the 

opportunity to customize website settings based on interests and needs and saving them from having to 

provide duplicative information each time they make a purchase. In addition, it will enable the United 

States Mint to create market segmentation groups and perform marketing analytics that it will use to 

provide customers with personally-customized marketing recommendations.

Whether and to whom the information will be disclosed.

Information collected by OMS II web measurement and customization technologies will not be shared 

with external agencies or otherwise except with explicit permission from the individual customer and in 

accordance with the Privacy Act and the Freedom of Information Act. 

 

The privacy safeguards applied to the information.

The United States Mint applied the principles of “privacy by design” to this system. This means that 

privacy has been addressed as a requirement throughout OMS II’s acquisition, design, and development 

lifecycle and will remain a priority during operations. Procurement agreements require that service 

providers and subcontractors must comply with Federal, Department of the Treasury, and United States 

Mint privacy and information security policies, regulations and directives. All contractors and 

subcontractors working in the development and maintenance of the system and program are required to 

sign non-disclosure agreements requiring that they use the information related to the program only for 

United States Mint purposes. Pursuant to M-10-22 and TD 81-08, the United States Mint will not, under 

any circumstances, use OMS II web measurement and customization technologies: 

a. to track individual-level user activity on the Internet outside of the United States Mint online 

store (i.e., no tracking is even done on other parts of the United States Mint’s website); 

b. to share the data obtained through such technologies, without the user’s explicit consent, with 

other departments or agencies except pursuant to the routine uses stated in the system of records 

notice (Treasury/ United States Mint - .009 – Order Management System (OMS), replacing

United States Mint .009, “Retail Sales System”); 

c. to cross-reference without the user’s explicit consent, any data gathered from web measurement 

and customization technologies against PII in a way that will make it possible to identify a 

particular individual with their online browsing and purchasing behavior; 

d. to collect PII without the user’s explicit consent in any fashion. 

In addition to the privacy by design requirements incorporated throughout the procurement and 

development process, United States Mint employee and contractor employee access to OMS II 

information will be restricted to the least amount required to accomplish their assigned duties. Further, 

all such employees are required to complete annual security and privacy awareness training and sign the 
OMS II Web Measurement and Customization Technologies

Required Additions to the Agency Privacy Policy when

Web Measurement and Customization Technologies are Used

7

IT System User Rules of Behavior. The Rules of Behavior outline the appropriate and mandatory 

behavior of all those using United States Mint’s IT systems or systems operated on behalf of the United 

States Mint.

Information maintained by OMS II will be safeguarded and retained in accordance with all Federal, 

Department of the Treasury, and United States Mint security and privacy regulations, directives, and 

guidelines. For additional information about the specific privacy safeguards applied to OMS II, review 

the OMS II privacy impact assessment: Treasury/ United States Mint - .009 – Order Management 

System (OMS), replacing United States Mint .009, “Retail Sales System.”

The data retention policy for the information.

Electronic information in OMS II is being evaluated to establish the proper maintenance and disposition 

of records contained in the system. Information will be maintained in a secure environment to ensure 

that no records are destroyed until a retention schedule is officially approved by the Archivist of the 

United States.

Whether the technology is enabled by default or not and why.

OMS II Tier 2 web measurement and customization technologies are enabled by default and gather 

aggregate and anonymous data for analytical and marketing purposes. Pursuant to M-10-22, only Tier 3 

web measurement and customization technologies require opt-in functionality. 

OMS II Tier 3 web measurement and customization technologies are not enabled by default; they are 

only enabled after a Nonregistered Visitor explicitly opts in to become a Registered Customer, Single 

Transaction Customer, and/or Email Subscriber. Nonregistered Visitors are notified at the time they 

create a registered customer account, make a purchase, or subscribe to receive United States Mint 

marketing information via email that they are opting-in to the use of Tier 3 web measurement and 

customization technologies. The notification includes notices that their browsing and purchasing 

behavior will be tracked and that information collected will be associated with their customer profile and 

the email address provided. 

How to opt-out of the web measurement and/or customization technology.

While OMS II Tier 2 web measurement and customization technologies are enabled by default, all 

visitors to the United States Mint’s online store (whether they previously opted in or not) may disable

first-party browser cookies to prevent their browsing and purchasing behavior from being associated 

with any particular customer, IP address, or other PII during their visit to the online store. Registered 

Customer, Single Transaction Customer, and/or Email Subscribers, however, must enable first-party 

browser cookies before making a purchase in the online store (after which, they are free to, once again, 

disable first-party cookies until they wish to make another purchase).

In addition to disabling browser cookies before visiting the online store, visitors may opt-out of OMS II 

uses of Tier 3 web measurement and customization technologies by not creating a registered customer

account, canceling an existing account, subscribing to newsletters and notification services, and/or

refraining from using the online store to purchase United States Mint numismatic products. 
OMS II Web Measurement and Customization Technologies

Required Additions to the Agency Privacy Policy when

Web Measurement and Customization Technologies are Used

8

Statement that opting-out still permits customers to access comparable information or services.

Declining to opt-in to OMS II Tier 3 web measurement and customization technologies will not prevent 

a customer from accessing information on the United States Mint’s online store. Declining to opt-in, 

however, will prevent customers from using the online store to place orders for United States Mint 

numismatic products. As an alternative to the bureau’s online store, customers who choose not to opt-in 

may place orders for United States Mint numismatic products by using the United States Mint’s toll-free 

customer service line (800-872-6468 or TTY 888-321-6468), placing a mail order (United States Mint, 

PO Box 71191, Philadelphia, PA 19176-6191), or visiting a United States Mint point of sale (i.e., in 

person) location. 

The identities of all third-party vendors involved in the measurement and customization process. 

OMS II is a turn-key system developed, provided, and maintained by PFSweb, Inc. Procurement 

agreements require PFSweb, Inc. and subcontractors to comply with Federal, Department of the 

Treasury, and United States Mint privacy and information security policies, regulations and directives. 

While PFSweb, Inc. is responsible for the development and maintenance of the OMS II environment, 

other third-party vendor applications support OMS II web measurement and customization processes. 

Those third-party vendors are as follows: AgilOne, Demandware, IBM Digital Analytics, and Google 

Analytics. For detailed information about how each of these third-party vendors supports OMS II web 

measurement and customization processes, please review the OMS II privacy impact assessment entitled: 

eCommerce End-to-End Solution: Order Management System II (OMS II), available at 

http://www.treasury.gov/open/Pages/open-notices.aspx.