Shoppers who have flocked to online stores for their holiday shopping are losing privacy with every mouse click, according to a new report.

The study by the Washington-based Electronic Privacy Information Center scrutinized privacy policies on 100 of the most popular online shopping sites and compared those policies with a set of basic privacy principles that have come to be known as "fair information practices."

The group found that none of the 100 sites met all of the basic criteria for privacy protection, which include giving notice of what information is collected and how it is used, offering consumers a choice over whether the information will be used in certain ways, allowing access to data that give consumers a chance to see and correct the information collected, and instituting the kind of security measures that ensure that the information won't fall into the wrong hands.

"This study shows that somebody else, other than Santa, is reading your Christmas list," said Jeff Chester, executive director of the Center for Media Education, which also worked on the survey.

The online privacy of children is protected by Federal Trade Commission rules, but adults do not share the same degree of privacy protection. The Clinton administration, like the online shopping industry, favors self-regulation over imposition of further government restrictions on electronic commerce.

Marc Rotenberg, executive director of the privacy group, said the study shows that self-regulations has failed. "We need legislation to enforce fair information practices," he said. "Consumers are at greater risk than they were in 1997," when the group released its first report.

The survey also asked whether the 100 sites used "profile-based" advertising, and whether the sites incorporate "cookies" technology, which gives Web sites basic information on visitors. Profiling is the practice of gathering information about consumers' interests by tracking their movements online. The information is then used to create targeted advertising on Web sites.

All but 18 of the top shopping sites did display a privacy policy--a major improvement over the early days of electronic commerce, when such policies were scarce. But that did not satisfy the privacy group: "Companies are posting privacy policies, but these policies are not the same thing as fair information practices," Rotenberg said.

The sites also did not perform well by other measures, the group said. It found that 35 of the sites feature profile-based advertising, and 87 percent use cookies. The group concluded that the policies that were posted "are typically confusing, incomplete, and inconsistent."

The report, "Surfer Beware III: Privacy Policies Without Privacy Protection," is the third such survey by the group. The privacy consulting group Junkbusters also assisted on the study.

The report called for further development of technologies that help consumers protect their privacy and even anonymity when exploring the Internet.

A representative of the FTC, the federal government's lead agency in online privacy, disagreed, saying it is continuing to monitor the online market for progress or backsliding.

"You can have the convenience of electronic commerce and the control over your personal information," said David Medine, the FTC's associate director for financial practices. "That doesn't have to be a trade-off."

Noting how high consumers consistently rank privacy among their concerns about the online world, Medine said that privacy policy presents a market opportunity for online retailers: "We'll start seeing some competition for who has the best privacy policy," he predicted.

The FTC will conduct a major privacy study next spring, he said.