Privacy Online: A Report to Congress

In June 1998, the Federal Trade Commission presented a report to Congress titled Privacy Online: A Report to Congress based upon its examination of the information practices of over 1400 commercial sites on the World Wide Web, and assessed private industry’s efforts to implement self-regulatory programs to protect consumers’ online privacy. The Report included an analysis of 212 sites directed to children. The FTC examined the privacy practices of the surveyed websites in light of five core principles of privacy protection:

(1) Notice/Awareness;

(2) Choice/Consent;

(3) Access/Participation;

(4) Integrity/Security; and

(5) Enforcement/Redress.

The core principles require that: (1) consumers should be given notice of an entity's information practices before any personal information is collected from them; (2) consumers should be given choice as to how any personal information collected from them may be used; (3) individual's should be given the ability both to access data about him or herself and to contest that data's accuracy and completeness; (4) data collectors must take reasonable steps to ensure that data be accurate and secure; and (5) an effective enforcement mechanism must be in place to enforce the core principles of privacy protection. With these fair information practice principles and industry guidelines as background, the Commission conducted a survey of commercial sites on the World Wide Web. Although the Commission had encouraged industry to address consumer concerns regarding online privacy through self-regulation, the Commission did not find an effective self-regulatory system. The survey results found that the vast majority of online businesses had yet to adopt even the most fundamental fair information practice (notice/awareness). Moreover, trade association guidelines submitted to the Commission did not reflect industry acceptance of the basic fair information practice principles, nor contain with limited exception the enforcement mechanisms needed for an effective self-regulatory regime.

In the 1998 Report the Commission concluded that greater incentives were needed to encourage self-regulation and ensure widespread implementation of the basic privacy principles. In the specific area of children's online privacy, the Commission recommended that Congress develop legislation placing parents in control of the online collection and use of personal information from their children.