The US Federal Trade Commission (FTC) for its part believes that the lack of mandatory privacy regulations has prevented e-commerce from achieving its potential. A pair of surveys have suggested, for example, that privacy concerns led to losses in sales of US$ 2.8 billion in 1999, and up to US$ 18 billion in 2002. Meanwhile the FTC has been trying to determine whether online privacy issues can best be left to companies to self-regulate, or whether the federal government should intervene.

In response to public discomfort over the collection and sale of personal information by websites, hundreds of bills have been introduced in Congress, state legislatures and local communities addressing the general protection of information. But attempts to draft regulations have been stymied by the rapidly changing nature of Internet technology, and by a fear of interfering with the evolution of the new medium. Some legislators believe that placing stringent privacy requirements on the Internet would greatly slow the growth of e-commerce (which stood at about $ 300 billion in 2002), and maybe create an even greater barrier to the growth of on-line commerce than have fears about loss of privacy.

Still others have also warned of hidden costs in legislation. Currently consumers have the option of supplying a great deal of information to websites, or of supplying none at all. With mandatory regulation of privacy, it is not clear that the same choice would be available. Moreover, the simple act of requiring privacy notices might remove low-cost websites that could not afford to comply.

But there is also international pressure on the US to adopt a consumer privacy law quite apart from any originating from American consumer privacy groups, and it may ultimately be this pressure that decides what type of federal legislation -- if any -- is adopted. Because privacy laws vary from country to country, Internet sites doing business abroad need to comply with host country regulations. The US and the European Union (which unlike the US has enacted strict privacy laws) recently had to negotiate a special agreement (Safe Harbor)so US companies could continue to handle information obtained online from European customers.

The need for stringent privacy laws have been challenged by some e-businesses. Paul Misener, Vice President for Global Public Policy at Amazon.com, told a congressional hearing on consumer privacy in 2002, “Although we are aware of intuitive and compelling arguments that legislation is necessary to boost consumer confidence, we are not nearly so sure this is true. [J]ust as in the off-line retail world, consumers know there are both safe and unsafe places to shop.”

Americans, believing that they own any information about themselves, have a long history of expecting companies they do business with to protect sensitive data because in many cases there has been little alternative. When people make major off-line purchases like homes or cars, they expect that the information they provide will be used only in acknowledged ways. As Professor of Law and Economics Paul H. Rubin of Emory University notes, “Once a customer provides the data to make a purchase, then by default the company must protect it -- the customer cannot do so.”

Credit card companies provide a good example. Although credit card fraud places a burden on consumers, much of that cost is borne by the companies that issue the credit cards. Since there is a low cap on any direct losses to cardholders, it is the credit card companies that are most heavily motivated to prevent fraud. Because the companies are obviously better positioned to do this than are cardholders, there has been little reason to challenge the model.

Randall Frost is a freelance writer based in Pleasanton, CA. His work has been published by the New England Financial Journal, CBSHealthWatch, Modern Drug Discovery, Outdoor California and Gale.