The Georgetown Internet Privacy Policy Survey is a progress report to the Federal Trade Commission on the extent to which commercial Web sites have posted privacy disclosures based on fair information practices. The study was initiated by the private sector and was funded by small contributions from seventeen different companies and organizations.

Media Metrix provided the data for the study. The sample consisted of 361 dot com Web sites visited by consumers at home drawn from a sampling frame of the top 7500 URL's ranked by audience during January 1999. The unduplicated reach of the sampling frame is 98.8%. Data were collected by 15 graduate student "surfers" during the week of March 8-12, 1999. The surfers completed a survey form for the URL's in the sampling pool until the target of 300 Web sites had been reached. Because the sampling frames for the 1998 FTC study and the current Georgetown study were drawn from different populations, extreme care must be exercised in making direct comparisons between the results of the two studies.

The study results address three questions:

1. What personal information do Web sites collect from consumers? 92.8% of the sites in the sample collected at least one type of personal identifying information (e.g. name, e-mail address, postal address). 56.8% collected at least one type of demographic information (e.g. gender, preferences, Zip code). 56.2% of the sites collected both personal identifying and demographic information. 6.6% of the sites collected neither type of personal information.

2. How many Web sites posted privacy disclosures? 65.9% (238) of the 361 sites in the sample have posted at least one type of privacy disclosure (a privacy policy notice or an information practice statement). 36% (131 sites) posted both types of disclosures. 34.1% (123 sites) did not post either type of privacy disclosure.

3. Do these disclosures reflect fair information practices? The content of all privacy disclosures were analyzed for four elements of fair information (notice, choice, access and security) and whether or not they posted contact information to ask questions or to complain about privacy. Of the 236 Web sites that collected personal information and posted a privacy disclosure, 89.8% included at least one survey item for notice, 61.9% contained at least one survey item for choice, 40.3% contained at least one survey item for access, 45.8% contained at least one survey item for security, and 48.7% contained at least one survey item for contact information. 13.6% (n=32) of the same 236 Web sites (or 9.5% of the 337 Web sites that collect at least one type of personal information) contained at least one survey item for all five elements of fair information practices: notice, choice, access, security and contact information.

Full Report (PDF)

More Et Al.