Online Privacy Statements: Are they Worth Reading?

摘要

Internet users have become increasingly concerned about data collection and data handling practices of Web sites. This issue has been explored in academic studies, focusing on the nature of users' privacy concerns (Hoffman, Novak, & Peralta, 1999; Cranor, Reagle, & Ackerman, 1999; Sheehan & Hoy, 2000), their awareness of privacy issues (Dommeyer & Gross, 2003), their willingness to provide information (Phelps, Nowak, & Ferrell, 2000), and the determinants of consumer trust (Schoenbachler & Gordon, 2002). To ease users' fears about data misuse, privacy policies have become de rigueur among U.S. commercial Web sites over the past couple of years (Messmer, 1997; Federal Trade Commission, 1998; Culnan, 1999; Federal Trade Commission, 2000; Liu & Arnett, 2002). Culnan and Milne (2001) found that the majority of Internet users do not read online privacy policies, primarily because they are too long, difficult to understand, and "all the same", as one survey respondent put it. The Platform for Privacy Preferences (P3P) and its XML-based, machine-readable privacy specifications may be a good alternative to traditional privacy policies, but as of 2003 only 10% of Web sites have P3P-based privacy policies (Cranor, Byers, & Kormann, 2003). Reasons for its slow adoption include unresolved legal issues and the fact that companies find it hard to squeeze their complicated privacy policies into the more straightforward P3P scheme (Thibodeau, 2002). Thus, privacy policies still have to be read by humans rather than Web browsers, and so their quality is critical to users' trust in Web sites. The present study examines 50 privacy statements from commercial Web sites in greater detail than the previous studies (Liu & Arnett, 2002; Miyazaki & Fernandez, 2000; Johnson-Page & Thatcher, 2001), focusing not just on the issues they address but also on the specific practices companies have adopted to collect, use and share customer data. The objective of this study is to determine how accurately privacy statements communicate data-handling practices, to what extent these practices respect user privacy, and whether companies displaying privacy seals handle user data more responsibly than companies without such a seal.