Privacy Protection as Best Practice

Sydney Rubin is a privacy advocate with Ignition Strategic Communications, the public relations agency for the Online Privacy Alliance, a group of more than 80 global businesses and professional
organizations which has formed to help develop a system to safeguard privacy through self-regulatory policies and practices. She suggests that communicators consider privacy part of strategic
communications. "From [our] perspective, in every case, if you want to stay out of trouble by doing the right thing, then the right thing is to honestly and transparently inform people about what you are
doing, and where possible, give them the option of participating or not participating," Rubin says. "Respect for privacy is like respect for anything else ... it's impossible to show too much
respect."

Companies that use the Internet to either sell to or communicate with children have been taking the lead in privacy issues, in part because of legislative mandates. In 1998, the FTC implemented the
Children's Online Privacy Protection Act (COPPA), which requires commercial Web sites designed for children to obtain "verifiable parental consent" before collecting, using or disclosing personal
information from children under 13. But companies serious about success in this marketplace go much, much further.

"It's part of our business model to keep kids' information private," says Jessica Halem, marketing manager at The FreeZone Network, a Web site for children. "We don't use cookies. We collect as little
information as possible from the kids. We don't share that with anyone, period." Halem says many of the people hired by the company have child-related backgrounds, from child psychologists to camp
counselors to parents. They are required to undergo background checks, and then the company requires them to go through extensive training on privacy requirements.

Halem suggests that it is much easier to put privacy practices into place from the very beginning, before a Web site even exists, as part of corporate core values, than to impose it top-down
afterwards. "Don't think of privacy and safety policies last - think about how to bring them in from the beginning," she says. "How you can integrate it into internal communications, staff training and
hiring."

(Rubin, 202/244-1162; Halem, 312/705-3835; or information and guidelines at privacyalliance.org and iab.net/privacy/privacy_guidelines.html.)