Big two take a bite at Net cookies

By Dita De Boni

New Zealand web sites which do not post privacy warnings for users may soon find themselves short of big-money advertising.

The move is being driven not by the Privacy Act, but by IBM and Microsoft, which say they will stop advertising on sites without privacy statements covering the collection, use and security of personal information.

The irony will not be lost on web surfers and privacy groups, which have accused computer companies, including Microsoft, of surreptitiously tracking users.

The New Zealand Privacy Commissioner, Bruce Slane, whose list of unresolved complaints is nearly 14 months long, says that instead of an "oppressive [Government] privacy policy," the private sector should be responsible for disclosure of information-gathering practices as set out in the 1993 Privacy Act.

"No one will be specifically enforcing an international privacy policy," Mr Slane says.

"But a statement disclosing how and where information will be used is part of enforcement itself and will aid consumer confidence."

Of particular concern to many internet users is the use of "cookies" - a record of user details that can be read by consumer marketing companies and Government agencies.

Cookies are set when information is requested from a web-server. The server sends back to the user's browser the requested page - and an instruction to write a "cookie," or record, which is stored in the user's computer and can trigger the server's "memory" each time the same web page is requested.

Most internet browsers allow cookies, although users can disable the feature.

One New Zealand company with a privacy policy outlining its use of cookies is the Internet Yellow Pages, which says "confidential" information collected will include which pages are viewed, how many PCs are connected to the site and which browsers are used.

The communications manager of Telecom Directories, Jo Fuller, says cookies are collected to "demonstrate the effectiveness of the Internet Yellow Pages site to existing and potential clients."

Microsoft New Zealand's Terry Allen says more than 2000 companies around the world have used Microsoft's "Privacy Wizard" - a kind of template from which companies can prepare privacy statements.

Mr Allen says Microsoft New Zealand is "looking into assessing" how to follow a headquarters edict saying Microsoft will buy advertising space only on web sites with comprehensive privacy policies posted.

IBM's Jason Dykes says his company is negotiating with companies to include web site privacy statements.

"Gradually, over the next few months, we will be looking into advertising only with companies which have privacy policies."

Although the Privacy Act is not technology-specific, Mr Slane says its principles apply to all personal information gained through the internet.

The OECD was developing a privacy policy "wizard" of its own that companies could use to reassure international internet users.

"Other ideas include listing a company official [on a web site] who would respond to complaints from consumers who felt their information was being used improperly," he says.

Mr Slane says very few of the long list of privacy complaints made to his commission are related to e-commerce.

A study of American web sites last year showed that 85 per cent collected personal information from users.

Only 14 per cent told users they were collecting information and only 2 per cent had comprehensive privacy policies displayed.