Do privacy seals in e-commerce really work?

While e-commerce has not changed the basic nature of the commercial transaction, a trust gap has developed in business-to-consumer (B2C) e-commerce transactions. This trust gap centers primarily on the privacy of personally identifiable information, such as name, address, and so forth, that is an essential element of B2C transactions. A Forrester research survey suggests that while US business-to-consumer (B2C) e-commerce sales are likely to exceed $100 billion by 2002, sales were reduced by some $3 billion because of privacy concerns. Web users typically express concern over the safety of giving credit card numbers over the Web, the likelihood that Web sites will sell their personal details, and the legitimacy of Web sites [2]. Such concerns are justified. In May 2000, the Federal Bureau of Investigation (FBI) and U.S. Department of Justice’s National White Collar Crime Center (NW3C) established the Internet Fraud Complaint Center (IFCC) (www.ifccfbi.gov/default.asp). By November 2000, the IFCC had received over 19,000 complaints, an average of 750 a week. Most complaints centered on online auctions (49%), but also included the non-delivery of goods (19%), securities fraud (17%), credit card fraud (5%), and identity fraud (3%). With legislation looming, the e-commerce industry in the U.S. has set about a self-regulation policy that centers on the use of privacy (or Web assurance) seals. The seal is meant to instill trust in the online consumer by verifying that the Web site has a policy about its collection and use of personally identifiable information. The attempt mirrors the success of the Good Housekeeping Seal of Approval, established in 1909, which stands behind its recommendations to the point of replacing or refunding the purchase price for any item that has been awarded its seal that proves to be defective within the first two years of purchase. But will it work for e-commerce? The good news is that the three main privacy seals (TRUSTe, WebTrust, and BBBOnline) have adopted a sensible set of data privacy principles and strive to ensure compliance by recipient Web sites. The bad news is that serious abuses continue, while almost half of Web sites have no privacy statement at all. The argument to be made here is that legislation is required to ensure that the good sense outlined by the