Privacy seal

Privacy seals have been around since the 1990s – with the TRUSTArc seal program being founded in 1996 and BBBOnline's in 1998. With the rise of e-commerce, it became apparent that privacy concerns were deterring potential customers. This information can be sold to third-parties for advertising purposes or be used by the company for data profiling purposes. Companies can price discriminate by using the information collected to predict the highest price point a customer is willing to pay. Some detractors of self regulation and laissez faire regulation believe a "race to the bottom" effect will occur if there are no regulatory (financial) penalties. Strauss et al. found that seal programs seem effective in regards to privacy but believes lack of regulation is why privacy seals have not seen high rates of participation. They note the conflict resolution and investigative aspect of privacy seal programs, but state that they have limited power to redress the situation. They are not given any powers for punitive action against companies in violation of privacy standards. Research by Jamal et al., however, suggests that lack of regulation should not be a concern. Even without governmental or financial threats, e-commerce companies still adopt policies and practices of privacy protection and disclosure. This is despite no general federal or state law requiring them – there are slight overlaps in the case of protecting health information or children. Proponents of governmental regulation believe legislation would officialize rules that are already being followed by many already. FTC guidelines are already followed by most companies (as a result of meeting customer expectation). Proponents also state that legislation in the United States could be less specific than the European Union's – wiggle room for how a business uses the data collected could still exist. Privacy seals assure consumers that a company is taking measures to protect their privacy and data. Companies must undergo a process of inspection by the seal provider to make sure they meet certain standards. Checks are then conducted regularly (depending on the provider this can be done annually, biannually or randomly) to ensure compliance. Although FTC guidelines act as a bare minimum, additional standards can differ between seal providers. For example, SecureAssure (launched in 1999) resorts to an opt-in practice rather than disclosure measures. They do not allow companies participating in their seal certification service to share any information beyond its primary use – i.e. no selling to advertisers. People using these websites must opt-in to receive promotional material (this includes emails). Privacy seals usually come with a fee that ranges from a few hundred to several thousand U.S. dollars. The Entertainment Software Rating Board (ESRB) Privacy Certification program utilizes a sliding scale (starting at $0) that is based on the annual revenue of the company seeking certification. Many privacy seal providers also serve as complaint resolution services. Participating seal service providers mediate conflicts between customers and the website in which their seal is displayed. They will also on occasion launch a formal investigation. The most severe action a privacy seal provider can enact is revoking the privacy seal from a company and thus producing negative attention. Action cannot be taken to remove the website or to enact a sizable financial penalty. == Uses ==

Privacy seals can be placed on many different types of e-commerce or educational websites. Companies may also have different motives for wanting a privacy seal. Studies in the past have looked at the effectiveness of privacy in general e-commerce, as well as in specific categories like loan providers, travel booking, and online bookstores. ESRB has several types of privacy seals. Their Kids Online Compliance seal certifies companies whose target market are children. Customers using websites with seals have higher rates of satisfaction and intention to purchase again. Privacy seals also desensitizes customers' perceptions of service performance. Kimery et al. found in their study that privacy seals only had a slightly positive impact on trust where unfamiliar e-commerce retailers were concerned. This means that well-known brick and mortar companies may after consideration decide that privacy seals are not worthwhile. Still, company privacy practices usually align with what customers' expect in websites with privacy seals. Additionally, a study by Ruppel et al. which followed four fledgling websites states that businesses will build websites to reflect their values. A brick and mortar store that has established trust with consumers would be unlikely to build a website that would jeopardize that relationship. For this reason, websites may start off with the intention to promote product rather than facilitate actual transactions. They found that regardless of risk condition (cost of product), fixation times were longer for privacy icons then for privacy text or non-privacy content. Research by Miyazaki et al. has compared perceived risk in e-commerce to other forms of shopping, more specifically mail order and purchases made by telephone. They found that consumers perceive online shopping as more dangerous than these other methods, but privacy seals are effective in mitigating concerns. Although privacy seals have shown to work in attracting customers, they have experienced limited success. In the case of the WebTrust privacy seal program which is a joint venture between the U.S. and Canada, a study was done to determine the cause of its slow growth. The authors of this study, Lala et al. suggest it might be a marketing issue. Consumers are unaware of what privacy seals look like, as well as their purpose. BBBOnline Privacy Seal service ceased taking new applicants in 2007 and stopped their service in 2008, but this has not stopped websites from displaying their privacy seal to this day. == Privacy concerns ==

Level of privacy concern can vary depending on the type of website. This can partially impact a consumer's intention to purchase – which is also affected by price of product and level of certainty that the company will protect consumer data after the fact. People who are knowledgeable in terms of how to use the internet are not necessarily well versed in internet safety or the extent to which the government is involved. Dinev et al. analyzed data from over 400 respondents using structural equation modeling to test various relationships between Internet literacy, social awareness, Internet privacy concerns, and intention to transact. They found that people who were more Internet literate had less concerns whereas people who are more socially aware (pay more attention to socio-political factors and current events) are more concerned about their privacy. Past research has shown that young adults (18 to 29) are less likely to be concerned or proactive about their privacy even though they are the most likely to have their identity stolen. Risk in e-commerce is not just about the security measures put in place by the organization's website but also has to do with the behavior of the consumer. Each privacy seal provider has its own standards in addition to following the rough guidelines the Federal Trade Commission has established on privacy protection. BBBOnline was found to make more statements about how they secure transmission of information than TRUSTArc. Generally speaking, websites with privacy seals are more transparent about their privacy practices, but they often ask for more personal information than websites without a privacy seal. This is because privacy seals evoke a sense of trust from the customers which makes them more willing to share personal information. Privacy seals are tools of persuasion. Companies benefit from having a privacy seal because it creates an appearance of trustworthiness. Privacy seals have little effect on perceived risk of using a website, but does strongly affect how trustworthy a customer perceives a website. Websites without seals are not necessarily more risky. This is because privacy seals are a product companies must opt-into, they are not automatically given to any websites that meet certain requirements. Privacy seals do not mitigate risk, they are a safety heuristic. Controversies Privacy seals have landed in hot water in the past due to slip ups. TRUSTArc mistakenly used a third party that tracks information on its own website. TRUSTArc also discovered that two of the websites certified by them were in violation of providing data to a marketing firm. == International applications ==

European Union An American creation, privacy seals, have slowly made their way into Europe. Most seal programs are not only American in origin but also mainly consist of U.S. websites. QXL, a now defunct online auction house, was one of the first European companies to receive certification by TRUSTArc. The study's two surveys (one based in each country) revealed that privacy seals did not significantly influence South Korean shopper's intent to purchase or their concerns. Kim et al. suggest this is because of South Korea's collectivist culture which makes them more trusting of their government. Places where governmental influence is welcomed would have less use for privacy seals because users would in theory be satisfied with the measures the government takes to protect their privacy. Japan Privacy seals entered the Japanese market because the Japanese government believed privacy assurance to be paramount to ensuring the growth of e-commerce. Starting in April 1998, the Japan Information Processing Development Center (JIPDEC) has been managing the PrivacyMark program. Ten years prior, JIPDEC published their "Guidelines for personal data protection in the private sector". As of 2015, PrivacyMark has certified 19,000 organizations. In 2008, JIPDEC created a mutual recognition program in China in partnership with Dalian Software Industry Association (DSIA). == See also ==