TRUSTe didn't look so trusty last year when a security expert found that its licensee RealNetworks had been collecting user information on the sly. Instead of reprimanding the company, the nonprofit argued that because RealNetworks' privacy violations took place via its RealJukebox software, not its Web site, the incident was outside the purview of TRUSTe. More recently, it's been other privacy advocacy groups like JunkBusters that have alerted the public to privacy violations such as Intel's decision to include an identifier in its Pentium III chip; JunkBusters also started a campaign against DoubleClick's acquistion of Abacus when it was announced last June.

But Bob Lewin, executive director and CEO of TRUSTe, says the group's privacy seal program plays an important role in enforcing privacy policies. Previously, Lewin was vice president of marketing at networking software company ISOCOR and before that at the open systems consortium X/Open Company. Now he heads up this nonprofit that charges between $300 and $4,999 to certify an e-commcerce site's privacy practices.

What's the basic message you're giving to consumers when they see the TRUSTe symbol? Is it that the site isn't going to sell my data?

The bottom line is that this site adheres to the fair information practices -- that they are disclosing what information they're collecting, why and if they're sharing that information with somebody. No 2: that they're giving the visitor the choice -- whether to allow that to happen; 3) that once the information is collected, they will use reasonable security to protect that information; 4) that they allow the consumer reasonable access to that information to modify it.

So if I were collecting consumers' e-mail addresses and then selling them to a direct-marketing company, would I still be able to get the TRUSTe symbol?

Only if you stated that to the consumer in your privacy statement. If somebody came to us and said, "Here's our privacy statement. We will collect the e-mail addresses, and it's our intent to sell or share this information with these third parties, and we are giving you the option to say yes or no to this." Then that site could become a TRUSTe licensee.

What percentage of sites get rejected?

It's not a large percentage -- I'd guess 1 to 2 percent.

What's the major reason sites get rejected?

Once they start through the process, they can't or will not meet the requirements of the program. Say they'd like to be able to share info with a subsidiary, and we say, "That's to a third party, you have to disclose that." Well, they may voluntarily decide they're not going to proceed. Also, we don't apply our mark to gambling sites, since it's illegal in some states. The other reason that it happens, frankly, is that 85 percent of our sites are very small -- $10 million and below --- and as the process starts, the company goes out of business.

If DoubleClick had been a TRUSTe member, would its decision to combine its database of anonymous surfing habits with an acquired database of personal information have set off red flags for you?

There would be some issues. That's why we formed a third-party ad server committee, to get all the technical and legal issues out on the table.

They would have had to inform us before they changed their policy, and we would have had some discussions.

Next page | Have you ever blown the whistle on a member?