FTC Curbs Web Sites' Data Use
By Robert O'Harrow Jr.
Federal regulators have forced a popular site on the Internet to stop releasing computer users' names, occupations and other personal details to advertisers without notification, a move hailed by privacy specialists yesterday as a milestone in consumer protection.
The Federal Trade Commission's action against GeoCities, one of the busiest sites on the World Wide Web, is the first time a federal agency has sought to enforce laws against deception or the misuse of personally identifiable information on the global computer network.
Privacy specialists said it sends a strong signal that businesses on the sprawling new medium will be held accountable for misleading consumers who use it.
"It's powerful because this action identifies a specific federal agency that is willing to fight on behalf of consumers on information privacy issues," said Jerry Kang, a law professor and Internet expert at the University of California at Los Angeles. "It's a very important step."
FTC officials said GeoCities a hot Internet stock that first sold shares to the public only three days ago should serve as an example of inappropriate behavior online. They promised to follow through on other cases when they arise.
"GeoCities misled its customers, both children and adults, by not telling the truth about how it was using their personal information," said Jodie Bernstein, director of the FTC's consumer protection bureau. "This case is a message to all Internet marketers that statements about their information-collection practices must be accurate and complete."
GeoCities stock fell $7, or 15 percent, to $38.50 yesterday. The company went public Tuesday at $17 a share, soaring 119 percent that day to close at $37.31¼.
The announcement comes as the White House, Congress and industry leaders continue to wrangle over how to ensure consumer privacy. An industry group calling itself the Online Privacy Alliance is moving ahead with a self-regulation program, saying that new laws could snuff out the potential of Internet commerce. White House officials have tentatively endorsed the approach but warned that the initiative must have teeth.
Christine A. Varney, a former White House official who is helping to organize the industry's self-regulation program, applauded the FTC effort. She said government enforcement of existing laws will be critical to ensuring online privacy.
"It is a big deal," she said. "A critical piece of self-regulation is enforcement of existing law."
At issue are the methods that thousands of Web sites use to collect personal information from millions of computer users, many of them technological neophytes. Sites often ask people, including young children, to register to gain access to special articles, chat sites and other features. That information is stored electronically and is often shared with other Web sites or used for marketing.
But privacy specialists and officials at the FTC said few Web sites tell visitors how they use information or give them an opportunity to remove it later. An FTC study released in June found that only about 14 percent of the Web sites in the survey posted notice of their information practices. The agency called on Congress to pass a law restricting the collection of information from children under 13 without parental approval.
In the case of GeoCities, the FTC said the site had created a database with names, addresses, incomes, marital status, occupations and other details. The Santa Monica, Calif., company, which has more than 2 million members, then gave the data to target marketers, the agency said.
The Web site also had a special place for children, the "Enchanted Forest" neighborhood, that required youngsters to provide information about themselves, the agency said.
Officials from GeoCities denied doing anything inappropriate. Still, chief executive Thomas Evans conceded the company did not fully disclose how it used personal information, and he acknowledged the site had collected data about young children.
But in the face of FTC scrutiny, he said those practices have been changed. "We've gone to the highest level of compliance [with privacy practices] for several months," he said.
"Everybody's trying to do the right thing," said Ronald Plesser, the attorney for GeoCities in talks with the FTC. "We view this as a step forward."
Under the FTC terms, GeoCities has agreed to post a privacy notice at its Web site that tells computer users what kinds of information it collects and how that information is used. It also agreed not to gather information from children under 13 without parental approval. The FTC frequently does not impose fines if a company promises to change its behavior.
Deirdre Mulligan, staff counsel for the Center for Democracy and Technology, said the agreement is a major step toward privacy on the Internet.
"There's a cop on the beat," she said. "This is the first real statement the FTC not only has the power, but they're going to use it."
© Copyright 1998 The Washington Post Company