The Georgetown Internet Privacy Policy Survey is a progress report to 
       the Federal Trade Commission on the extent to which commercial Web 
       sites have posted privacy disclosures based on fair information 
       practices. The study was initiated by the private sector and was funded 
       by small contributions from seventeen different companies and 
       organizations. 

       Media Metrix provided the data for the study. The sample consisted of 
       361 .com Web sites visited by consumers at home drawn from a 
       sampling frame of the top 7500 URL's ranked by audience during 
       January 1999. The unduplicated reach of the sampling frame is 98.8%. 
       Data were collected by 15 graduate student "surfers" during the week of 
       March 8-12, 1999. The surfers completed a survey form for the URL's 
       in the sampling pool until the target of 300 Web sites had been reached. 
       Because the sampling frames for the 1998 FTC study and the current 
       Georgetown study were drawn from different populations, extreme care 
       must be exercised in making direct comparisons between the results of 
       the two studies. 

       The study results address three questions: 

       1. What personal information do Web sites collect from consumers' 
       92.8% of the sites in the sample collected at least one type of personal 
       identifying information (e.g. name, e-mail address, postal address). 
       56.8% collected at least one type of demographic information (e.g. 
       gender, preferences, Zip code). 56.2% of the sites collected both 
       personal identifying and demographic information. 6.6% of the sites 
       collected neither type of personal information. 

       2. How many Web sites posted privacy disclosures' 65.9% (238) of the 
       361 sites in the sample have posted at least one type of privacy 
       disclosure (a privacy policy notice or an information practice statement). 
       36% (131 sites) posted both types of disclosures. 34.1% (123 sites) did 
       not post either type of privacy disclosure. 

       3. Do these disclosures reflect fair information practices' The content 
       of all privacy disclosures were analyzed for four elements of fair 
       information (notice, choice, access and security) and whether or not 
       they posted contact information to ask questions or to complain about 
       privacy. Of the 236 Web sites that collected personal information and 
       posted a privacy disclosure, 89.8% included at least one survey item for 
       notice, 61.9% contained at least one survey item for choice, 40.3% 
       contained at least one survey item for access, 45.8% contained at least 
       one survey item for security, and 48.7% contained at least one survey 
       item for contact information. 13.6% (n=32) of the same 236 Web sites 
       (or 9.5% of the 337 Web sites that collect at least one type of personal 
       information) contained at least one survey item for all five elements of 
       fair information practices: notice, choice, access, security and contact 
       information.