Small-print statements on Privacy Policy and promises to not reuse or resell personal information are being scrutinized as online buyers become more protective of their online privacy, as well as more aware of data thefts and hacker activities. Note, also, that Yahoo recently announced it will not retain personal information beyond three months, which cuts Yahoo’s stored user database by half.

Fran Maier in E-Commerce Times stated the dilemma for online sellers as:

Ask for Too Much Information, Watch Customers Flee.

Building on the relative strength of e-commerce (compared to disappointing holiday season performance for offline retail), E-Commerce Times focused on steps online marketers can take to ensure that their privacy policies gain, and retain, customer loyalty. Tips include:

· Don’t Skimp on Privacy Policy Monitoring. 
When times are tough and personnel budgets are tightened, skimping on privacy compliance is a false economy. Maier suggested using outside services if an online merchant does not have IT or legal staff to cover this need. Privacy Certification Programs can monitor and notify customers on privacy concerns, including programs like TRUST-e, whose logo is posted on sites of qualified participants.

· Use Best Practices in Privacy Protection Along with Personalization.
The hottest area of email/online marketing centers around personalization and retargeting – collecting consumer behavior, such as past purchases or page views, in order to make value-added recommendations to cross-sell related products. E-Commerce Times suggests not being too invasive or violating privacy protection while building target marketing techniques. Consumers can be unforgiving and highly vocal when companies misstep, noted Maier.

· Don’t Use Legal-ese. 
An e-commerce seller should post a prominent and plain-language privacy statement that covers usage (and sharing with third-party marketers) of customer info gained in cookie files, from IP addresses and URL tracking. Ensure full disclosure to avoid future PR crises from complaints or flaming on social media blogs and peer review sites.

· Respond to Data Breaches Immediately.
Any loss or theft of information should be fixed immediately through IT security and all affected customers should be alerted, notification often provided by 3rd-party privacy compliance companies. To show scope of data breach problems, E-Commerce Times offered stats on “phishing” and “malware” attacks:

The Anti-Phishing Working Group reported a 93% increase in the number of URLs spreading malware in 1stQ 2008 (6,500) over the previous high in 4thQ 2007; and a 337% increase over 1stQ 2007!

· Exercise judgment in using social media sites to collect personal data.
Importing contact info and email addresses through social networking sites is an effective viral marketing technique; but it should be done only within privacy standards. And with clear notice to customers about how their personal information might be used.

· Treat Privacy Compliance as investment.
Because customers have more loyalty – and brand equity is higher – at companies that are trusted, a low-cost investment of time and funds to protect customer privacy is a competitive advantage … especially in a tough economy.