From the May 1999 issue of Entrepreneur

BrainPlay.com takes privacy seriously. An online retailer of educational toys and software based in Denver, the company has had a privacy statement on its Web site since its launch two years ago. While the company says protecting the privacy of Internet customers is a courtesy, privacy has become the subject of a heated legal debate among consumer protection groups, business associations, government agencies and the Clinton administration. Because the Internet gives companies the capability to gather enormous amounts of information about their customers, the worldwide computer network is both a marketer's dream and a privacy advocate's nightmare.

For BrainPlay.com, the issue is simple: Protecting privacy improves its company image and instills trust in its customers. "More people are paying attention to privacy issues," says Srikant Srinivasan, BrainPlay.com's founder and CEO. "Consumers today want to know -- and have the right to know -- about the companies they're dealing with and how their personal information is being used. The good companies are letting them know."

BrainPlay.com's privacy statement is comprehensive. It says the company doesn't sell names, e-mail addresses or other personal information about its customers to third parties. Customers who sign up for BrainPlay.com's monthly e-mail newsletter, which includes information about special offers, can remove their names from the mailing list at any time. The privacy statement also notes that while the company collects information about how visitors use the site, personal information is used only to update customers on a product's shipping status or to verify shipment receipts.

"Customers want to [know] we aren't doing anything with the information they're giving us," says Doug Smooke, BrainPlay.com's marketing services manager. "We've always tried to be as upfront as possible with our customers about our policies."


Melissa Campanelli is a technology writer in Brooklyn, New York, who has covered technology for Mobile Computing & Communications and Sales & Marketing Management magazines. You can reach her at mcampanelli@earthlink.net

Privacy Catches On

Today, many companies doing business on the Web post some sort of privacy policy on their site. While most companies gather and track at least some customer information for marketing reasons, only a portion of those collect personal information that can be traced to an individual consumer.

Information can be collected in a few ways: directly, when a customer provides information voluntarily, such as by registering at a site or signing a guest book; or indirectly, through a browser and its "cookie" file. (Cookies are computerized mechanisms that allow Web sites to identify individual Web browsers.)

Consistent with its privacy policy, BrainPlay.com doesn't collect cookies. "We make sure we let our customers know we're not tracking their computers," says Smooke. "But there may be a point in time when we start doing it." If BrainPlay.com were to use cookies, it would tell its Web customers. "If you're going to track cookies on your site, then you have to say that," Smooke says. "You need to tell the user what you're doing."

Online Seal Programs

Another way to build consumer confidence regarding privacy is to join an online seal program. These programs are much like a Better Business Bureau for the Web. If a company adheres to certain privacy principles, it's allowed to display a special seal of approval on its Web site.

In general, seal programs are de-sighted to build users' trust in the Internet and to promote principles of fair information practices. They indicate to Web users that a company is using the information it collects in a responsible way.

Two leading privacy-seal programs are TRUSTe (Trusted Universal Standards in Electronic Transactions), based in Palo Alto, California, and BBBOnLine, a subsidiary of the Council of Better Business Bureaus (BBB) in Arlington, Virginia. To include either of these programs' privacy seals on its Web site, a company must agree to post a privacy statement that can be easily accessed and understood; it must also implement privacy principles that: reflect fair information practices.

The TRUSTe seal is awarded only to Web sites that adhere to TRUSTe's established privacy principles and comply with TRUSTe's verification and consumer resolution processes. TRUSTe's privacy principles say that companies must: inform customers what personally identifiable information is collected, how it is used and with whom the information wilt be shared, as well as what the site's policy is on correcting and updating personal information. These principles embody fair information practices approved by the U.S. Department of Commerce, the Federal Trade Commission (FTC) and such prominent industry associations as the Online Privacy Alliance.

When you see our trustmark, you can be assured, among other things, that: the Web site will tell you exactly what personal information is being gathered about you and how it will be used," says TRUSTe's Anne Jennings. "Many companies that join see TRUSTe as a way to build trust with their consumer base."

TRUSTe's program isn't free. An annual license fee costs $299 for a company with less than $1 million in annual revenue and increases as a company's annual revenue increases. Once an application is received, TRUSTe reviews the Web site and its privacy statement, responds with comments and then, if all goes well, approves it. TRUSTe then e-mails a seal in an electronic file, with instructions on how to link the seal to TRUSTe's online privacy statement. For more information, check out TRUSTe's Web site at http://www.truste.org

The BBBOnLine program is also designed to give consumers the confidence that their personal information will be safeguarded in cyberspace by the companies that participate in the program; its requirements are similar to TRUSTe's. BBBOnLine's seal is backed by the Better Business Bureau; to participate, a company can't have an unsatisfactory record with the BBB. All applicants pay a one time $75 fee. Annual fees vary according to each company's annual revenue. For more information, visit: http://www.bbbonline.org

BrainPlay.com is a member of both seal programs. "The programs helped us formalize our privacy statement, and gave us a little more credibility," says Smooke. The Better Business Bureau and TRUSTe are recognized names. Customers can click on these logos and know we're not just a fly-by-night organization. That makes a customer more comfortable shopping with us."

Safety First

If you don't want to join a seal program, it's still a good idea to have a policy statement on your site and to adhere to the commonly followed, industry -- accepted practices laid out by the FTC. (See "All's Fair") It's also important to remember that once a privacy policy is posted on a Web site, it must be adhered to, or you risk getting into legal trouble.

The Direct Marketing Association (DMA), a trade group that sees the possibility of government privacy regulation as a major threat, has an online guide to developing a privacy policy statement. The guide, found at http://www.the-dma.org/topframe/index7.html , encourages companies to complete a questionnaire and create a privacy policy statement consistent with the association's Privacy Principles for Online Marketing, which are similar to the seal programs' principles mentioned previously. In addition, the DMA is working with the FTC on a project to present research on how many Web sites are publishing privacy policies in accordance with the FTC's standards. TRUSTe also offers a free Privacy Statement Wizard at http://www.truste.org/wizard

Although Internet privacy has become a major issue in Washington, few businesses want to see more regulation of Internet commerce. To avoid the possibility of future regulation, Web marketers and retailers should voluntarily develop their own initiatives to protect consumer privacy Respecting the privacy of Web users not only helps forestall more regulation but also makes good business sense in building a bond of trust with your online customers.

Next Step

In addition to the organizations listed in this column, the following are some useful Internet privacy sources for small companies:

Contact Sources

BBBOnLine, bbbprivacy@cbbb.bbb.org

BrainPlay.com, (303) 226-6206, doug@brainplay.com

Direct Marketing Association, (202) 955-5030

Federal Trade Commission, (202) 326-2222