Posts filed under 'In the News'
You may have seen the TRUSTe Privacy Seal on many of your favorite Web sites such as Apple, eBay, Facebook, Monster.com and The New York Times. This ubiquitous seal marks 2,400+ Web sites that are dedicated to protecting your privacy. On June 11, TRUSTe will commemorate its 10th anniversary by introducing a modernized version of its former logo, retaining the TRUSTe name and its familiar green and black colors.
TRUSTe’s Web Privacy Seal means that a Web site keeps its promises to protect your privacy, and allows you to have a choice about the use and sharing of your personal information.
Subjecting Web sites to tough standards and rigorous testing since 1997, TRUSTe has been:
1) Making sure that Web sites treat your identity and email address with respect and transparency. Any Web site with the TRUSTe seal will give you the right to access your information, delete your information, and give you a choice to keep it private. Not every Web site can meet TRUSTe’s tough standards. The privacy statement and TRUSTe approval can be validated by clicking on the seal or visiting the TRUSTe Web site.
2) Monitoring any changes to a sealholder’s Web site or promises. The TRUSTe seal on a Web site means that the site can be trusted to keep the promises it makes in its privacy statement. TRUSTe regularly monitors Web sites’ adherence to their privacy statements and has the power to enforce compliance with its program. In 2006, TRUSTe conducted 24 investigations of sealholders and revoked the seal in a number of those cases.
3) Resolving your individual privacy-related complaints. If you believe your privacy has been violated on a Web site displaying the TRUSTe seal, contact TRUSTe directly by registering a complaint on TRUSTe’s Watchdog complaint form at http://www.truste.org/watchdog. This is a unique service to help you guard and protect your individual personal information.
Look for the TRUSTe seal and ask your favorite Web sites to make sure they are protecting your privacy by joining TRUSTe.
For more information on TRUSTe and its new look, visit www.truste.org.
June 11th, 2007
A study conducted by researchers at Carnegie Mellon University Usable Privacy and Security Labs found that consumers choosing to purchase among retailers providing easily accessible privacy information, were willing to pay a premium on websites with more protective privacy practices. The search engine designed for the experiment offered a five-point scale that could match P3P machine-readable privacy statements to the test subject’s privacy preferences for using information. It has long been thought that internet shoppers considered privacy as an afterthought in their purchasing decisions. However, TRUSTe sealholders that have been testing the impact of privacy seals on transactions have known all along that making privacy accessible, reassuring and protective, can build trust and increase engagement. This study offers more evidence that good privacy = good business.
Read the full paper (.pdf)
June 7th, 2007
About ten years ago a bunch of folks from internet startups, and the EFF, and others, were cooking up the concept of a self-regulatory framework for internet privacy. After lots of starts and stops, and one grueling labor, the first standards for internet privacy statements and a list of TRUSTe Web Privacy Seal certified websites were birthed in 1997.
Today, we unveiled the first eight software applications certified to the Trusted Download standards. Ten years later Trusted Download has been a labour of love similar to our webseal. In some ways TRUSTe has taken learning from its previous programs to give TDP a running start, and in other areas the program is breaking new ground. The Anti-spyware Coalition provided the foundation for TDP, by hammering out definitions for spyware and nusiance programs in 2005 - these formed the prohibited behaviors in our certification agreements.
It has taken years for TRUSTe to build its privacy program requirements from mere disclosure, “say what you do,” into an aspirational set of standards that now include a prohibition on sharing of information without consent. For TDP we wanted to launch a program that began with the highest standards, instead of working up to them. We convened the internet‘s most influential companies - Yahoo, AOL, Microsoft, CA, CNET to ensure that no one entity or viewpoint influenced the standards too greatly. Although they aren’t program sponsors, the program requirements include provisions that Google and others contributed to the process. And we included important players such as the Center for Democracy and Technology from the beginning and in the ongoing advisory committee to the program.
If the launch of the web seal program and its subsequent development is any indicator, we are in for serious growing pains. We’re anticipating a learning process. Self-regulation is an ecosystem, and an essential part of the range of solutions that help make the internet a more trusted place. We welcome constructive feedback on the program, with the understanding that this is just the beginnng of changing the market.
Fran Maier, Executive Director
February 15th, 2007
TRUSTe just completed a survey of consumers on security breach notice and we’ll soon be releasing some data on how residents of states with breach notice requirements fared versus residents of states without breach notice requirements. Lucky for California’s stats we conducted the survey prior to the UCLA data breach. I received my first breach notice yesterday, not from my bank or credit card company, I had applied to a UCLA program in 1997.
I’ve been reading through Kim Cameron’s whitepapers on digital identity, namely the 7 Laws of Identity which I think sums up nicely what was broken at UCLA, “We should build systems that employ identifying information on the basis that a breach is always possible. Such a breach represents a risk. To mitigate risk, it is best to acquire information only on a “need to know” basis, and to retain it only on a “need to retain” basis. By following these practices, we can ensure the least possible damage in the event of a breach.”
December 15th, 2006
Today’s AP story, Privacy Options limited for Net services, highlights TRUSTe as an advocate for consumer choice, and mentions one exemplary sealholder, E-LOAN as offering exceptional choice when it comes to personal privacy. TRUSTe has reviewed tens of thousands of privacy policies, and E-LOAN’s is simply one of the best. One reason why they won our award for being a Most Trusted Company for Privacy this year.
Transparency, ensures that consumers are informed of the bargain. Accurate disclosure of practices also empowers consumers to encourage service providers to change thier practices. Facebook, another TRUSTe sealholder, is an excellent example of the importance of good disclosure and responsiveness to privacy issues. They handled customer concerns quickly and responsively - that’s also building trust.
- Posted by Carolyn Hodge
October 13th, 2006
If there was any confusion about what TRUSTe meant when we said we look at different things than SiteAdvisor, things got a tad clearer today when they announced they “don’t do phishing.”
This is only significant because in the previous post on this blog TRUSTe defends itself in a side-by-side comparison with SiteAdvisor, conducted by Ben Edelman, an expert reviewer and advisory board member to Site Advisor.
To repeat our previous posting, “TRUSTe views Site Advisor as a potentially useful monitoring tool, but not an accreditation program or an authority on privacy. Both approaches have strengths and shortcomings.”
Apples to oranges comparisons only become problematic when you come out on the losing end.
September 28th, 2006
In a recent study, the efficacy of our program and our standards has been called into question. TRUSTe disagrees with the study and its conclusion that TRUSTe certified websites are less trustworthy than non-certified web sites. TRUSTe requires its sealholders to adhere to a strict set of standards for consumer privacy based on informed choice for the use of personal information. Our processes are rigorous – on average 12% of applicants do not earn certification, and 100% of certified websites need to make changes to their policies, practices or websites prior to receiving certification. Notable companies with TRUSTe certification include Apple, Avis, Disney, eLOAN, Nationwide, NFL, and Pfizer. Consumers can be confident that TRUSTe certified sites comply with the disclosed privacy policy and offers them informed notice and choice.
The study does not present a full or accurate review of TRUSTe’s program requirements, monitoring processes and enforcement tools. The TRUSTe Web Seal Program Requirements represent a leading edge of privacy practices requiring disclosure of the uses of personal data, informed choice (as well as specifics for third-party sharing), and commitment to the Watchdog Dispute Resolution program. TRUSTe uses a number of tools, from user complaints to email seeding, to ensure continued compliance with our standards for informed notice and choice. Consumer generated Watchdog complaints have resulted in severe sanctions against licensees, including TRUSTe’s public termination of Gratis Internet - a company that the New York Attorney General has sued subsequent to TRUSTe’s actions.
In addition to several inaccuracies and misstatements, the study’s conclusions are based on an underlying set of assumptions, without exposition the methodology, definitions, and approach giving rise to such assumptions. TRUSTe views Site Advisor as a potentially useful monitoring tool, but not an accreditation program or an authority on privacy. Both approaches have strengths and shortcomings. As an accreditation program TRUSTe will err on the side of rating companies as trustworthy, conversely SiteAdvisor has been shown in some cases to err on the side of untrustworthy.
As for the four sites called out on Mr. Edelman’s blog, Direct-Revenue and MaxMoolah (and all WinHundred related companies) are no longer in the TRUSTe program. FunWebProducts, was, by an error in our database listed on our customer list, but it has never been certified, and has never displayed any seals or reference to TRUSTe to consumers. The fourth, Webhancer is certified by TRUSTe and will be required to submit its software for certification to Trusted Download program which is launching imminently. The Trusted Download program was designed specifically to address notice and choice and control issues with software that go beyond our website requirements. Like the Website Privacy Seal program, it will offer companies incentives to provide notice and choice while prohibiting intrusive behaviors.
We welcome this opportunity for regulators and others to closely review certification programs and for consumers to pay closer attention to seal and ratings programs and their requirements. We invite the public to closely look at the rigorous requirements of the TRUSTe web seal program, email privacy seal program, as well as our recently announced Trusted Download Program.
September 25th, 2006
Great article about everyday privacy on Reuters Today called “Product Returns: Consumers balk at giving personal info”
I recently tried to exchange sizes on a cash purchase at the Children’s Place here in San Francisco. Upon the exchange I was walked through a series of questions requiring my name, address, telephone number, etc. All of which I refused, requiring store manager intervention.
There are two issues arising in these situations:
1) Retailers do not provide adequate notice and information about any type of personal data collection at the point of sale. Combined with woefully undertrained and unknowledgeable store clerks, who give misinformed or inadequate answers — how can you blame customer unease at handing over personal information? I can guess more accurately why my personal data is being collected than the store clerk who may or may not have been instructed to respond.
2) At least in cases where your infomation is collected for marketing purposes consumers can see potential value in coupons or special offers. In this case you are asking law-abiding individuals to potentially expose thier personal information to a data breach because retailers have a 9% fraudulent returns problem.
So it doesn’t surprise me at all that individuals lie about thier information when asked, or that they balk at giving thier driver’s licenses to retailers. I encourage consumers to speak up about non-essential data collection, and demand reasonable disclosure about why and how the information is being used.
August 3rd, 2006
While privacy and piracy have been in the news quite a bit in the past few months as separate ideas, David Holtzman’s Viewpoint in Business Week Online - July 24, 2006, took the interesting step of combining them. Recent debate about privacy has been engulfed by repeated high profile breaches and the subsequent focus on data protection and security. Mr. Holtzman moves the discussion about privacy back to where it belongs – the value of personal data and how it is used.
The focus on “ownership” however, may be a red herring.
The concept of ownership bundles rights that a person can 1) assert around a thing, and 2) can restrict anyone else from asserting around such thing. This works well with physical objects (film, cars, CDs, etc.) but becomes more problematic when addressing data about such things. A person actually does not own personally identifiable data in many instances. For example, I don’t “own” my bank account number. While this may be counterintuitive, I cannot restrict my bank from changing or even reusing my account number. Because the bank has more rights over who can and how that number can be used, I can’t be said to “own” that number. Much personally identifiable data is subject to this quandary – the data is about me, but I don’t “own” it.
Control versus Ownership
This difficulty with “ownership” exposes Holztman’s red herring. Most of us aren’t as concerned with the technicality of ownership of our data, as much as asserting control over our data. Jim Harper of the Cato Institute articulates the definition of privacy like this:
“Privacy is the condition that people enjoy when they are given the opportunity to control information about themselves, and they exercise that control in a manner consistent with their interests and values.”
A privacy policy is supposed to do exactly that — to allow you to exercise of control over data about yourself. Without mentioning “ownership” this definition works well with how consumers interact with their data in the marketplace.
TRUSTe’s program requirements around what must go into a privacy policy expressly require this option of control. According to TRUSTe, a consumer must be given the option of limiting use beyond the transaction for which data was collected, and a company may not eliminate this requirement through privacy policy disclosures. (There is an exception for complying with legal disclosure requests from the government, as recently seen with the nation’s telecommunications firms.)
Further, where a website collects personally identifiable data from a third party, as in a gift delivery, the consumer must affirmatively opt-in to any other use by the same company that isn’t for the primary purpose of the collection. This means that if a friend sends you flowers, that flower shop shop is not able to send you offers for additional services unless you opt-in. . These requirements give control to the consumer regardless of who “owns” the data. A company, at least one certified by TRUSTe, can hardly do what ever it wants with data about an individual.
Mr. Holtzman and I do not greatly disagree. He offered our shared viewpoint with the statement:
“As consumers, we should be entitled to only give out our information when we want, and maintain some control over its subsequent disposition, including mandatory erasure when our business relationship is terminated.”
TRUSTe requirements, and all the regulatory environments which address personally identifiable data (e.g. Gramm-Leach-Bliley Act, HIPAA, Fair Credit Reporting Act, etc.) are in alignment with this concept of control versus ownership. Compliant policies restrict how personally identifiable data about an individual is used and disclosed regardless of who “owns” the data.
Commerce versus Stealing
Which brings us to the second privacy issue raised by Mr. Holtzman – the value of data. Mr. Holtzman makes a fascinating assertion that a privacy statement is a “…license to steal consumer information, wrapped up in legal tinsel.”
First, stealing is taking from a person, without their consent, something they “own” (which may or may not be the case with personally identifiable information.). Consequently, there are two elements in play here: 1) ownership of the data in question, and 2) lack of consent. If a person gives you something, that isn’t stealing. Further, if a person gives you something in exchange for something else, not only is that not stealing, that is called commerce.
So, putting aside the first threshold issue of “ownership,” let’s discuss the second issue of “bargained-for exchange,” which seems to be at the root of Mr. Holtzman’s complaint – “why can’t I get paid for data about me?”
A consumer interacts with a company (which would be the reason for a privacy policy to even apply) when the individual perceives a value to the interaction. Perceived value could come from information the individual receives from the company, or from the services that the company offers. I pay my bills at CheckFree because I perceive value when I don’t have to pay 37 cents to mail my bill. Further, when CheckFree personalizes communication with me, I perceive value in knowing I am not getting phished or spammed. So, for the disclosure of my information, I receive value in reducing my cost of paying bills, increased security in communication from Checkfree, and increased convenience of paying bils online.). All this for a service I don’t have to pay for. That looks a lot like bargained for exchange.
Regardless of “ownership”, the individual’s engagement with the business provides at least perceived, if not actual, benefit for the consumer. This is not stealing.
Now, a larger question lies in what kinds of companies actually do follow TRUSTe or GLB-like requirements? And additionally, is the benefit given to consumers actually realized to the level that the consumer wants? I think these are excellent questions and should be fully explored. However, these questions do not really lend themselves to the sensationalization that sells newspapers.
Regardless of how sexy the topic may not be, it is fundamentally the first principle of the privacy debate – can individuals control information about themselves in a way that is consistent with their interests and values; or is commerce placing a lower value on the bargained for exchange than the consumer might? This is a question of market motivations and consumer values. However, before any of this can happen in a meaningful way, commerce must adopt the business models that provide informed choice to the individual. TRUSTe is one way the marketplace does this.
July 26th, 2006
Much ado has been made about businesses “owning” information. Information is difficult to “own”. Ownership is defined as the exclusive right of possession, enjoyment, and disposal of a thing. In today’s society multiple parties (businesses, consumers, governmental bodies, etc.) assert rights to information. And yet, all of those parties have a right to possess such information. While companies have a fundamental “ownership” right to their business records, TRUSTe contends that the question isn’t really about ownership. Fundamentally the issue is control. Consumers should have rights to say in how those records are used via informed consent.
This issue of data ownership has existed for many years, but has only recently come into the media spotlight when AT&T updated their privacy policy to clearly state their “ownership” of customer data. TRUSTe feels that clear notice of data use practices are the lynchpin of trust in an online world. Just as AT&T has done in their privacy statement, TRUSTe promotes informed choice about personal information and encourages the explicit disclosure of information collection and uses. The AT&T policy change is a positive step in the right direction as they have elevated the debate. Now we all know what has been occurring for the past few years.
Businesses (like AT&T) may have a fundamental “ownership” rights to data. However companies, have obligations to the subject of the information regardless of whether or not they own the information. For example, consumer protection statutes do not protect the data itself, they protect the consumer – the subject of the data. The “owner” is still responsible for how their use and misuse of information will affect the customer.
Businesses who “own” data should finally consider consumer choice – what choices do consumers have regarding what companies do business with. Based on the data use and sharing practices of the company. As mentioned above, TRUSTe promotes transparency and informed choice. Therefore, TRUSTe encourages businesses to let consumers exercise their right to have a say in how those records are used via informed consent arising from all the state and federal consumer protection statutes.
While companies have a fundamental “ownership” right in their business records, it is important to remember that consumers have rights to say in how those records are used via informed consent. The AT&T policy change is a positive one – being transparent is a good thing for all parties
July 5th, 2006
Previous Posts
