FTC: Privacy Policies Should Be ExtendedFTC: Privacy Policies Should Be Extended

Many companies post privacy policies online without stating that those policies pertain only to online transactions, then use the consumer data they gather in offline transactions as they choose. But Howard Beales, the director of the Federal Trade Commission's bureau of consumer protection, warned last week that unless a policy states that it applies only to online transactions, the protections it specifies should extend to offline transactions, too.

Such an expectation "raises the bar for companies," says Mary Culnan, professor of management and IT at Bentley College in Waltham, Mass., but not high enough that they can't get around it. Companies will respond by simply adding a Web-only clause to their policies, she says. But Beales says companies want to conduct business fairly, and that since consumers want to protect their privacy on and off the Web, that's what companies will do.

A few companies are ahead of the game. Southwest Airlines Co., for instance, says its online policy of never sharing consumer data already extends to offline channels.

Some privacy advocates claim the FTC hasn't come down hard enough on companies that post misleading policies. Beales responds that the commission is working hard to crack down on such cases, but that "they're not always easy to find."