Do Companies' Online Privacy Policy Disclosures Match Customer Needs?

Abstract

Along with companies' increased interest in the use of personal information and the growing concerns of customers, privacy emerges as a critical issue in an e-commerce environment. Although several researchers have examined companies' privacy practices using posted privacy policy disclosures, few studies have investigated companies' privacy policies against Fair Information Practices (FIP). This study investigates companies' privacy policy statements and important privacy policies that individuals want to know against FIP. We examine the privacy policy statements of 136 companies from U.S. and Canada and relate them to the results of a Web-based user survey of 210 respondents. Our findings reveal a difference in companies' privacy policies between U.S. and Canada. The Security Safeguards and Use Limitation principles were the two most important companies' privacy policies that individuals want to know. The Security Safeguards and Purpose Specification principles were the two most frequently addressed OECD principles in more information-sensitive industries while the Purpose Specification and Openness principles were the two most frequently addressed principles in less information-sensitive industries. Thus, there is a gap between what privacy policies individuals value and what companies in less information-sensitive industries disclose in their privacy policy statements. However, companies in more information-sensitive industries frequently disclose an important privacy policy (i.e., Security Safeguards) that individuals want to know.

Keywords: internet privacy, privacy policy disclosure, consumer protection, electronic commerce