How Not to Administer a Privacy Policy

I recently received an email from MarketWatch, a Dow Jones financial news and research service. The email was alerting me to a new privacy policy for the MarketWatch website:

Please note that the MarketWatch Privacy Policy has been updated. The revised policy will be effective 6/26/07. We've made some changes to the policy to ensure our practices are consistent with the way our site and services are evolving to better meet the needs of our users. To review the new privacy policy, please click here.

Clicking here leads to the website's privacy policy page, as I expected. What I didn't expect was the complete absence of any explanation as to what was changing from the previous policy. And, in fact, the previous policy was nowhere to be found – despite the fact that the new one isn't scheduled to become effective until June 26 – so that even if I wanted to try to compare the two statements, I couldn't.

Someone at MarketWatch really dropped the ball on this one. Privacy and data security issues are important enough that every company should go out of its way to describe in detail its policies, and to highlight changes in those policies. This would seem to be especially important for a financial services website, but it applies universally.

For what it's worth, the new policy is explicit in describing MarketWatch's use of cookies, web beacons, and third-party targeted ads. I haven't decided whether to continue my subscription to the site's services, but their lack of consideration for their visitors is not pushing me toward staying with them.

Comments

This beacon stuff sounds a lot like tracking visitors through a service like sitemeter.com, which has both free and fee features, and some public access. I'm sure there are contrasts, too.

I often enjoy looking at the sitemeter stats for the Ant; you get a lot of traffic from a lot of interesting places and organizations. I like the map feature of Sitemeter. As I write, the last 100 hits to the Ant include India, Peru, Italy, England and Canada, at least 22 states, several dot edu's, a couple dot gov's (NASA and Customs), and a dot mil out of Corpus Christi. Among the commerical enterprises among the last 100 hits while I was here was DowJones.com, perhaps reading this very article.

No matter where you go on the internet, there you are, and your Big Brother, too. Assume the whole world knows where you've been, where you came in from, and where you went when you left. Deletion of surfing history hides very little, as most of us know.

Perhaps inadvertently, most sites with visible sitemeters or hitcounters, invite people (including business enterprises, legit/benign or not) who have access to the hit counter, to acquire some limited information about who visits. This free data isn't packaged as nice as a dedicated service, and not as visitor-specific as the dedicated service, but nonetheless, readily available for the picking.

While not a commerical venture in a practical sense (how's that merchanise flying out the door?) the Ant is recognized/regarded as an influence at the least, by those who seek your public opinion, Eric, on books, movies, music, and certain products, and therefore your visitors are of interest to them.

Care to consider or comment on the Ant's "privacy policies?" Perhaps you would poll your 463 visitors a day (as Sitemeter disclosed) as to whether you should take your Sitemeter private, or buy the invisible sitemeter, so that the inquisitive visitor need not obtain information so freely? Even if you hide your counter now, I could still look up some information, and at least get the URL for the FireAnt sitemeter, from sites that archive the web. So unless you make it password protected, it's still practically public.

Posted by: Larry S. at June 18, 2007 02:18 PM

Larry, the biggest difference between what SiteMeter does and what MarketWatch is doing is that the tracking of the former involves no personally identifiable data. I can make an educated guess based on geographic location, ISP and, perhaps, computer OS as to the identity of a given visitor, but that's all it would be: a guess. And since the free version doesn't keep any data beyond the last 100 visits, there's no easy way to build a history.

Web beacons like MarketWatch employs for its subscription site can associate your browsing history and habits with your actual identity (assuming you told the truth when you created your account). Google's doing a similar thing whenever you log in to leave a comment on a Blogspot site or to check your Gmail account, and then forget to log out before doing a search.

From a practical and personal perspective, I don't worry about any of this stuff. I'd just like to see the web-based companies and services be a bit more transparent with their policies and not make their clients and visitors work so hard to figure them out, or understand their implications.

You do raise a good point about the Gazette's privacy policy. I've never created one since I don't collect any personally identifiable data, but I haven't considered whether I ought to say that outright or not.

It sounds like you've done a much more thorough analysis of my site stats than I've ever done. Perhaps I should have a statement to the effect that "Larry may be monitoring your visit to this site." ;-)

Posted by: Eric at June 18, 2007 02:37 PM
Post a comment [Take your time...we're in no hurry.]









Remember personal info?