Can You Keep a Secret?

At the height of the internet boom, marketers had big dreams about harnessing the power of consumer information. As they saw it, the Internet had created opportunities for data mining, cross-selling, and targeted marketing that went far beyond what was feasible in traditional commerce. Airlines could find out who was checking fares to the Caribbean. Health-care companies could keep track of who was reading up on diabetes or schizophrenia. At last, it would be fast, easy, and cheap to profile a vast assortment of customers--and to pitch them accordingly.

But then the privacy backlash set in. Consumers began to worry that their health records, their music tastes, and other information about them were being put at the disposal of strangers. Meanwhile, a highly vocal privacy-advocacy community began publicizing outrage-of-the-month incidents--which put pressure on perceived offenders to back away from plans to make full use of customer data. Amazon.com, for example, tried to publish lists of the books that sold best among employees of Coca-Cola, IBM, and the like, only to retreat after some customers complained that their reading tastes weren't anyone else's business.

As a result, lots of big companies began treating online privacy in a purely defensive way--as an issue to be handled mainly by their legal department. "Just don't get it wrong" supplanted "Get it right."

Lately, though, all sorts of organizations that do business on the Internet are taking a fresh look at their privacy strategies. Their objective: to strike the right balance between shielding each user's privacy and exploiting a rich mountain of consumer data. "Good privacy can be a good business practice," contends David Kramer, a partner at Wilson Sonsini Goodrich & Rosati, one of Silicon Valley's top law firms. "If you think about it, it's really part of good customer service."

In this new environment, companies aren't abandoning efforts to extract value from online databases. But they are gathering and exploiting data in a more consumer-sensitive way. Replacing the strip-mining tactics that consumers fear most is an approach that rests on a few basic principles.

Be Up-front

Over the past few years, companies have tended to keep privacy issues in a haze. Too often, privacy policies have been verbose and jargon-filled, and companies have buried them in obscure corners of Web sites or deep inside long-winded emails.

That's not smart, and in some industries, it's not even legal. New federal regulations require companies in the health-care and financial-services fields to post clear highly visible privacy policies on the Web, and to remind users repeatedly that they can opt out of future marketing initiatives. But even in industries where anything goes, there's a strong case to be made for being candid rather than coy. If you want your customers to remain your customers, then you should be reasonably clear about how you plan to use information about them--and what their rights are regarding that information.

Isn't there a risk that most consumers will make their data off-limits if the opt-out card is easy to play? Not if companies convince consumers that data sharing is worth it. In fact, if opt-out rates start to rise much above 10%, that's probably a good sign that a company has done a poor job of designing its marketing promotions.

Stay in Control

Don't let a third party use your data to communicate directly with customers. That's a steady refrain of Marc Loewenthal, chief privacy officer at Providian Financial, a San Francisco-based credit-card issuer. Sure, there are good reasons why Providian might allow businesses like Avis Rent A Car, Flowers.com, and Marriott Hotels to pitch their goodies to its online customers. But, Loewenthal says, that kind of dialogue should always begin with an email or targeted ad sent by Providian itself, and only those customers who respond to such a message should be put in touch with a third-party marketer.

From a privacy standpoint, Loewenthal argues, that's a much more attractive option than opening up vast swathes of Providian's cardholder registry to outsiders. Customers receive only those pitches that Providian thinks might appeal to them--and they don't run the risk of getting bombarded with spam. What's more, Providian maximizes the long-term value of its large customer database. "That's a no-brainer for us," Loewenthal says. "Customer data is very valuable to us, and we need to guard it very jealously."