Privacy Policies on Consumer Web Sites

 

An Educational Service of the American Library Association

Office for Information Technology Policy

 

Prepared by Leslie Harris & Associates  www.lharris.com in conjunction with OITP staff  www.ala.org/oitp

-----------------------------------------------------

In an online environment where personally identifiable information is collected routinely, librarians could assume the important task of alerting patrons about the quantity and type of information a commercial web site collects and how that information is used.  One way librarians can help patrons safeguard their privacy is by educating them about commercial web site privacy policies and privacy certification programs. 

 

A privacy policy is a statement that explains what personally identifiable information a particular web site collects, how it uses that information, with whom the web site shares the information, and whether and how users can exercise control over their personal information.  It is helpful for librarians to understand how privacy policies work and how to locate them in order to help their patrons as they surf the web. 

 

In general, each page of a commercial web site should have a link, usually at the bottom of a page, to the web site's privacy policy.  Unfortunately, not all web sites comply with this practice, and privacy policies often may be difficult to locate.  In addition to, or in lieu of, privacy policies, some web sites will provide the user with a notice immediately prior to collecting personally identifiable information.   

 

Not all privacy policies are equal.  Some privacy policies fail to adequately identify the types of information collected from a user, whether the web site uses cookies, how the company will use the personally identifiable information that it collects, the affiliated and third party companies with whom the company will share the information, or provide the user with ways to correct the information collected, or object to particular uses of their personally identifiable information.  A good commercial web site privacy policy should answer the following questions:

 

+    What is the information being collected?

+    Why is it necessary to collect this information?

+    How is the information being collected?

+    Does the user have a choice regarding the type and quantity of personal information that the web site collects?

+    How is the information used once it is collected?

+    Is the information shared with third parties?

+    Does the user have the right to object to secondary uses of the information?

+    How long is the personal information stored?

+    Can users access the information that has been collected about them and correct any inaccurate data?

+    What is the complaint and redress process?

+    Is the web site subject to any federal laws and regulations?

+    Is the web site subject to any state privacy laws?

 

Because there are no uniform requirements for web sites with respect to privacy policies, it is up to Internet users to vigilantly protect their rights and limit disclosure of personally identifiable information to those web sites that fail to adequately inform users about how the information is used and shared.  There are several organizations, particularly TRUSTe and the Better Business Bureau Online, that provide certifications or seals to web sites who have satisfied program requirements and may be deemed "trustworthy" with respect to privacy practices.  While these programs cannot guarantee how personally identifiable information is used, these programs can help a user determine whether his or her personally identifiable information will be used in an ethical manner and in accordance with the web site's privacy policy.

-----------------------------------------------------

Further information:

 

TRUSTe:

http://www.truste.org

 

Better Business Bureau Online:

http://www.bbbonline.org

 

-----------------------------------------------------

Copyright 2002, American Library Association, Office for

Information Technology Policy

 

Disclaimer

 

This Online Privacy Tutorial is a service of the American Library Association. The content of this tutorial is primarily the work of Leslie Harris & Associates in Washington, DC. The views expressed in these messages are not necessarily the views of ALA or Leslie Harris & Associates. This tutorial is for information only and will not necessarily provide answers to concerns that arise in any particular situation. This service is not legal advice and does not include many of the technical details arising under certain laws. If you are seeking legal advice to address specific privacy issues, you should consult an attorney licensed to practice in your state.