28 March 2002

Web Survey Finds Decline in Collection of Private Information

Results considered an improvement in privacy policies

Operators of sites on the World Wide Web are showing more respect for the privacy of online visitors, according to a survey released March 27 by the Progress and Freedom Foundation (PFF), a private Washington-based research organization.

"By every relevant measure, the extent of online information collection has declined since May 2000," according to the report, the fourth survey of privacy practices compiled by PFF since 1998.

The study also finds a decline in the use of third-party cookies to track visitors' movements as they move to other sites online. (A cookie is a mechanism that allows a site operator to collect and store information on users).

Sites are giving more prominent placement to the statement of their privacy policies, and those statements have become more complete, according to the PFF survey. Consumers are also being offered more choices on directing site operators in the use of their Personal Identifying Information.

"The privacy practices and policies of commercial Web sites are continuing to evolve, and, by at least some criteria to improve," the PFF report says.

The full report is available in PDF format at http://www.pff.org/publications/privacyonlinefinalael.pdf

Permission has been obtained from the Progress and Freedom Foundation for use by the Office of International Information.

Following is the executive summary of the PFF report

The Progress and Freedom Foundation

March, 2002

Executive Summary

This study is the fourth in a series of surveys of the privacy practices of commercial sites on the Internet, dating back to 1998. It is designed to be directly comparable to the results from the most recent FTC survey of Web sites, published in May 2000. The report also takes note of some of the major market-driven developments affecting the collection and use of personal information in the online environment.

PFF engaged Ernst & Young to perform the survey, which was carried out in December, 2001. The surfers surveyed three groups of domains¹, all selected based on estimates of traffic over sites provided by Nielsen//NetRatings: 1) the 85 busiest sites (the "Most Popular Group"), 2) a random sample of all of the sites with more than 39,000 unique visits (the "Random Sample"), and 3) a subset of the random sample restricted to the top 5,625 sites (the "Refined Random Sample").

The survey revealed a continuing evolution in the privacy practices and policies of commercial Web sites. Among the most interesting findings:

Web sites are collecting less information. Perhaps the most unexpected finding was that commercial Web sites are collecting less information than they were two years ago. Among the most popular domains, for example, the proportion collecting Personally Identifying Information ("PII") other than email fell from 96 percent to 84 percent; it fell from 87 percent to 74 percent for sites in the Random Sample. By every relevant measure, the extent of online information collection has declined since May 2000.

Fewer Web sites utilize third-party cookies. Another form of information collection, the use of third-party cookies to track surfing behavior across multiple Web sites, is also down significantly. The proportion of Web sites that utilize third-party cookies fell from 78 percent to 48 percent for the most popular group and from 57 percent to 25 percent for the Random Sample.

Privacy notices are more prevalent, more prominent and more complete. Practically all of the most popular domains and 83 percent of the Random Sample sites provide some privacy disclosure, little changed from 2000. However, substantially more of the random sample domains provide a privacy policy comprehensively stating how they handle consumer information. Overall, privacy notices tended to provide more information and were more likely to be accessible from a site's home page.

In general, consumers have more opportunities to choose how PII is used. For example, the percentage of the most popular sites that offer choice over sharing consumer information with third parties -- a key consumer concern -- jumped from 77 percent to 93 percent. By contrast, there was little change in the availability of choice for internal use of PII (i.e. use by the Web site operator to send further communications), though such choice continues to be offered by 71 percent of sites in the random sample and 89 percent of sites in the most popular group.

More sites offer opt-in; fewer offer opt-out. For choice over third-party use, opt-in more than doubled from 15 percent to 32 percent among the most popular domains, while opt-out fell from 49 percent to 30 percent. In the Random Sample opt-in increased from 11 percent to 18 percent, while opt-out declined from 59 percent to 53 percent.

More sites offer a combination of fair information practice elements. The proportion of Web sites that provide a combination of notice, modified choice and security has increased both among the random Sample and the Most Popular domains. Most striking is the fact that 80 percent of the most popular domains now provide all three elements, up from 63 percent in the 2000 survey.

P3P adoption is off to a rapid start, but adoption of seal programs is growing relatively lowly. Although P3P enabled browsers were only available in late summer, and the adoption of the standard is not yet final, one-quarter of the most popular domains and five percent of the random sample domains have already implemented this technology. Privacy seal programs, on the other hand, do not appear to be making major strides: the proportion of random-sample sites displaying seals increased from eight percent to 12 percent, while the proportion in the most popular group was essentially unchanged.

What these results suggest, simply put, is that the privacy practices and policies of commercial Web sites are continuing to evolve, and, by at least some criteria, to improve. And, notably, some of the most significant changes are in the areas, that have been identified as raising the greatest concerns for consumers-such as placement of third-party cookies and third party sharing of information.

¹ Like the FTC's 2000 Survey, the units of analysis for our study are Internet domains - i.e. discrete Web locations identified by unique domain names. Terms like "Web site" or "online retailer" are sometimes used interchangeably.