SUMMARY OF TESTIMONY

Americans want control of their identities - They would like the presumption of privacy when they are online; they want to be asked before information is gathered or disseminated. They want rules, but they have no clear preference for government standards or industry self-regulation. Still, only a small fraction of Internet users have taken steps to protect their privacy and 56% do not know what cookies are. They would like more control of their data through notice, choice, access to their data, and security. And they would appreciate more education about these issues and new tech tools to help them manage their online privacy.

Context matters - Concern about privacy should be understood in relation to other factors: 

·        "Privacy" means several things to Americans. For some it means anonymity, for others it means confidentiality (that information will not disclosed to others), and for others it means security (that malicious outsiders cannot get at the information).

·        More than two-thirds of those who express concern about privacy do quite trusting things online, such as purchase goods, participate in support groups, seek health information, make friends with strangers, participate in auctions, and seek religious information.

• Information transactions are commonplace online: 64% have given or are willing to give their email addresses and other personal information to Web sites in return for access.
• 54% of all Americans approve of the FBI or law enforcement agencies intercepting email over the Internet sent to and from people suspected of criminal activities. 34% disapprove. 12% don't know.

Demographics matter, too - Gender, age, education level, and, perhaps most important, Internet experience, are strongly associated with Internet users behavior and attitudes about privacy.

Testimony by Lee Rainie

Chairman Stearns and honorable members of the Subcommittee, it is a distinct honor for the Pew Internet & American Life Project to be asked to testify at this important hearing. I am the director of the project. It is an independent, nonpartisan, center created to examine the social impact of the Internet with a grant from the Pew Charitable Trusts. We do not have an advocacy agenda. I will be talking today about our findings from several polls we conducted last year and in February this year that illustrate some fascinating cross currents on the privacy issue.

At the most fundamental level, Americans would like the presumption of privacy when they are online and they would like to be in control of when pieces of their identity are given out. This is the Information Age corollary to the classic American formulation of privacy: the right to be left alone. In the 21^st Century, they want right to control their identities. If they could craft a Golden Rule of the Internet it would be: "Nobody should know what I do on the Web or anything else about me unless I say so."

Not surprisingly, these Americans have great concerns about their privacy being compromised. Still, it has become clear in our work related to this issue that different people mean different things when they are talking about privacy. The context of the questions and of the behavior needs to be understood in order to grasp how Americans feel about privacy. For instance, the definition of the term is very important. For some it means anonymity. About a quarter of Internet users say they want no information about them traced or disclosed in any circumstance.

For others, the concept of "privacy" means confidentiality. They are comfortable letting some Web sites or organizations know about them, but they do not want that information passed along to third parties without permission. And for others it means security; they are anxious that information about them is going to be discovered by hackers (68% of Internet users worry hackers will steal their credit card information) or that important personal data will be inadvertently disclosed by a sloppy Web operation.

            Americans also are most anxious about improper use of their information when it could do them real harm. Most Internet users fear insurance companies learning about their health and medical information searches and, as a result, changing or canceling insurance because of the kinds of Web sites that were visited. Many fear their employers might find out and that could affect their job status. And the vast majority fear financial loss through disclosure of their credit card information.

Trusting behavior

At the same time they overwhelmingly express concern about their online privacy, American Internet users do a striking number of intimate and trusting things online. This is another aspect of how the context of privacy discussions is important to understand. More than two-thirds of Internet users who have serious privacy concerns have done at least one of these things online: purchase goods, make travel reservations, get health information, respond to email and instant messages from strangers, make friends and dates with people they have never met face-to-face, join support groups, place their calendars and address books online, and participate in online auctions.

Perhaps one of the reasons for that level of trustful behavior is that few Internet users have ever had a serious problem online. Just 4% of Internet users say they have felt threatened in some way while they were online; 3% say they have been cheated when they tried to buy something online; and fewer than 3% believe their credit card information has been stolen online. The irksome issue is "spam," the online equivalent of junk mail, which makes about a third of Internet users unhappy to varying degrees. And about a quarter of Internet users say they have gotten an offensive email from a stranger.

Yet another reason for the high level of trusting activity online is the majority of Internet users do not know if or how they are being tracked. Most feel they are anonymous online unless they take affirmative steps to disclose information about themselves. This is enormously important, for instance, to some who seek health information, especially when they are conducting their searches in the privacy of their den or recreation room. Most are unaware, of course, that many of the health-related Web sites they visit plant cookies - small bits of encrypted information deposited on a computer's hard drive so the online firm can track the user's clicks through the site (and sometimes other sites) and to identify that computer the next time it visits the health site. Fully 56% of Internet users do not know what a cookie is; and just a tenth of Internet users have set their browsers to reject cookies.

In principle, Americans do not much like the idea of online tracking and profiling - by a two-to-one margin they say that tracking is an invasion of privacy, rather than a tool to help Web sites provide customized information to users. Still, relatively few take steps to shield their identities:  24% of Internet users have provided a fake name or personal information in order to avoid giving a Web site real information; 9% have used encryption to scramble their email; 5% have used "anonymizing" software that hides their computer identity from Web sites they visit.

Information transactions

Internet users' preference for a presumption of privacy does not translate into a universal yearning for anonymity. In fact, most are comfortable with disclosing information under the terms of basic information transaction of the Internet age in which the bargain between a user and a Web site is: "I give you a piece of my identity in return for something of value from you." Some 54% of Internet users have chosen to provide personal information in order to use a Web site and an additional 10% say would be willing to provide it under the right circumstances.

            They want rules, but they reject the notion that the government and Internet companies are the best stewards of their personal privacy. Asked who would do the best job setting those rules, 50% of online Americans said Internet users' themselves would be best, 24% said the federal government would be best; and 18% said Internet companies would be best.

            And they are clear in their gut-level preference for what they would like the rule to be: 86% of Internet users say that Internet companies should ask people for permission to use their personal information. It is important to add that at the time we measured this sentiment last spring, we knew that most Internet users would not know the intricacies of the policy debate about the different kinds of options - opt-in or opt-out or robust-opt-out and everything in between. So, we did not pose our questions in a way that would sort out Americans' views on these matters. We know they express every way they can that they would like to control the process of information collection and disclosure.

Finally, there is also at least one other context in which the strong public concern about privacy is tempered by another fear: the anxiety about online crime.  In a survey in February, we found that substantial majorities of Americans were concerned about every kind of online crime. As a result, 54% of all Americans (and 60% of Internet users) approve of the FBI or law enforcement agencies intercepting email over the Internet sent to and from people suspected of criminal activities; 34% of all Americans said they disapprove; 12% said they don't know. At the same time, 62% of Americans say new laws should be written to make sure that ordinary citizens' privacy is protected from government agencies.

Demographic context

Concerns about privacy are notably higher among some groups, especially Internet novices (those who first got online within the past six months), parents, older Americans, and women. In some cases, these fears also apply to online African-Americans, Hispanics, and those in households with modest income levels. These fears are often associated with lower participation in online life and some online activities, especially commercial transactions. For instance, one of our surveys suggested that those who had the strongest fears about privacy violations online were 20% less likely to have shared information with a Web site; 15% less likely to have used their credit cards online, and 15% less likely to have clicked on an ad.

One of the biggest questions hanging over the Internet is whether today's newcomers will eventually act like today's veterans in their online behavior and in their beliefs. The veteran population is dominated by young, upscale, well-educated, white men. They are much more likely than others to say they are unconcerned about their privacy being compromised in the online world and much more likely to spend money and manage money (through online banking and brokerage activities) than other Internet groups. On the other hand, the novice Internet population looks a lot more like the rest of America with lots of women, minorities, and those from modest-income households, and without college educations. The issue is whether this large newcomer group, which is more concerned about privacy issues, will feel less anxious as time passes and will do more business online.

We are just getting some preliminary information that suggests experience online significantly increases the commercial activities of Internet users as well as their willingness to do other trusting activities online, such as seeking health information. In March 2001, we reinterviewed about 90 Internet users who told us in March 2000 they had recently gotten Internet access. In the course of a year of gaining experience online, this group showed a 15% increase in the number of trusting activities this group had performing online and a nearly 50% increase in the commercial activities it had performed online. This is too small a group from which to draw strong conclusions, but it suggests that experience breeds higher levels of trust.

Privacy concerns are an even bigger issue to those who do not now have Internet access. More than 82 million American adults to not have Internet connections and more than half of them say they have no plans to get access. One of the major concerns they cite is the danger and unreliability of the online world. These worries are most acute among older Americans.

Policy implications

Internet users would be happier if their online experiences were governed by the strong preference to be in charge of their identities. They embrace principles of notice, choice, access to information about them, and security. Internet users would prefer a different tilt on the privacy playing field, where the burden of effort was shifted away from them and towards those who want to collect information about them.

Internet users would surely profit from an industry-led education campaign that focused on the mechanics of tracking. Companies would gain in users' eyes if they offered a clearer and more convincing explanation of the virtues of cookies - specifically, how their use enhances users' experiences and makes it simpler and more efficient for them to use the Web, and how their use enables advertisers to support the vast amount of free content on the Web. Our surveys show that most Americans viscerally oppose the ideas of online tracking and profiling and they will need a lot of convincing before they accept some of the benefits of those activities.

Finally, users would appreciate more technological tools that would give them a sense of control, or at least transparency in letting them know what is happening to the pieces of their identity they are divulging as they move through Internet space.

Addendum: Other significant findings in Pew Internet Project surveys

•  86% of Internet users think Internet companies should ask people for permission to use personal information when people give it to them. 

• 71% of Internet users say they themselves, rather than the government or online businesses, should have the most say over how Internet companies track Web activities,

• 54% of Internet users believe that Web sites' tracking of users is harmful because it invades their privacy; 27% say tracking is helpful because it allows the sites to provide information tailored to specific consumers. 

• 89% of those who seek health information online (we call them "health seekers") are concerned that a health-related Web site might sell or give away information about what they did online; 71% are "very concerned" about such privacy violations. 

• 85% of health seekers are concerned that an insurance company might raise their rates or deny them coverage because of the health sites they have visited; 72% are "very concerned" about this possibility. 

• 52% of health seekers are concerned that their employer might find out what health sites they have visited. This ranks comparatively low in part because most health seekers are getting their information online from home. 

• 60% of Internet users think that putting medical records online is a bad thing, even if the records are on a secure, password-protected site, because they worry about other people seeing their personal information. The rest think it's a good thing because they and their doctors would have easy access to patients' medical records. 

• 94% of Internet users want privacy violators to be disciplined. If an Internet company violated its stated privacy policy and used personal information in ways that it said it would not, 11% of Internet users say the company's owners should be sent to prison; 27% say the owners should be fined; 26% say the site should be shut down; 30% say the site should be placed on a list of fraudulent Web sites. 

• Internet users are pretty savvy about at least one privacy safeguard: passwords. Sixty-eight percent of Internet users use different passwords when they register at various Web sites. 

• While many are concerned about their privacy online, there is no evidence that the Internet is a more menacing threat to privacy, in most Americans' opinion, than activities in the offline world. That applies, for instance, to credit card information. Of all those Americans who had used their credit card to buy something over the phone, 56% said they worried about someone else getting their credit card number. In comparison, of all those with Internet access who used their credit card to buy something online, 54% said they worried about someone else getting their credit card number. 

• Similarly, Americans are just as likely to approve FBI or law enforcement surveillance of criminal suspects' phone calls and postal mail as they are to approve surveillance of suspects' email. Fully 56% of all Americans approve of the FBI or law enforcement agencies intercepting telephone calls to and from people suspected of criminal activities; 55% of all Americans approve of the FBI or law enforcement agencies intercepting letters and packages sent by mail to and from people suspected of criminal activities; 54% of all Americans approve of the FBI or law enforcement agencies intercepting email over the Internet sent to and from people suspected of criminal activities.

• 11% of all Americans and 17% of Internet users know someone who was fired or disciplined because of an email they sent or a Web site they went to at work. 

• 25% of Internet users have been hit by computer viruses. The vast majority of the viruses have been sent to them via email. 

• Older Americans are more likely than younger Americans to express concerns about privacy and the Internet. Fully 67% of those between the ages of 50 and 64 years old say they are "very concerned" about businesses and people they don't know getting personal information about them or their families, compared to 46% of between 18 and 29. 

• 81% of those who get health information online would like to have the right to sue a medical company that gave away or sold information in violation of its privacy promises. 

• 92% of Americans say they are concerned about child pornography on the Internet and 50% of Americans cite child porn as the single most heinous crime that takes place online. In other areas, 87% of Americans say they are concerned about credit card theft online;

• 82% are concerned about how organized terrorists can wreak havoc with Internet tools; 80% fear that the Internet can be used to commit wide scale fraud; 78% fear hackers getting access to government computer networks; 76% fear hackers getting access to business networks; and 70% are anxious about criminals or pranksters sending out computer viruses that alter or wipe out personal computer files. 

•  62% of Americans say new laws should be written to make sure that ordinary citizens' privacy is protected from government agencies. 

• Among the relatively small number of Americans (21%) who have heard about the FBI's email sniffing program called "Carnivore" or "DCS1000," there is much more evenly divided opinion. Forty-five percent of people who have heard of it say Carnivore is good because it will allow the FBI a new way of tracking down criminals. Another 45% say Carnivore is bad because it could be used to read emails to and from ordinary citizens. 

•  79% of Internet users who did not buy gifts during the holiday season of 2000 said they do not like to send credit card or other personal information over the Internet.