Opting in, opting out, or no options at all: The fight for control of personal information

Washington Law Review

Volumn 74, Issue 4, 1999, Pages 1033-1117

  Sovern, Jeff ^a,b  

^a ST JOHN'S UNIVERSITY   (United States)

^b Och Spine at New York Presbyterian Hospitals   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 0347358110     PISSN: 00430617     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (497)

1. Driving records in New York are available to the public. See N.Y. Veh. & Traf. Law § 508.3 (McKinney 1996) ("The commissioner shall keep a record of every license issued which record shall be open to public inspection."). Businesses use driving records for a number of commercial purposes. For example, sellers of eyeglasses use them to identify consumers who require corrective lenses. Information about height and weight in driving records is useful to clothing retailers, especially those that sell to the "big and tall" market. See Michael W. Miller, Firms Peddle Information from Driver's Licenses, Wall St J., Nov. 25, 1991, at B5.
2. Some states make a significant amount of money from selling drivers' information. See Paul M. Schwartz & Joel R. Reidenberg, Data Privacy Law 150 (1996);
3. What's in a Name? Big Bucks, Albany Times Union, May 8, 1996, at A14 (reporting that state sold list of drivers for $1.4 million).
4. However, there are states that either do not release the data or use an opt-out procedure under which drivers may prevent disclosure of their information. See Schwartz & Reidenberg, supra at 150. In 1994, Congress enacted the Driver's Privacy Protection Act, Pub. L. No. 103-322, 108 Stat. 2102 (codified at 18 U.S.C. §§ 2721-2725 (1994)), to restrict access to information in state motor vehicle records. The Act lists, in 12 subsections, permissible uses of drivers' personal information. See 18 U.S.C. § 2721(b)(1)-(10), (13), (14) (1994). It also provides in two additional subsections that a consumer's information may be used for "bulk distribution for surveys, marketing or solicitations" or for "any other use" if the motor vehicle department has notified consumers "in a clear and conspicuous manner" that the information may be used for such purposes and has given consumers the opportunity to prevent the disclosure. 18 U.S.C. § 2721(b)(11)-(12). This statute has not prevented the existence of an Internet site that lists driver's license information, as discussed in infra note 22. The federal statute was ruled an unconstitutional infringement on the powers of the states under the Tenth Amendment in Condon v. Reno, 155 F.3d 453 (4th Cir. 1998), cert. granted, 119 S. Ct. 1753 (1999). But see Travis v. Reno, 163 F.3d 1000 (7th Cir. 1998) (upholding statute); Oklahoma v. United States, 161 F.3d 1266 (10th Cir. 1998) (same); Pryor v. Reno, 998 F. Supp. 1317 (M.D. Ala. 1998) (same). For an argument that government may not restrict the reporting of or access to information contained in public records, see Cheryl M. Sheinkopf, Balancing Free Speech, Privacy and Open Government: Why Government Should Not Restrict the Truthful Reporting of Public Record Information, 44 UCLA L. Rev. 1567 (1997).
5. This information is available in a computer database. The information is useful to creditors searching for debtors who have moved. For example, the database allows the creditor to identify the debtor's former neighbors, from whom the creditor might obtain the debtor's whereabouts. See William M. Bulkeley, Bill Collectors Master Automated Arm-Twisting, Wall St. J., Sept. 10, 1990, at B1.
6. He had cut the bullet open, removed the gunpowder, and taped it together again, thus rendering it an inert piece of metal, but it does kind of make you wonder. The student in question graduated, passed the bar, made it through the Character Committee, and is now practicing law. That makes you wonder too.
7. See Oscar H. Gandy, Jr., The Panoptic Sort 91 (1993);
8. Erik Larson, The Naked Consumer 63-64, 93 (1992);
9. National Telecomm. & Info. Admin., U.S. Dep't of Commerce, Privacy and the NII: Safeguarding Telecommunications-Related Personal Information, app. at A-3 (1995)
10. [hereinafter Privacy and the NII];
11. Schwartz & Reidenberg, Data Privacy Law, supra note 1, at 322;
12. H. Jeff Smith, Managing Privacy 100 (1994);
13. Joel R. Reidenberg, Setting Standards for Fair Information Practice in the U.S. Private Sector, 80 Iowa L. Rev. 497, 519-20, 523 (1995);
14. Merchants of Data: Are They Telling on You?, 56 Consumer Rep. 356 (1991);
15. Robert O'Harrow, Jr., For Sale on the Web: Your Financial Secrets; Bank Accounts Vulnerable to Data Brokers, Wash. Post, June 11, 1998, at A1;
16. Larry Tye, List-Makers Draw a Bead on Many, Boston Globe, Sept. 6, 1993, at 1;
17. Your Health Files: How Insurers Check, 56 Consumer Rep. 357 (1991).
18. See Privacy and the NII, supra note 4, app. at A-3 ("[L]ist brokers have created catalogs of 'Arabs, in Their Native Lands, Who Gamble and Invest;' 'Doctors Who Are Known to Have Gambled;' and 'Jewish Philanthropists and Investors.'"); Reidenberg, supra note 4, at 519-20, 523; Susan Headden, The Junk Mail Deluge, U.S. News & World Rep., Dec. 8, 1997, at 43; Martin J. Smith, Ever Wonder Why You Get All That Unsolicited Junk Mail?, Ariz. Republic, Dec. 5, 1993, at A1
19. (noting that Hispanic New Movers File containing 1.85 million names is available for $70 per thousand names); Tye, supra note 4, at 1 (listing those with Italian, Japanese, and Jewish lineage); Mary Zahn & Eldon Knoche, Electronic Footprints: Yours Are a Lot Easier to Track than You May Think, Milwaukee Sentinel, Jan. 16, 1995, at 1A (listing subscribers to gay and lesbian magazines; company claims to be able to identify 85% of the 2.6 million Jewish households in the United States).
20. See, e.g., Larson, supra note 4, at 58 ("They can know, for example, what brand of condoms you charged at your local Rite-Aid or that you picked up a pregnancy test today. They can know too about your secret life, the flowers you buy that your wife never sees, your practice of staying in gay guest houses whenever you go away on business."); Margot Williams & Robert O'Harrow, Jr., Online Searches Fill in Many Holes, Wash. Post, Mar. 8, 1998, at A19 (reporting on free web service that found consumer's address, phone number, names, and addresses of 20 neighbors, and provided map and directions to consumer's home; another service provided for $9.50 consumer's previous addresses and for $12 consumer's Social Security number and birthday; another service provided driving record for $15.50; Lexis-Nexis charged $41 for information about consumer's home, including current assessed value, date of original purchase and price, number of square feet and rooms; another service provided sales estimates for consumer's business for $5; other services gave names and ages of consumer's children, and length of residence).
21. See Evan Hendricks, Metromail Stung Again, Privacy Times, May 17, 1996, at 4;
22. see also Ann Reilly Dowd, Protect Your Privacy, Money, Aug. 1997, at 112 ("Marketing information about kids is now a hot commodity and for good reason. . . . For 8.5 [cents] a name and a copy of the script you'll use to sell your product to kids, one Tucson company, for example, will give you as many as 8 million children under 17 sorted by name, sex, age and city.").
23. See Gandy, supra note 4, at 92. The U.S. Department of Commerce has reported on a company that has a database with information on more than 150 million people and 90 million households and another company with a database consisting of 133 million individuals. See Privacy and the NII, supra note 4, app. at A-2 n.10.
24. See Oscar H. Gandy, Jr., Legitimate Business Interest: No End in Sight? An Inquiry into the Status of Privacy in Cyberspace, 1996 U. Chi. Legal F. 77, 96 (1996) (citing Aristotle Industries' advertisement in Campaigns & Elections, Feb. 1995, at 83).
25. See Robert Moskowitz, Protecting Your Privacy Requires Planning, Investor's Bus. Daily, Sept. 16, 1994, at 1;
26. see also Jeffrey Rothfeder, Privacy for Sale 17 (1992).
27. See Andrew L. Shapiro, Privacy for Sale: Peddling Data on the Internet, The Nation, June 23, 1997, at 11-12.
28. See Nina Bernstein, Personal Files Via Computer Offer Money and Pose Threat, N.Y. Times, June 12, 1997, at 1 ("[The company] retrieved more than 900 tidbits of Ms. Dennis's life going back to 1987. Laid out on 25 closely printed pages of spreadsheets were not only her income, marital status, hobbies and ailments, but whether she had dentures, the brands of antacid tablets she had taken, how often she had used room deodorizers, sleeping aids and hemorrhoid remedies.").
29. See Michael Fraase, Information Eclipse, Privacy and Access in America 155 (1999);
30. Robert O'Harrow, Jr., Data Firms Getting Too Personal?, Wash. Post, Mar. 8, 1998, at A1.
31. See Robert Douglas et al., How Your Financial Privacy Is Threatened, Consumers' Res. Mag., Dec. 1998, at 10; O'Harrow, supra note 4, at A1.
32. See Nina Bernstein, On Line, High-Tech Sleuths Find Private Facts, N.Y. Times, Sept. 15, 1997, at A1.
33. Reidenberg, supra note 4, at 536.
34. Direct Mail List Rates and Data, compiled by Standard Rate and Data Service, is referred to in Jill Smolowe, Read This!!!!!!, Time, Nov. 26, 1990, at 62, 66;
35. see also Joel R. Reidenberg, Privacy in the Information Economy: A Fortress or Frontier for Individual Rights, 44 Fed. Comm. L.J. 195, 202 n.29 (1992).
36. One company alone reportedly maintained 1600 databases containing more than 3.5 billion public records. See Rajiv Chandrasekaran, Doors Fling Open to Public Records, Wash. Post, Mar. 8, 1998, at A1.
37. See Paula Crawford Squires, Transactions Go into a Database; Businesses Compile Dossiers on Customers, Richmond Times Dispatch, July 28, 1996, at A-12.
38. See Privacy and the NII, supra note 4, app. at A-2.
39. See, e.g., id. ("[B]ecause the costs associated with storing, processing, and distributing personal records are continuously decreasing, accumulating personal information from disparate sources will become a cost-effective enterprise for information users with interests ranging from law enforcement to direct marketing."); Bernstein, supra note 15, at A1 (describing service that provides Social Security number, date of birth, and telephone number in less than three minutes and for about $1.50; "for a few minutes and a few dollars more, the computer screen fills with other personal details: past and current addresses, names and telephone numbers of neighbors, names and Social Security numbers of relatives, in-laws and business associates, civil judgments and property tax filings."); Kristin Davis, Guarding Your Financial Privacy, Kiplinger's Pers. Fin. Mag., Aug. 1995, at 38, 40 ("Among the . . . most voracious customers: employers, journalists and private detectives.
40. 'I can do in one hour what ten years ago would have taken a week to do[,]' [said one private investigator]."); Evan Hendricks, CDB's Cut-Rate Look-Up Service, Privacy Times, Feb. 20, 1998, at 8 (reporting cost of look-up service, which provides subject's name, aliases, current and previous addresses, telephone number, Social Security number, driver's license number, date of birth, links to possible relatives, real property ownership, bankruptcies, tax liens, judgments, corporations, UCC filings, and other information reduced to $7 per search).
41. See Westlaw Database Directory 141-43 (1997).
42. Among the Westlaw databases for locating individuals are eight bearing the prefix "People Finder." The suffixes read: "Address Alert," "Name Tracker," "Name Tracker - Deceased," "Skip Tracer," "Social Security Number Tracker," "Social Security Number Tracker - Deceased," "Telephone Tracker," and "TRW/Trans Union Credit Bureau Headers Population Demographics." Among the Internet sites that can be used to find people is Database America, at 〈http:/www.databaseamerica.com〉.
43. Another Internet site which provides information on assets, lawsuits, liens, bankruptcy records, refinancings, and other information is KnowX, at 〈http://www.knowx.com〉.
44. Lexis-Nexis also has two services designed to locate people: P-Trak and P-Find. For a discussion of what these services can do, see FTC, Public Workshop on Consumer Information Privacy Session One: Database Study (June 10, 1997) 〈http://www.ftc.gov/ bcp/privacy/wkshp97/volume1.pdf〉
45. [hereinafter FTC, Session One: Database Study] (remarks of Karen Welch, Strategic Account Consultant, Lexis-Nexis).
46. See American Info. Network Inc., The Internet Department of Motor Vehicles (visited Oct. 6, 1999) 〈http://www.ameri.com/dmv.htm〉 (charging fee for access to driver's license and motor vehicle information);
47. Informus Corp. (visited Oct. 6, 1999) 〈http://www.informus.com〉 (providing access to Social Security numbers, credit reports, and criminal records for fees under $25);
48. Glen Roberts, The Stalker's Home Page (visited Oct. 6, 1999) 〈http://www.glr.com/stalk.html〉 (containing links to other web sites that verify Social Security numbers and provide other personal information);
49. Search First Info. Serv. (visited Oct 6, 1999) 〈http://www.searchfirst.com〉 (providing access to driver's license information, Social Security number verification, credit report, and criminal records, for various fees under $50).
50. See O'Harrow, supra note 13, at A1.
51. See Privacy and the NII, supra note 4, app. at A-7 n.30. Some services provide information to anyone who pays a fee. See FTC, Session One: Database Study, supra note 21, at 45-46 (describing subscription-free services available on Internet).
52. See, e.g., Rothfeder, supra note 10, at 17-21 (reporting on Vice-President Dan Quayle's Sears and Brooks Brothers accounts, Social Security number, and credit card number); Ellen R. Foxman & Paula Kilcoyne, Information Technology, Marketing Practice, and Consumer Privacy: Ethical Issues, 12 J. Pub. Pol'y & Marketing 106, 111 (1993) (describing how authors obtained CBS News Anchorperson Dan Rather's credit report, charge card data, mortgage information, location of residence, shopping information, and dining information); cf. Privacy and the NII, supra note 4, at 4 (reporting journalists' discovery of financial, legal, marital, and residential histories of movie producer George Lucas and White House Chief of Staff Leon Panetta). In 1997, amendments to the Fair Credit Reporting Act went into effect, which may offer more protection for credit reports. See 15 U.S.C.A. § 1681 (West Supp. 1999).
53. See Larson, supra note 4, at 61.
54. Board of Governors, Federal Reserve Sys., Report to the Congress Concerning the Availability of Consumer Identifying Information and Financial Fraud 10 (1997) [hereinafter Report to the Congress].
55. See Rothfeder, supra note 10, at 90.
56. Miller, supra note 1, at B1; see also Larson, supra note 4, at 134-36 (describing similar marketing techniques).
57. See Roger Clarke, Profiling: A Hidden Challenge to the Regulation of Data Surveillance, 4 J.L. & Info. Sci. 403 (1993).
58. For examples, see Daniel Mendel-Black & Evelyn Richards, Peering into Private Lives: Computer Lists Now Profile Consumers by Their Personal Habits, Wash. Post, Jan. 20, 1991, at H1: Vacuumed into huge databases around the country is information about how many times you went out to eat last month, about whether your dog prefers Alpo to Purina . . . . Details like these are sorted, digested and compiled so that computers can plop you into neatly defined categories to help determine the likelihood that you'll pay your Visa bill on time or buy a new brand of detergent or cigarettes within the next few months . . . . [C]ashing in a coupon [can put your name and address on a list because] some that arrive at your home are encoded with digits that will identify you when you trade them in.
59. What Price Privacy?, 56 Consumer Rep. 356 (1991),
60. also states: By overlaying the data available through thousands of information systems, it's now possible to create a remarkably detailed picture of anyone. That picture could include your age, income, political party, marital status, the number of children you have, the magazines you read, your employment history, and your military and school records. A database might also know what kind of breakfast cereal you eat, the make of car you drive, even the brand of diapers your baby wears. See also Jonathan P. Graham, Note, Privacy, Computers, and the Commercial Dissemination of Personal Information, 65 Tex. L. Rev. 1395, 1400 (1987).
61. See O'Harrow, supra note 13, at A1.
62. See Evan Hendricks, Class-Action Suit Targets CVS over Use of Prescription Data, Privacy Times, Apr. 3, 1998, at 1, 2;
63. see also Center for Pub. Integrity, Nothing Sacred 27 (1998) (describing woman who, after visiting doctor for routine tests, received letter from "pharmaceutical company that had obtained access to her medical data and wanted her to try its new cholesterol medication");
64. Evan Hendricks, Rising Traffic in Prescription Info Causes Backlash in D.C., Privacy Times, Feb. 20, 1998, at 1, 2 [hereinafter Hendricks, Rising Traffic in Prescription Info] (noting that efforts to market antidepressants and schizophrenia drugs to mental health patients is "particularly controversial because of the greater potential for manipulation");
65. Sheryl G. Stolberg, The Numbering of America: Medical I.D.'s and Privacy (or What's Left of It), N.Y. Times, July 26, 1998, § 4 at 3.
66. See Rothfeder, supra note 10, at 91-92.
67. See id. at 92.
68. Richard S. Murphy, Property Rights in Personal Information: An Economic Defense of Privacy, 84 Geo. L.J. 2381, 2402 (1996) (emphasis in original);
69. cf. Mary J. Culnan & Sandra J. Milberg, The Second Exchange: Managing Customer Information in Marketing Relationships (visited May 19, 1999) 〈www.msb.edu/faculty/culnanm/home.html〉 ("[T]he first exchange of goods or services . . . is accompanied by what we . . . call a 'second exchange' of personal information for a variety of customized tangible or intangible benefits."),
70. See Gary T. Marx, Privacy & Technology, Whole Earth Rev., Winter 1991, at 90, 91; see also Foxman & Kilcoyne, supra note 25, at 110 (describing technology that allows subscribers to call toll-free numbers to obtain lists of callers' numbers); Mendel-Black & Richards, supra note 30 ("[D]ialing an 800 number can put your name and address on a list.").
71. See Kevin DeMarrais, Big Brother Is Watching Your Database, The Record, Apr. 30, 1995, at A1;
72. see also Rothfeder, supra note 10, at 92-93 (describing similar lists created from consumers who called toll-free numbers to find out pollen count by zip code - who later received solicitations from sellers of antihistamines - and consumers who called to receive Thanksgiving turkey cooking tips - who subsequently were sent mailings from poultry farms); Evan Hendricks, Companies Exploiting Internet's Ability to Track Consumer Habits, Privacy Times, July 3, 1995, at 3, 4 (reporting on company that runs "Free Offer Outlet" on computer services, harvests names, addresses, and phone numbers of people who accept free offers, and provides information to sponsors for market research and follow-up; harvesting from one computer service alone said to generate over 300,000 leads in four months); Hendricks, Rising Traffic in Prescription Info, supra note 32, at 1, 3 (reporting on drug companies said to capture phone numbers from consumers calling toll-free numbers for various medications). Western Union advertised a similar practice to debt collectors with a debtor's address but not a phone number the company offers to send to the debtor a letter stating that the debtor has a telegram waiting and that if the debtor calls Western Union, the debtor can obtain the telegram. When, the consumer calls, Western Union is able to obtain the telephone number from which the debtor is calling. The Court of Appeals for the Ninth Circuit has ruled that this practice amounts to debt collection; consequently, Western Union must comply with the Fair Debt Collection Practices Act, 15 U.S.C. § 1692a(2) (1994). See Romine v. Diversified Collection Serv., Inc., 155 F.3d 1142 (9th Cir. 1998).
73. See Tye, supra note 4, at 1.
74. See FTC, Privacy Online: A Report to Congress 22, 27 (1998) [hereinafter FTC, Privacy Online]. On the other hand, a more recent study found that nearly two-thirds of the sites in its sample contained at least one privacy disclosure.
75. See Mary J. Culnan, Georgetown Internet Privacy Policy Survey 7 (1999).
76. See FTC, Privacy Online, supra note 39, at 23, 25. The FTC took a number of different samples of web sites, the largest of which it labeled the Comprehensive Sample. Other samples include: Retail Sample, Financial Sample, Children's Sample, and Most Popular Sample. Unless otherwise indicated, information reported in this Article relates solely to the Comprehensive Sample.
77. See id. at 31.
78. See id. at 32, 33; see also Shelley Pasnik & Mary Ellen R. Fise, Children's Privacy and the GII, in Privacy and Self-Regulation in the Information Age (visited Oct 6, 1999) 〈http://www.ntia.doc.gov/reports/privacy/selfreg1.htm〉.
79. See FTC, Privacy Online, supra note 39, at 36-37. After FTC issued the report, Congress enacted the Children's Online Privacy Protection Act, Pub. L. 105-277, 112 Stat. 2681 (1998). That statute regulates the collection of information from children in online transactions and requires parental approval for the collection and retention of certain information. The FTC has since proposed a rule to implement the statute. See 64 Fed. Reg. 22,750 (1999).
80. As Arthur Miller puts it, "At bottom, one person's 'I want to know' conflicts with another's 'leave me alone.'" Arthur R. Miller, The Right of Privacy: A Look Through the Kaleidoscope, 46 SMU L. Rev. 37, 38 (1992).
81. See, e.g., Alan F. Westin et al., The Equifax Report on Consumers in the Information Age xviii (1990)
82. [hereinafter 1990 Equifax Report] ("[P]rivacy is the claim of individuals to decide what information about themselves will be communicated to others."); Charles Fried, Privacy: Economics and Ethics - A Comment on Posner, 12 Ga. L. Rev. 423, 423 (1978) ("[P]rivacy is to be defined as the control of information about oneself.");
83. Charles Fried, Privacy, 77 Yale. L.J. 475, 493 (1968);
84. Jeffrey H. Reiman, Driving to the Panopticon: A Philosophical Exploration of the Risks to Privacy Posed by the Highway Technology of the Future, 11 Computer & High Tech. L.J. 27, 30 (1995) ("[P]rivacy is the condition in which others are deprived of access to you.");
85. John T. Soma & Richard A. Wehmhoefer, A Legal and Technical Assessment of the Effect of Computers on Privacy, 60 Denv. L.J. 449, 450 (1983) (defining privacy as "the unitary concept of separation of self from society");
86. see also Fred H. Cate, Privacy in the Information Age 19-31 (1997) (canvassing definitions).
87. See, e.g., Jacob Sullum, Secrets for Sale, Reason, Apr. 1992, at 29 ("[T]he amorphous concept of informational privacy, variously described as a right, a concern, an interest, and a preference.").
88. See, e.g., Cathy Goodwin, Privacy: Recognition of a Consumer Right, 10 J. Pub. Pol'y & Marketing 149, 149 (1991).
89. Among privacy statutes regulating commerce (as distinct from statutes governing government-held data) are the Right to Financial Privacy Act, 12 U.S.C. §§ 3401-3422 (1994) (governing bank records), the Fair Credit Reporting Act, 15 U.S.C. §§ 1681-16811 (1994) (governing credit and other reports on consumers), the Video Privacy Protection Act, 18 U.S.C. §§ 2710-2711 (1994) (barring video stores from disclosing information), the Family Educational Rights and Privacy Act (so-called "Buckley Amendment"), 20 U.S.C. § 1232g (1994) (regulating information provided by educational institutions), the Employee Polygraph Protection Act, 29 U.S.C.A. §§ 2001-2009 (West Supp. 1999) (limiting employers' ability to use lie detectors), the Telemarketing Protections Act, 47 U.S.C. § 227 (1994) (limiting use of automatic-dialing machines in telemarketing), and the Cable Communications Policy Act, 47 U.S.C. § 551(a) (1994) (cable television). According to Dorothy Glancy: Legal conceptions of privacy are notoriously uncertain. Within the universe of legal concepts, privacy laws often seem to behave like the fractals in chaos theory - ever-changing in unpredictable but patterned ways. Some years ago, Chief Justice Rehnquist described the privacy cases decided by the United States Supreme Court as "defying categorical description." Professor Arthur R. Miller chose "A Thing of Threads and Patches" as the title of one of the chapters in his influential book, The Assault on Privacy. A federal judge once described privacy law as like a "haystack in a hurricane." Privacy laws seem to have this amorphous quality in part because privacy depends to some extent on each person's expectations regarding respect for her individual personality. Dorothy J. Glancy, Privacy and Intelligent Transportation Technology, 11 Computer & High Tech. L.J. 151, 170-71 (1995); see also Reidenberg, supra note 17, at 209-10 ("Existing federal legislation only addresses privacy concerns in particular industry contexts. Although each of these industry-specific laws contains detailed obligations, they provide a sphere of protection to isolated concerns for narrowly-identified problems and are incomplete responses to information privacy issues.") (footnote omitted). See generally id. at 210-36 for Professor Reidenberg's review of various privacy laws.
90. For example, cable television operators cannot disclose what shows their viewers have watched on Pay-Per-View. See 47 U.S.C. § 551 (1994). The disclosure of credit reports is regulated so that only those who wish to see them for certain purposes may do so. See 15 U.S.C. § 1681b.
91. See 18 U.S.C. § 2710. Or as Vice President Al Gore has said: "We live in a nation where people can get access to your bank account and your medical records more easily than they can find out what movies you rent at the video store." Sheryl G. Stolberg, Privacy Concerns Delay Medical I.D.'s, N.Y. Times, Aug. 1, 1998, at A10.
92. See Schwartz & Reidenberg, supra note 1, at 270. Some states do regulate disclosures by credit card issuers. Thus, Virginia bars merchants from selling "any information gathered solely as the result of any customer payment by . . . credit card." Va. Code Ann. § 59.1-442 (Michie 1992), while California requires credit card issuers to allow credit card holders to opt out of the disclosure of their information. See Cal. Civ. Code § 1748.12 (West 1998); see also infra note 386.
93. Similarly, your cable television company may not lawfully communicate to others what channels you watch under 47 U.S.C. § 551, but nothing prevents your local movie theater from announcing your viewership. Indeed, it is debatable whether federal law prohibits wireless cable service operators or direct broadcast satellite systems operators from disclosing viewing habits. See Privacy and the NII, supra note 4, at 16-17.
94. See, e.g., Murphy, supra note 35; Richard A. Posner, The Right of Privacy, 12 Ga. L. Rev. 393 (1978).
95. See, e.g., Joshua D. Blackman, A Proposal for Federal Legislation Protecting Informational Privacy Across the Private Sector, 9 Computer & High Tech. L.J. 431 (1993); Reidenberg, supra note 17; Reidenberg, supra note 4.
96. See, e.g., Privacy Working Group, Information Infrastructure Task Force, Privacy and the National Information Infrastructure: Principles for Providing and Using Personal Information 6-7 (1995) [hereinafter Privacy and the National Information Infrastructure] (stating that users of information should disclose their purposes).
97. See, e.g., Robert M. Gellman, Can Privacy Be Regulated Effectively on a National Level? Thoughts on the Possible Need for International Privacy Rules, 41 Vill. L. Rev. 129 (1996);
98. P. Amy Monahan, Deconstructing Information Walls: The Impact of the European Data Directive on U.S. Businesses, 29 Law & Pol'y Int'l Bus. 275 (1998). For a thorough discussion of the extent to which U.S. laws meet European standards, see Schwartz & Reidenberg, supra note 1.
99. As one commentator put it, the merchant wishes "to maximize the future streams of revenue from sales while minimizing the future sum of expenses related to producing those sales. Gathering information about the tastes, preferences, and responsiveness of consumers to monetary and other incentives is believed to be critical to the realization of these goals." Gandy, supra note 9, at 88.
100. Some publications provide their list to others as often as 52 times a year. See Karlene Lukovitz, Cashing in on Renting Your List, Folio, Oct. 1985, at 106.
101. See id. at 106 (quoting list manager as saying, "List rentals are almost all gravy.").
102. See Headden, supra note 5, at 45; Smolowe, supra note 17, at 66.
103. See Schwartz & Reidenberg, supra note 1, at 336-37 (stating that pharmaceutical company merged with mail-order pharmacy to obtain latter's detailed records; prescription drug benefits plan manager sought to buy corporation that maintained prescription drug database and owned pharmacies).
104. See generally Sheldon Feldman, The Current Status of the Law Governing Prescreening, Including Permissible Postscreening Practices, 46 Bus. Law. 1113 (1991). Prescreening is now regulated by the Fair Credit Reporting Act, which permits prescreening, subject to certain safeguards, and requires consumer reporting agencies to allow consumers to have their names removed from lists maintained for prescreening. See 15 U.S.C. §§ 1681b(e), 1681m(d) (Supp. IV 1998).
105. See The Supermarket as Selling Machine, 58 Consumer Rep. 560, 560 (1993).
106. See Marx, supra note 36, at 90, 91-92; Mendel-Black & Richards, supra note 30. Mendel-Black and Richards also describe the following: Sharper Image . . . keeps one list of its own 800,000 mail-order buyers and another of 1.2 million people who have shopped at its retail stores. Every 18 months, the company learns considerably more about who these people are by supplying the names to National Demographics & Lifestyles, a Denver outfit with detailed characterizations of 30 million people gleaned from product registration forms returned by buyers. National Demographics matches Sharper Image's customers against names in its own database, then concocts a statistical description. The most recent finding was something like this: The typical Sharper Image buyer is male, between the ages of 45 and 55, with a household income of $70,000. National Demographics then reaches into its database and supplies the retailer with the names of thousands more Americans who fit that description.
107. See, e.g., Foxman & Kilcoyne, supra note 25, at 110 ("Major corporations analyzing and/or renting out purchase information include American Express, Blockbuster Entertainment, Lotus, McDonald's, and Philip Morris."); John Markoff, American Express Goes High-Tech, N.Y. Times, July 31, 1988, § 3 at 1.
108. See Report to the Congress, supra note 27, at 7.
109. See William J. Fenrich, Common Law Protection of Individuals' Rights in Personal Information, 65 Fordham L. Rev. 951, 956 (1996).
110. See Protecting Consumers Against Cramming and Spamming: Hearings Before the Subcomm. on Telecomm., Trade, & Consumer Protection of the House Comm. on Commerce, 105th Cong. 9-104 (1998) [hereinafter Cramming and Spamming Hearings] (testimony of Jerry Cerasale, Senior Vice-President of Government Affairs, Direct Marketing Association, Inc.).
111. See Fenrich, supra note 67, at 956.
112. See Arthur M. Hughes, The Complete Database Marketer 5 (rev. ed. 1996) ("It is and will continue to be the hottest growth area in advertising for the foreseeable future.").
113. See, e.g., Jones v. Federated Fin. Reserve Corp., 144 F.3d 961 (6th Cir. 1998) (involving person who obtained credit report on roommate's ex-spouse); Yohay v. City of Alexandria Employees Credit Union, 827 F.2d 967 (4th Cir. 1987) (involving person who obtained credit report on ex-spouse); Privacy Rights Clearinghouse, Second Annual Report of the Privacy Rights Clearinghouse 40-41 (1995) (describing parents who checked on son's fiancee);
114. Gini G. Scott, Mind Your Own Business 325 (1995) ("[P]eople check up on neighbors, friends, dates, mates, family members, and others."); Chandrasekaran, supra note 17 (describing college students using Lexis-Nexis to check on dates' ages and marital status).
115. See FTC, Session One: Database Study, supra note 21, at 229 (remarks of Bruce Hulme, Legislative Committee Member of National Council of Investigation and Security Services) (describing service that helped locate over 2000 abducted children).
116. See FTC, Public Workshop on Consumer Privacy Session One: Computerized Databases Containing Sensitive Consumer Identifying Information (visited Oct. 6, 1999) 〈http://www.ftc.gov/bcp/privacy/wkshp97/comments1/aces2.htm〉 (remarks of Geraldine Jensen, President, Association for Children for Enforcement of Support, Inc.) (reporting that service has assisted over 25,000 families in locating absent parents who owe child support; average family collected $4000 per year in child support, enabling 88% of clients on welfare to become self-sufficient when child support payments were joined with available earned income).
117. See Rothfeder, supra note 10, at 106-12.
118. For examples, see the stories collected at Switchboard Inc., True Stories About Switchboard Bringing People Together (visited Oct. 6, 1999) 〈http://www.switchboard.com/stories.htm〉; see also Chandrasekaran, supra note 17, at A1; FTC, Session One: Database Study, supra note 21, at 6 (remarks of FTC Chairman Robert Pitofsky) ("[D]atabases have been critical in locating witnesses, tracking down criminals, and even reuniting lost family members.").
119. For a chilling account of the role of computers in the stalking and eventual murder of actress Rebecca Schaeffer, see Rothfeder, supra note 10, at 13-15.
120. See Center for Public Integrity, supra note 32, at 7.
121. See infra notes 369-71 and accompanying text.
122. See Steven A. Bibas, A Contractual Approach to Data Privacy, 17 Harv. J.L. & Pub. Pol'y 591, 599 (1994) ("Many consumers enjoy receiving mailings and shopping at home.").
123. See Equifax-Harris Consumer Privacy Survey 18 (1996) [hereinafter 1996 Equifax Survery]; see also 1990 Equifax Report, supra note 45, at 68 (reporting similar findings; additionally, 16% had made such purchases more than five times); Learning Where to Draw the Line on Privacy Issue, Advertising Age, Feb. 15, 1993, at 35 (quoting DMA representative who stated that over 100 million Americans had shopped at home in some form in previous year).
124. See 1990 Equifax Report, supra note 45, at 68.
125. See Private Ayes, Marketing Tools, Jan.-Feb. 1996, at 31. This number is projected to grow at a rate of 7.2% a year. See Neil Munro, Washington Tech., Putting a Price on Technology (Mar. 6, 1997) 〈http://www.wtonline.com/archive/97-03-06/front_page/putting_link. html〉.
126. See Anthony T. Kronman, The Privacy Exemption to the Freedom of Information Act, 9 J. Legal Stud. 727, 747 (1980);
127. Daniel Klein & Jason Richner, In Defense of That Pesky Junk Mail, Chi. Trib., Apr. 20, 1992, at 19 ("Direct mail is especially important for customers who do not live in a major metropolitan area, or who have a physical or health disability that makes shopping and travel difficult").
128. The argument is presented and criticized in Jerry Kang, Information Privacy in Cyberspace Transactions, 50 Stan. L. Rev. 1193, 1217-18 (1998). Kang argues that if less privacy actually benefited consumers by reducing their junk mail, consumers would choose to surrender their privacy.
129. Those who market through e-mail have been known to adopt such a strategy anyway. One e-mail marketer has reportedly stated, "It's just as cost-effective for me to send to six million e-mail addresses as one million, so why bother?" See Dee Pridgen, How Will Consumers Be Protected on the Information Superhighway? 32 Land & Water L. Rev. 237, 240 (1997);
130. cf. FTC, Public Workshop on Consumer Information Privacy Session Three: Consumer Online Privacy (June 12, 1997) 〈http://www.ftc.gov/bcp/privacy/wkshp97/index.html〉 [hereinafter FTC, Session Three: Online Privacy] (remarks of Jason Catlett, Chief Executive Officer, Junkbusters Corp.) (stating that 10,000 pieces of spam cost one dollar to send).
131. See Foxman & Kilcoyne, supra note 25, at 108; Richard Lacayo, Nowhere to Hide, Time, Nov. 11, 1991, at 37.
132. See Foxman & Kilcoyne, supra note 25, at 108. Response rates to telemarketing are said to be even higher than for direct mail. See Caroline E. Mayer, Telemarketers Just Beginning to Answer Their Calling, Wash. Post, Aug. 31, 1997, at H1.
133. See Kenneth C. Laudon, Markets and Privacy, 39 Comm. of the ACM 92, 103 (1996).
134. See Judith B. Prowda, Privacy and Security of Data, 64 Fordham L. Rev. 738, 751 (1995).
135. See Goodwin, supra note 47, at 159: Since marketing research remains essential to carrying out the marketing concept - developing products and services that meet consumer needs - some intrusion may be necessary to conduct accurate marketing research. For example, obtaining a random sample may require telephone or personal contact with a number of people who are not interested in the product under consideration. If marketing research costs increase substantially due to privacy regulation, all consumers may experience price increases, when in fact only a limited number of people may be concerned about privacy. Some have urged dealing with this problem by having different rules for marketing research than for conventional marketing. See Robert E. Shaw, Telemarketing: Its Impact on the Research Industry in the United States, Eur. Res., May 1987, at 78.
136. See, e.g., David J. Klein, Comment, Keeping Business out of the Bedroom: Protecting Personal Privacy Interests from the Retail World, 15 J. Marshall J. Computer & Info. L. 391, 393 n.10 (1997) ("Some companies can offer discounts on their goods when they utilize personality profile lists, because they send fewer mail advertisements, and they send them only to those persons who are likely to purchase the product").
137. See Headden, supra note 5, at 42, 44.
138. See Smolowe, supra note 17, at 65.
139. See id. at 63.
140. See Goodwin, supra note 47, at 159 ("[S]mall business owners in Alaska claimed they need access to tourism mailing lists to carry out successful promotion and promote entrepreneurial development"); What Price Privacy?, supra note 30, at 359 ("The direct mail chief at one of the nation's largest catalog houses says that by using more sophisticated mailing lists, his company has been able to cut its annual mailings by 25% and increase the response rate too. 'For us,' he says, 'that spells the difference between making a solid profit or closing our doors.'").
141. Some also claim that mail-order selling reduces damage to the environment because it enables people to shop without traveling. See Bibas, supra note 79, at 600; Prowda, supra note 89, at 751; Klein & Richner, supra note 83, at 19. But see infra note 120 and accompanying text for argument that direct-mail solicitations damage the environment.
142. See Goodwin, supra note 47, at 159 ("Protection of consumer privacy may inadvertently harm other segments of society. . . . Also, telemarketers create jobs and shopping opportunities for the handicapped . . . as well as development of depressed rural areas.").
143. See Foxman & Kilcoyne, supra note 25, at 108.
144. See Richard A. Posner, An Economic Theory of Privacy, Regulations, May/June 1978, at 19;
145. Richard A. Posner, Privacy, Secrecy, and Reputation, 28 Buff. L. Rev. 1 (1979);
146. Posner, supra note 53. The first of these pieces was commented on by a variety of scholars in the same issue of the Georgia Law Review. A series of papers applying a law and economics approach to the right to privacy also appears at Symposium: The Law and Economics of Privacy, 9 J. Legal Stud. 621-842 (1980), with a brief introduction by Judge Posner.
147. Posner, supra note 53, at 394.
148. Id. at 399. In a later piece, Judge Posner wrote that the desire to protect against embarassment also motivates privacy, and is more worthy of legal protection. See Richard A. Posner, Privacy, in 3 The New Palgrave Dictionary of Economics and the Law 103, 105 (1998).
149. Priscilla M. Regan, Legislating Privacy 48 (1995).
150. See Edward J. Bloustein, Privacy Is Dear at Any Price: A Response to Professor Posner's Economic Theory, 12 Ga. L. Rev. 429, 442 (1978).
151. It may be that Posner's fundamental error arises out of his attempt to distinguish privacy as an 'instrumental' value from privacy as a 'final' value. . . . [P]rivacy is so integrally and inextricably related to the maintenance of personal dignity, an 'ultimate' or 'final' social value of extraordinary importance, that the law must also protect privacy. Id.; see also Anthony D'Amato, Comment: Professor Posner's Lecture on Privacy, 12 Ga. L. Rev. 497, 499 (1978).
152. See Alan F. Westin, Privacy and Freedom 8-11 (1967).
153. See Fried, Privacy, supra note 45, at 477 ("[Privacy] is necessarily related to ends and relations of the most fundamental sort: respect, love, friendship and trust. . . . [W]ithout privacy they are simply inconceivable."). For a discussion of the philosophical underpinnings of privacy doctrine, see Regan, supra note 102, at 24-33.
154. See Cathy Goodwin, A Conceptualization of Motives to Seek Privacy for Nondeviant Consumption, 1 J. Consumer Psychol. 261 (1992) ("Qualitative data suggest that consumers seek privacy to enhance the quality of the consumption experience, to avoid interference from disapproving reference groups, and to resolve cognitive discomfort associated with self-discrepancy.").
155. Arthur R. Miller, The Assault on Privacy 48-49 (1971).
156. See supra note 37 and accompanying text.
157. See Privacy and the NII, supra note 4, at 3 ("[A]n individual may want to keep certain types of health data confidential from the general public because its disclosure could cause the person embarrassment"). According to Anthony Kronman: Why are people ever embarrassed when their interests are revealed to others who share the same interests? Perhaps disclosure awakens feelings of shame or guilt: the other person's knowing wink is a reminder of what one wishes to forget. Alternatively, the disclosure of a sensitive fact about oneself, even to someone who happens to be sympathetic, may raise a fear that the same information will be revealed to others who are not sympathetic or approving. Anthony T. Kronman, The Privacy Exemption to the Freedom of Information Act, 9 J. Legal Stud. 727, 746-47 (1980) (footnote omitted) (emphasis in original).
158. Reidenberg, supra note 4, at 498. For a discussion of the role of dignity in privacy, see Kang, supra note 84, at 1259-65.
159. Murphy, supra note 35, at 2386.
160. See Goodwin, supra note 47, at 152.
161. See Hal R. Varian, Economic Aspects of Personal Privacy, in Privacy and Self-Regulation in the Information Age (visited Oct. 6, 1999) 〈http://www.ntia.doc.gov/reports/privacy/selfreg1.htm〉.
162. See Privacy and the NII, supra note 4, at 3. Another explanation offered for the importance of informational privacy is that withholding information from others makes it possible to attain greater intimacy with selected individuals by sharing secrets with them. See Fried, Privacy, supra note 45.
163. See Mark Lewyn, You Can Run, But It's Tough to Hide from Marketers, Bus. Week, Sept. 5, 1994, at 60 (family of police officer).
164. See Edmund Mierzwinski, Data Dealers Seizing Control of Our Lives, 19 At Home with Consumers 4 (1998) ("[U]nrestricted sale of credit headers is one of the main causes of financial identify theft[,] . . . a growing crime that leaves up to 40,000 or more consumers each year fighting to clear their names and correct their credit reports after thieves establish fraudulent credit accounts in their names.").
165. For example, the Federal Trade Commission has promulgated a regulation providing consumers solicited in the home a three-day cooling-off period in which to rescind any purchases. See 16 C.F.R. § 429.1 (1999). Some states have enacted similar statutes. See, e.g., N.Y. Pers. Prop. Law § 425 (West 1998). Some states have even enacted such statutes for telephone sales; a list appears in Dee Pridgen, Consumer Credit and the Law app. 15A (1994).
166. See Smolowe, supra note 17, at 63.
167. See id. at 67.
168. See id. at 64.
169. See Evan Hendricks, Capital Insights, Privacy Times, Dec. 15, 1997, at 1.
170. See Cramming and Spamming Hearings, supra note 68 (testimony of Randall Boe, Associate General Counsel, America Online, Inc.).
171. See FTC, Public Workshop on Consumer Information Privacy Session Two: Consumer Online Privacy (June 12, 1997) 〈http://www.ftc.gov/bcp/privacy/wkshp97/index.html〉 [hereinafter FTC, Session Two: Consumer Online Privacy I] (remarks of Jill A. Lesser, Deputy Director, Law and Public Policy, America Online, Inc.); see also id. at 75 (remarks of Colleen M. Kehoe, Graduate Student, Georgia Institute of Technology) (reporting that 74% of respondents to survey disagreed strongly that they liked receiving mass e-mailings);
172. Center for Democracy & Tech., Preliminary Comments to the Federal Trade Commission on Unsolicited Commercial E-mail (June 2, 1997) 〈http://www.ftc.gov/bcp/privacy/wkshp97/comments2/votele.htm〉 (responding to question, "What do you think of unsolicited commercial e-mail?", 47 said it "is an overall good," 2196 described it as "a problem," and 214 called it "overblown as an issue").
173. See FTC, Session Two: Consumer Online Privacy I, supra note 123, at 48 (remarks of Jill A. Lesser, Deputy Director, Law and Public Policy, America Online, Inc.); see also id. at 64 (remarks of Shabbir J. Safdar, Founder, Voters Telecommunications Watch) (reporting that nonrepresentative survey of Internet users found that for about one-third of those surveyed, spam made up one-quarter of e-mail).
174. See Cramming and Spamming Hearings, supra note 68, at 4 (testimony of Paula Selis, Senior Counsel, Consumer Protection Division, Washington State Attorney General's Office); see also Voters Telecomm. Watch, Final Comments to the FTC on Unsolicited Commercial Email, (visited Aug. 21, 1998) 〈http://www.ftc.gov/bcp/privacy/wkshp97/comments2/ftcfilin.htm〉 [hereinafter Final Comments] (reporting that of over 2700 people surveyed, 2228 stated that unsolicited commercial e-mail cost them long-distance or other telephone toll charges; 481 reported that their Internet service provider charges them for connect time while they are downloading or reading mail; 76 claimed that their Internet service provider charged them by the byte to download mail; and 726 stated that they incurred other costs).
175. See, e.g., FTC, Privacy Online, supra note 39, at 43 ("If growing consumer concerns about online privacy are not addressed, electronic commerce will not reach its full potential."); Mark E. Budnitz, Privacy Protection for Consumer Transactions in Electronic Commerce: Why Self-Regulation Is Inadequate, 49 S.C. L. Rev. 847, 851 (1998);
176. John V. Swinson, Confidentiality on the Superhighway, Am. Law., Dec. 1995, at 23;
177. Amy Harmon, F.T.C. to Call for Laws to Protect Children Online, N.Y. Times, June 4, 1998, at D1;
178. Evan Hendricks, E-Commerce & Privacy, Privacy Times, May 29, 1998, at 10 (remarks of Madeline Mooney, Vice-President, Lycos Inc.).
179. But see Peter P. Swire & Robert E. Litan, None of Your Business 88 (1998) ("Polling data and personal intuition support the argument that people will engage in more electronic commerce if they believe their privacy will be protected. Any such increases may be offset by the decreases in commerce that can occur because of interference with the free market.").
180. See Cramming and Spamming Hearings, supra note 68. (statement of the FTC on consumer privacy) ("A substantial number of online consumers would rather forego information or products available through the Web than provide a Web site personal information without knowing what the site's information practices are."); see also Evan Hendricks, House Hearing Covers Self-Regulation, Encryption, Privacy Times, Apr. 3, 1998, at 2, 3;
181. Evan Hendricks, Internet Users Want New Privacy Laws, Survey Finds, Privacy Times, Jan. 2, 1997, at 4, 5;
182. Letter of Jerry Herman & Deirdre Mulligan, Executive Director and Staff Counsel, Center for Democracy & Tech., to FTC (visited Oct. 6, 1999) 〈httpy/www.ftc.gov/bcp/privacy/wkshp97/comments2/demotech.htm〉; eTRUST, Comments of eTRUST Concerning Consumer On-Line Privacy (visited Oct 6, 1999)
183. 〈http://www.ftc.gov/bcp/privacy/wkshp97/comments2/etrust.htm〉; Family PC, Kids' Safety & Parental Guidance Clearinghouse (visited Oct. 6, 1999)
184. 〈http://www.zdnet.com/familypc/ content/kidsafety/results/html〉.
185. See Alan F. Westin, "Whatever Works": The American Public's Attitudes Toward Regulation and Self-Regulation on Consumer Privacy Issues, in Privacy and Self-Regulation in the Information Age, (visited Oct 6, 1999) 〈http://www.ntia.doc.gov/reports/privacy/selfreg1.htm〉 [hereinafter Westin, Whatever Works]. That number has increased slowly but steadily. For example, in 1994, 84% of those surveyed stated that they were concerned, up from 79% in 1990 and 77% in 1983.
186. See Equifax-Harris Mid-Decade Consumer Privacy Survey 17 (1995) [hereinafter Equifax Mid-Decade Survey]; 1990 Equifax Report, supra note 45, at 2. The 1995 figure was 82%. See Equifax Mid-Decade Survey, at 17. Similarly, one 1998 survey found that 87% of computer users were concerned.
187. See Alan F. Westin & Danielle Maurici, E-Commerce & Privacy: What Net Users Want 7 (1998).
188. Similarly, another survey conducted in the same year found that 88% of consumers were concerned. See Executive Summary: 1998 Privacy Concerns and Consumer Choice Survey (visited Dec. 17, 1998) 〈http://www.privacyexchange.org/iss/surveys/1298execsum.html〉 [hereinafter 1998 Executive Summary].
189. The Cambridge Reports surveys, conducted in 1988 and 1989, found that more than two-thirds of the respondents considered personal privacy "very important" and nearly a quarter called it "somewhat important." James E. Katz & Annette R. Tassone, Public Opinion Trends: Privacy and Information Technology, 54 Pub. Opinion Q. 125, 135, 139-40 (1990).
190. More than two-thirds of those queried were either "very concerned" or "somewhat concerned" about invasion of their personal privacy. Id. A poll by Money magazine found that 74% of the public are somewhat or very concerned about threats to their privacy, while 65% are more worried about their privacy than they were five years ago. See Ann Reilly Dowd, Money Poll: You're Deeply Worried About Your Privacy, Money, Aug. 1, 1997, at 107.
191. Westin, Whatever Works, supra note 128, at 56 (71% in 1990; 80% in 1995; 83% in 1996).
192. 1990 Equifax Report, supra note 45, at 7.
193. See Mary J. Culnan, Consumer Awareness of Name Removal Procedures: Implications for Direct Marketing, 9 J. Direct Marketing 10, 11 (1995) (describing survey conducted by Yankelovich Partners, Inc.).
194. See FTC, Privacy Online, supra note 39, at 6.
195. See id. Another survey, albeit one that used a sample which was not representative of the public at large, found 93% of the respondents believed the collection of personal information from children to be very serious. See Mark S. Ackerman et al., AT&T Labs, Beyond Concern: Understanding Net Users' Attitudes About Online Privacy (visited Apr. 19, 1999) 〈http://www. research.att.com/library/trs/TRs/99/99.4/99.4.3/report.htm〉.
196. See Harris-Equifax Consumer Privacy Survey 19 (1991) [hereinafter 1991 Equifax Survey].
197. 1998 Executive Summary, supra note 128.
198. See 1990 Equifax Report, supra note 45, at 26.
199. Id. at 44. When asked if they agree that "when people apply for a credit card, the company issuing the credit card should be able to check on their credit and credit card records," 94% said, "Yes." Id.
200. See Harris-Equifax Consumer Privacy Survey 5 (1992).
201. See 1990 Equifax Report, supra note 45.
202. See id. at xxv.
203. See id.
204. See id. at xxv-xxvi.
205. See FTC, Public Workshop on Consumer Information Privacy Session Two: Consumer Online Privacy (June 11, 1997) 〈http://www.ftc.gov/bcp/privacy/wkshp97/index.html〉 [hereinafter FTC, Session Two: Consumer Online Privacy II] (remarks of Humphrey Taylor, Chairman and Chief Executive Officer, Louis Harris & Associates, Inc.).
206. See Dowd, supra note 129 (stating that 80% of women are concerned about threats to their privacy, while only 68% of men are similarly concerned).
207. See 1990 Equifax Report, supra note 45, at 18.
208. See id.
209. See Beth Negus, You're Not Welcome; Direct Survey Has Alarming Findings About 'Junk' Views and Data Protection, Direct, June 15, 1996, at 1, 60 (reporting that 27% were not at all concerned, 23% were slightly concerned, 24% were somewhat concerned, and 25% were greatly concerned).
210. See id. at 61. Of the 62% of consumers who said they favor restrictions on data use, more than three-quarters would still favor such laws even if it meant they would not receive catalogs or mail about things that interest them. See id. at 64; see also 1990 Equifax Report, supra note 45, at 28 (reporting that when consumers were asked how they would feel if they could not receive at-home mail offers or catalogs geared to their interests, 14% replied that they would be very upset, 25% somewhat upset, 23% would not be very upset, and 38% would not be upset at all).
211. 1996 Equifax Survey, supra note 80, app. A at 8. In 1991, 46% saw mail offers as a nuisance, 38% rarely used them but did not see a problem, and 6% regarded them as useful. See id.; 1991 Equifax Survey, supra note 135, at 16-17.
212. See 1996 Equifax Survey, supra note 80, at 84.
213. See 1990 Equifax Report, supra note 45, at 30.
214. See FTC, Session Two: Consumer Online Privacy II, supra note 144, at 10 (remarks of Humphrey Taylor, Chairman and Chief Executive Officer, Louis Harris & Associates, Inc.); see also Alan F. Westin et al., Commerce, Communication, and Privacy Online 23 (1997); Ackerman et al., supra note 134 (reporting that 52% of unrepresentative sample found unsolicited commercial e-mail very serious); Final Comments, supra note 125.
215. See 1996 Equifax Survey, supra note 80, at 71.
216. See 1990 Equifax Report, supra note 45, at 85. Similarly, a poll of 342 chief information officers found that, in their personal use of the Internet, 60% were not willing to give up their privacy in exchange for added customer value or convenience. See CIO Comm., Inc., CIOs Grapple with Double Standard on Internet Privacy Regulations (visited Apr. 13, 1999) 〈http://www.cio.com/ knowpulse/perspectives99〉.
217. See 1996 Equifax Survey, supra note 80, at 13.
218. See id.; see also Westin, Whatever Works, supra note 128.
219. See 1996 Equifax Survey, supra note 80, at 13.
220. See id. at 13-14; Westin, Whatever Works, supra note 128.
221. 1990 Equifax Survey, supra note 45, at 69. Another poll found 67% of respondents concerned about the sale of personalized marketing lists and 69% concerned about Internet companies soliciting information about their family's buying habits. See Dowd, supra note 129. Still another found that 68% of consumers regard the collection and distribution of data to marketing companies as a serious invasion of privacy. See Culnan, supra note 132, at 11.
222. See 1990 Equifax Report, supra note 45, at 69. Consumers were told: Businesses marketing goods and services directly to consumers are now able to buy from mailing list-making companies information about your consumer characteristics - such as your income level, residential area, and credit card use - and use such information to offer goods and services to you. Do you feel this is a good or bad thing? Id. Consumers who replied that it is a bad thing were then asked: "How concerned are you about this - are you very concerned, somewhat concerned, not very concerned, or not at all concerned?" Id. Similarly, an American Express telephone survey found that 80% of all Americans think that companies should not give out personal information to other companies. See Mary G. Jones, Privacy: A Significant Marketing Issue for the 1990s, 10 J. Pub. Pol'y & Marketing 133, 139 (1991).
223. See 1990 Equifax Report, supra note 45, at 71-72. Consumers were told: Increasingly, companies are marketing goods and services directly to people by mail. Some reasons for this trend are that many people have less time to shop or they prefer to make shopping decisions at home. Also, companies are trying to reduce their costs of advertising and selling in stores, and they find direct marketing can reduce their expenses and their product prices. Companies try to learn which individuals and households would be the most likely buyers of their products or service. They buy names and addresses of people in certain age groups, estimated income groups, and residential areas with certain shopping patterns so they can mail information to the people they think will be most interested in what they are selling. Do you find this practice acceptable or unacceptable? Id.
224. For a discussion of prescreening, see supra note 62 and accompanying text.
225. See 1990 Equifax Report, supra note 45, at 70. Consumers were asked: Some companies want to identify consumers with a certain income and a good credit history, to send them an offer for a premium credit card or a product They ask credit reporting bureaus to screen their computerized files for those who meet the requirements and then supply just the consumer's name and address. However, they do not get the consumer's advance permission. Do you feel this practice is acceptable or is not acceptable? Id. Just 23% of the respondents answered that the practice was acceptable, while 76% found it unacceptable. See id.
226. See 1990 Equifax Report, supra note 45, at 74-75. Consumers were asked: Credit card issuers also market directly to consumers. To make sure they send information only to people who qualify, they ask credit bureaus to tell them which individuals meet their credit standards before they send a credit offer. Is this practice acceptable or unacceptable to you? Id. When put this way, 66% found the practice acceptable and 32% called it unacceptable. See id.
227. When Equifax asked about prescreening again in 1996, in connection with insurance, just over half the public found it "very" or "somewhat" acceptable while another quarter found it "not at all acceptable." 1996 Equifax Survey, supra note 80, at 11.
228. See Westin, Whatever Works, supra note 128. Other fair information practices include limiting the uses of the information to the broad area of consumer activity the individual is knowingly involved in; allowing consumers opportunities to examine and correct the information; and adopting rules to keep information confidential and secure. For findings supporting Westin's conclusion, see 1990 Equifax Report, supra note 45, at 73, which asked consumers who found the sale of mailing lists unacceptable whether the sale could be made acceptable if people who did not want to receive these offers by mail could have their names excluded. Of those asked, 88% said that would make the practice acceptable, while only 10% said it would still be unacceptable. The same surveyers asked consumers who found prescreening unacceptable whether it would be acceptable if people who did not want to be offered credit cards by mail could ask not to have their names and addresses used for this kind of screening. Of the respondents, 89% would then see it as acceptable while 9% continued to view it as unacceptable. See 1990 Equifax Report, supra note 45, at 76. The 1996 Equifax/Harris Privacy Survey found that about nine out often consumers found it acceptable for companies to use credit report information to decide which consumers to send preapproved offers of insurance to, provided that the consumers had the chance to opt out of the mailing lists. By contrast, only about half found the practice acceptable if consumers could not opt out. See 1996 Equifax Survey, supra note 80.
229. See Evan Hendricks, Latest Poll Shows Public Concern over Privacy Continues to Surge, Privacy Times, Nov. 19, 1991, at 7. Another poll showed a lower percentage, though still a majority of 60%, of consumers object to the sale of mailing lists without permission. See Cuban, supra note 132, at 11.
230. See Dowd, supra note 129.
231. See Eli M. Noam, Privacy and Self-Regulation: Markets for Electronic Privacy, in Privacy and Self-Regulation in the Information Age (visited Oct. 6, 1999) 〈http://www.ntia.doc.gov/reports/ privacy/selfreg1.htm〉.
232. See 1990 Equifax Report, supra note 45, at 13.
233. Id.; see also Foxman & Kilcoyne, supra note 25, at 115 (describing voter whose personal information was used as a result of voting as saying: "I have voted in every election since I was 18, and I think [this] was the last election I'll ever vote in.").
234. See FTC, Privacy Online, supra note 39, at 3; see also 1998 Executive Summary, supra note 128 (reporting that 78% of consumers "say they have refused to give information to a business or company because they thought it was not really needed or was too personal").
235. See Equifax Mid-Decade Survey, supra note 128, at 3.
236. See 1990 Equifax Report, supra note 45, at 15.
237. See Mendel-Black & Richards, supra note 30; Sullum, supra note 46, at 28, 29.
238. Sullum, supra note 46, at 29.
239. See Mendel-Black & Richards, supra note 30. Mendel-Black and Richards elaborated on "Marketplace: Households": Information for the disc was gleaned from 40 different sources, including the U.S. Census, Internal Revenue service, Postal Service and surveys taken at 8,500 shopping centers and retailers nationwide. As one of the country's largest credit bureaus, Equifax has also drawn on its own records, which contain specific information about a person's marital status, sex, age range and likely income level. . . . The most sensitive information - estimated income and lifestyle - is blended with that of nearby households to build a general profile for each neighborhood. And a user would not be able to seek out a specific person. In other words, a user could not look up John Q. Smith on Aurora Drive, but Smith's name and address would pop up as part of a larger group of people fitting a certain profile. The companies say this and other measures will help protect privacy. Id. Consumer Reports, working with a demonstration disc, reported that the program allowed users to limit searches to particular streets or even certain buildings, and that depending on the attributes searched, lists could have fewer than ten households on them. See What Price Privacy?, supra note 30, at 360. In the end, consumers may have scored an incomplete victory. Other CD-ROM products are available, and a competitor of Equifax, Experian (formerly TRW), has announced plans to produce a product similar to "Marketplace: Households." See Mary J. Culnan, Self-Regulation on the Electronic Frontier: Implications for Public Policy, in Privacy and Self-Regulation in the Information Age (visited Oct. 6, 1999) 〈http://www.ntia.doc.gov/reports/privacy/selfreg1.htm〉.
240. See, e.g., Hendricks, supra note 121 (reporting that Lexis-Nexis dropped plan to make consumer Social Security numbers available to subscribers after complaints); Evan Hendricks, Capital Insights, Privacy Times, May 2, 1996, at 1 (reporting that after receiving complaints, Database America and Yahoo! deleted 90 million unlisted numbers from what was to be compilation of 175 million names and addresses);
241. Pac Bell Backs Off Selling Lists, Alameda Times Star, Apr. 16, 1986, at 6 (reporting that company reversed decision to sell customer names and addresses after receiving more than 75,000 customer protests);
242. Seth Schiesel, America Online Backs Off Plan to Give Out Phone Numbers, N.Y. Times, July 25, 1997, at D1 (reporting that company abandoned plan to provide lists of customers' phone numbers to telemarketers and others within 24 hours after plan became widely known and consumers complained).
243. See R.H. Coase, The Problem of Social Cost, 3 J.L. & Econ. 1 (1960).
244. In Richard A. Epstein's words: The law may create any distribution of entitlements that it chooses, be it wise or foolish. In the next instant, all the relevant parties can enter into as many transactions as they please and thereby correct any ostensible misallocations created by the legal order. No matter how Byzantine the legal system's initial rules, private parties and government actors collectively can cut the Gordian knot and in a twinkling move resources to their highest-valued use. Richard A. Epstein, Holdouts, Externalities, and the Single Owner: One More Salute to Ronald Coase, 36 J.L. & Econ. 553, 555 (1993).
245. See id. at 558 ("In principle, if the transactions costs between the two parties were low enough (zero is always low enough), then B [individuals] would be able to pay A [the firms] some sum of money to alter those activities that would leave both parties better off than they would be in the absence of that bargain.").
246. See Murphy, supra note 35, at 2413 (suggesting that merchants could purchase rights from consumers by price differentiation; that is, by charging consumers who withheld permission to use their personal information higher price than consumers who granted permission).
247. Coase's theorem has elicited critical academic discussions, some of which are referred to in Christine Jolis et al., A Behavioral Approach to Law and Economics, 50 Stan. L. Rev. 1471, 1483 (1998).
248. Perhaps the most prominent of these services is Private Citizen, Inc. A website operated by Consumer Net lists several companies which provide these services. The website is at 〈http://consumer.net/optout/consumerfee.asp〉 (visited Oct. 6, 1999);
249. see also Scott, supra note 71, at 321. Florida has a system in which its residents can pay $10 to have telemarketers told not to call them. Annual renewals cost five dollars. See Fla. Stat. Ann. § 501.059(3)(a) (West Supp. 1999). Two years after the system's inauguration, 25,000 Floridians had paid the initial fee. See William M. Bulkeley, Congress's 'Cure' for Junk Calls Faces a Skeptical FCC, Wall St J., May 19, 1992, at B6.
250. See Schwartz & Reidenberg, supra note 1, at 333 (noting that American Express and Citibank notify cardholders each year that they may opt out); Goodwin, supra note 47, at 157.
251. See Letter from Michael D. McNeely, Assistant Director, Bureau of Competition, FTC, to Robert L. Sherman, Paul, Hastings, Janofsky & Walter LP (Sept. 9, 1997) 〈http://www.ftc.gov/ os/1997/9710/dma.htm〉 [hereinafter McNeely Letter]. The Direct Marketing Association also maintains a list of consumers who object to telemarketing calls.
252. See Anne W. Branscomb, Who Owns Information? 15 (1994). Ultimately, New York Telephone abandoned its plan to sell the list because of consumer opposition. See Privacy and the NII, supra note 4, at 7 n.26.
253. See Regan, supra note 102, at 233. In the fall of 1997, Maryland adopted a system in which drivers could block access to their information. By March 1, 1998, 646,000 (or about 17% of the state's 3.8 million drivers) had opted out See Chandrasekaran, supra note 17, at A1; see also Lukovitz, supra note 58, at 106 ("Publishers interviewed by FOLIO uniformly reported that very few readers take advantage of the option to not have their names rented; CBS, for instance, gets such requests from under 2 percent of subscribers."); Laurie Peterson, The Great Privacy Debate, ADWEEK - W. Advertising News, Sept 23, 1991, at 24 ("Studies show that when given the choice, fewer than 10% of consumers will ask to receive no more catalogs."); FTC, Session Two: Consumer Online Privacy I, supra note 123, at 40 (remarks of Jill A. Lesser, Deputy Director, Law and Public Policy, America Online, Inc.) (reporting that about half a million members of AOL have opted out).
254. My guess is that it is more than just an assumption. That is, I suspect that the companies that sell women's clothing have found that they will sell more if they send their catalogs to people who buy children's clothing from catalogs.
255. Others have discussed the pain direct marketers can unwittingly cause. See, e.g., Larson, supra note 4, at 11, 83-86, 204-05 (predicting that solicitations would be sent to families that had lost children given child-mortality rates; author told one magazine that imaginary person in his household was expectant mother; imaginary person subsequently received dozens of mailings, including more than one hundred offers; advice columnist described "sadness, shattered feelings, family rifts, grief, doubt, and devastation" caused by direct-mail ads which included handwritten notes from direct mailer suggesting recipient try anti-aging creams, diet pills and the like; notes confused recipient into thinking someone they knew had sent them direct mailer's ads); Privacy Rights Clearinghouse, supra note 71, at 24 (reporting instance where junk mail was still sent to person six years after death; woman who miscarried received baby-related catalogs two years later); R.J. Ignelzi, Mail and Telejunk, San Diego Union-Trib., July 4, 1995, at E1 (reporting that woman who had miscarriage received for years solicitations that assumed birth of baby, including birthday cards).
256. See 1996 Equifax Survey, supra note 80; cf. Information Issues: Intellectual Property, Privacy, Integrity, Interoperability, and the Economics of Information, 48 Fed. Comm. L.J. 5, 41 (1995) [hereinafter Information Issues] (remarks of Ellen Kirsh, Vice-President and General Counsel, America Online, Inc.) ("I think that if people are given the choice, there is some information that they'd like to get. If you don't want Publisher's Clearinghouse, maybe there are things that you would like people to send to you, if there is some reasonable way to do that, that could turn out to be a good thing for everyone.").
257. Similarly, the 1991 Harris-Equifax Consumer Privacy Survey found that 64% of respondents would choose to have their names removed from some lists, 22% from all lists, and 13% from no lists. See 1991 Equifax Survey, supra note 135, at 18-19.
258. See 1996 Equifax Survey, supra note 80.
259. See Westin et al., supra note 153, at 23 ("If a procedure were available to block their e-mail addresses from product and service offers, 37% of Internet and online service users who send or receive e-mail would want their addresses blocked from all offers. A large group (50%) would want their address blocked from some offers, and the smallest group (12%) would not want their addresses blocked at all.") (emphasis in original).
260. See Regan, supra note 102, at 49.
261. See id.
262. See Dottie Enrico, Dollars and Dialers; Phone Company's Plan to Sell Names Stirs Controversy, Newsday, June 11, 1990, at 3.
263. See Mary J. Culnan, "How Did they Get My Name?": An Exploratory Investigation of Consumer Attitudes Toward Secondary Information Use, 17 MIS Q. 341, 357 (1993) (finding 78% of participants unaware of procedures to allow mailing list removal); 1996 Equifax Survey, supra note 80 ("The percentage of people who report being aware of any procedures that allow one to remove one's name from direct mail lists for catalogs, products, and services has remained constant from 1991 to the present at 44%."); 1991 Equifax Survey, supra note 135, at 18; see also Westin et al., supra note 153, at 23 (finding 57% of computer users aware of procedures that allow them to remove names from direct mail lists for catalogs, products and services, and 25% of online service and Internet users who send or receive e-mail aware of procedures for removing their e-mail addresses from lists held by companies that send e-mail offers).
264. See 1996 Equifax Survey, supra note 80. One study found that people who were not aware of name-removal procedures were more concerned about privacy. Those people felt, however, that having the opportunity to opt out is less important than did those who were aware of similar procedures. See Culnan, supra note 132, at 14-15.
265. See Jones, supra note 161, at 139.
266. See Smith, supra note 4, at 4 (describing study that finds "consumers tend to be quite uninformed regarding the actual [privacy] policies and practices of industries with which they deal regularly"); Frank V. Cespedes & H. Jeff Smith, Database Marketing: New Rules for Policy and Practice, Sloan Mgmt. Rev., Summer 1993, at 7,8 ("Our interviews with consumers . . . suggest that they are still largely unaware of how information about them is gathered and used.");
267. Simson L. Garfinkel, How Computers Help Target Buyers, Christian Sci. Monitor, July 25, 1990, at 13 (quoting Bonnie Guiton, Special Advisor for Consumer Affairs to President George Bush, as saying: "A major concern of mine is that consumers are uninformed. . . . In most cases, they don't even know that (information on them) is being collected."); O'Harrow, supra note 13, at A1 (quoting Leslie L. Byrne, former director of the Office of Consumer Affairs, as saying: "[M]ost people don't have a clue what's being gathered about them."); Ticked off at Amex, USA Today, May 26, 1992, at 10A (describing consumer who assumed that personal data provided to credit card companies and other lenders was protected by business ethics code);
268. Privacy Rights Clearinghouse, First Annual Report (visited Oct 6, 1998) 〈http://www.privacyrights.org/ar/annrept.html〉 ("Most [consumers] are unaware of the ways in which personal information is . . . used and distributed."); Westin, Whatever Works, supra note 128 (describing 1997 survey concerning online privacy survey that "found that 71% of respondents online were not aware of their services' information policies . . . and that most visitors to web sites were not aware of the policies those sites followed in collecting visitors' personal information"). Peter Swire has pointed out that consumer ignorance of company use of their personal information may have significant costs: "Because the company internalizes the gains from using the information, but can externalize a significant share of the losses, it will have a systematic incentive to over-use private information. In terms of the contract approach, companies will have an incentive to use private information even where the customers would not have freely bargained for such use."
269. Peter P. Swire, Markets, Self-Regulation, and Government Enforcement in the Projection of Personal Information, in Privacy and Self-Regulation in the Information Age (visited Oct. 6, 1999) 〈http://www.ntia.doc.gov/reports/privacy/selfreg1.htm〉.
270. This lack of awareness by consumers creates other problems as well. For example, because consumers do not know what information is collected about them, they cannot correct errors in that information. See Reidenberg, supra note 4, at 534.
271. See Smith, supra note 4, at 4; see also O'Harrow, supra note 13, at A1 ("That obfuscation is sometimes intentional, according to Maryalice Hurst, former chairman of the Direct Marketing Association's ethics committee. Some companies 'go behind the customers' back to acquire what they know the customer wouldn't give them,' Hurst said.").
272. Smith, supra note 4, at 4.
273. See Paul M. Schwartz, Privacy and the Economics of Personal Health Care Information, 76 Tex. L. Rev. 1, 49 (1997).
274. A number of studies have found that increased comparison shopping by consumers leads to lower market prices. See, e.g., Brian F. Blake et al., The Impact of Comparative Food Price Information on Consumers and Grocery Retailers: Some Preliminary Findings of a Field Experiment, 16 J. Consumer Aff. 224 (1982);
275. Kenneth McNeil et al. Market Discrimination Against the Poor and the Impact of Consumer Disclosure Laws: The Used Car Industry, 13 L. & Soc'y Rev. 695, 708-09 (1979);
276. J. Edward Russo et al. An Effective Display of Unit Price Information, 39 J. Marketing 11 (1975);
277. see also William N. Eskridge, Jr., One Hundred Years of Ineptitude: The Need for Mortgage Rules Consonant with the Economic and Psychological Dynamics of the Home Sale and Loan Transaction, 70 Va. L. Rev. 1083, 1111-12 n.96 (1984);
278. Phillip Nelson, Information and Consumer Behavior, 78 J. Pol. Econ. 311 (1970);
279. Steve Salop, Information and Market Structure: Information and Monopolistic Competition, 66 Am. Econ. Ass'n Rev. 240 (1976) ("[I]f information is costly, each small firm obtains market power, and the equilibrium (if one exists) is characterized by prices above competitive levels.");
280. Charles Stuart, Consumer Protection in Markets with Informationally Weak Buyers, 12 Bell J. Econ. 562 (1981);
281. E. Thomas Sullivan & Brian A. Marks, The FTC's Deceptive Advertising Policy: A Legal and Economic Analysis, 64 Or. L. Rev. 593, 620 (1986) ("The courts, the Commission, and legal commentators have recognized that the lack of product information leads to market imperfections, abuse and reduced consumer welfare.").
282. But see Leon Courville & Warren H. Hausman, Warranty Scope and Reliability Under Imperfect Information and Alternative Market Structures, 52 J. Bus. 361, 373 (1979) (stating that "inaccurate information does not necessarily imply poor market results" based on economic model that makes questionable assumption that consumers maximize perceived expected utility).
283. See Schwartz, supra note 206, at 49.
284. Cf. Fair Packaging and Labeling Act, Pub. L. No. 89-755, 80 Stat. 1296 (1966) (codified at 15 U.S.C. §§ 1451-1461 (1994)) ("Informed consumers are essential to the fair and efficient functioning of a free market economy."); FTC Labeling and Advertising of Home Insulation Rule, 44 Fed. Reg. 50,218, 50,223 (1979) ("An essential element of effective competition is the availability of information that consumers need to evaluate competing products and to make the best possible choices."); Virginia Bd. of Pharmacy v. Virginia Citizens Consumer Council, 425 U.S. 748, 765 (1976) (stating that "the free flow of commercial information is indispensable" to free enterprise economy).
285. Enid Nemy & Ron Alexander, Metropolitan Diary, N.Y. Times, May 4, 1998, at B2.
286. See Meheroo Jussawalla & Chee-Wah Cheah, The Calculus of International Communications: A Study in the Political Economy of Transborder Data Flows 80 (1987);
287. Sandra B. Petersen, Your Life as an Open Book: Has Technology Rendered Personal Privacy Virtually Obsolete?, 48 Fed. Comm. L.J. 163, 165 (1995). Swire argues: It is a daunting prospect for an individual consumer to imagine bargaining with a distant Internet marketing company or a huge telephone company about a desired privacy regime. To be successful, bargaining would likely require a considerable degree of expertise in privacy issues, as well as a substantial commitment of time and effort. The cost of this elaborate bargaining process is likely to exceed the incremental benefit in privacy to that citizen. Swire, supra note 202.
288. Branscomb, supra note 188, at 11.
289. See Privacy Rights Clearinghouse, supra note 71, at 25; see also G. Bruce Knecht, Junk-Mail Hater Seeks Profits from Sale of His Name, Wall St. J., Oct. 13, 1995, at B1 (describing consumer who for years has requested companies to delete his name from their mailing lists but still receives one to seven solicitation letters each day).
290. See Mayer, supra note 87.
291. Reidenberg, supra note 4, at 533.
292. See Swinson, supra note 126, at 23.
293. See Dowd, supra note 7, at 110: Spammers often punish those who try to opt out of getting unsolicited e-mail by "flaming" them - sending them nasty messages online, sometimes in overwhelming numbers. Just ask David Aronson, a Dulles, Va. software engineer and outspoken spam critic. On top of the 20-odd spams he receives at work and home on an average day, Aronson showed MONEY a stream of filthy utterly unprintable flames from someone who described himself as a "gay atheist commie spammer." Warns Aronson: Never, ever reply directly to spammers. It tells them your e-mail address is valid. They will sell it, and you'll get more spam. Id.; see also FTC, Session Two: Consumer Online Privacy I, supra note 123, at 11 (remarks of Jason Catlett, Chief Executive Officer, Junkbusters Corp.) (stating that some spammers "actually maintain their own pseudo-remove addresses but simply use the results as an additional source of addresses to spam").
294. See Amy Harmon, How to, Well, Eat Less Spam, N.Y. Times, May 7, 1998, at G8.
295. See Allison Fahey, DMA Speaks to Consumers, Advertising Age, Apr. 9, 1990, at 63.
296. See Dowd, supra note 7, at 110 ("[M]any of the worst offenders are, naturally, not DMA members."); What Price Privacy?, supra note 30, at 360 ("[S]hady operators are usually not [Direct Marketing A]ssociation members."); Electronic Privacy Info. Ctr., Comments of the Electronic Privacy Information Center Concerning Children's Privacy (visited Oct. 6, 1999) 〈http://www.ftc.gov/bcp/privacy/wkshp97/comments3/epic3.html〉 [hereinafter EPIC Comments] (noting that self-proclaimed largest bulk advertising e-mailer in country is not member of DMA).
297. See McNeely Letter, supra note 187.
298. See Nora Carrera, One Man's Junk Is Another's Mail, Rocky Mountain News, Sept 25, 1995, at 38A.
299. See Schwartz & Reidenberg, supra note 1, at 333 (citing Mary J. Culnan, Consumer Attitudes Toward Secondary Information Use, Privacy and Name Removal: Implications for Direct Marketing, Paper Presented at Chicago/Mid-West Direct Marketing Days (Jan. 20, 1993)).
300. See Headden, supra note 5, at 42, 48; see also Ignelzi, supra note 191 ("It takes between two and six months to have your name and address removed from mailers' lists.").
301. EPIC Comments, supra note 220; see also Lewyn, supra note 115, at 60 (stating that consumers who use DMA list say their names come off some, but not all lists); Beth Givens, Privacy Rights Clearinghouse, Consumer Privacy 1997 - Comments (visited Oct. 6, 1999) 〈http://www.ftc. gov/bcp/privacy/wkshp97/comments2/sess2com.htm〉 ("Does the [DMA list] work? From the standpoint of callers to the PRC's hotline who have used the [DMA list], the answer is 'no.' Consumers see little to no reduction in volume of unsolicited mail after registering with the [DMA]. The only category of mail for which the [DMA] has any noticeable effect is catalog mail.").
302. See Schwartz & Reidenberg, supra note 1, at 333.
303. Lewyn, supra note 115, at 60, 61 (quoting Evan Hendricks of Privacy Times).
304. See Direct Mktg. Ass'n, Fair Information Practices Manual § 2, at 25 (1994); see also Judith Waldrop, The Business of Privacy, Am. Demographics, Oct 1994, at 46 (quoting Keith Wardell of Buyer's Choice Media).
305. See supra note 192 and accompanying text; see also Waldrop, The Business of Privacy, supra note 228, at 46 (quoting Keith Wardell of Buyer's Choice Media as saying: "[W]hat most consumers really mean when they opt out is that there are certain things they want and certain things they don't want. The customer wants to have more control than an absolute on-and-off switch.").
306. See Equifax-Harris Consumer Privacy Survey 6-7 (1994) [hereinafter 1994 Equifax Survey]. For companies that offer products or services through the mail, 47% of respondents were not at all confident and 31% were not very confident; the comparable figures for those companies making telephone offers were 54% and 29%; only 5% and 4% were very confident in the use of information by these companies. See id.; see also 1990 Equifax Survey, supra note 45, at 20-21 (reporting that 64% of public had low degree of trust in how companies solicit people by direct mail or telephone collect and use personal information; consumers were more willing to trust every other industry asked about, with the percentage of consumers who had low degree of trust ranging from 18% for hospitals to 39% for credit bureaus). Another survey, conducted by Direct, a trade publication for direct marketers, found that 56% of consumers think direct marketers are generally less honest than other businesses. See Negus, supra note 148, at 64.
307. See FTC, Session Three: Online Privacy, supra note 85, at 157-58 (remarks of Alan Westin, Editor and Publisher, Privacy and American Business; Professor, Columbia University).
308. See Knecht, supra note 213 (quoting Eli Noam, Professor of Finance and Economics at Columbia University, as saying: "It is true that the costs go up when people can call to remove their names, but the lists that result would be much more selective. . . . Rather than bombarding people with piles of uninvited mail, companies would focus on the people they really want to reach.").
309. This is not unusual. See Privacy Rights Clearinghouse, supra note 71, at 24 (reporting that person who died six years ago still receives direct mail ads); Widows & Widowers Newsl., Sept 25, 1998 (on file with author) (reporting that deceased people still receiving mailings).
310. My wife's death occasioned an obituary in the New York Times on August 10, 1995. If they wish to, marketers could keep up with obituaries just as they keep up with birth announcements. For a discussion of how marketers learn about and respond to births, see David Zielinski, Database: The Heart of Relationship Marketing, 27 Potentials in Marketing 66, 67 (1994) (reporting that diaper manufacturer knows names of over 75% of expectant mothers in United States; obtained information from doctors, hospitals, and childbirth trainers). See generally Larson, supra note 4.
311. See Ann Cavoukian & Don Tapscott, Who Knows: Safeguarding Your Privacy in a Networked World 179 (1997) ("Treating your customers with respect and recognizing their right to privacy will not only improve customer service but may also create a loyal following, which in turn will boost the bottom line."); Reidenberg, supra note 4, at 533 ("[B]usiness is beginning to grasp that better standards for fair information practice can be a competitive advantage and will be necessary for business survival.").
312. At least two businesses have voluntarily decided to use an opt-in system: the Microsoft Network, commonly known as MSN, and USA Today. See Cavoukian & Tapscott, supra note 235, at 69-70,94-95.
313. See Scott, supra note 71, at 322.
314. See Munro, supra note 82; Paulette Thomas, 'Clicking' Coupons On-Line Has a Cost: Privacy, Wall St. J., June 18, 1998, at B1 (100,000 consumers signed up in first three months to receive coupons in return for personal information); cf. infra note 368 and accompanying text.
315. See Swire, supra note 202. Similarly, a credit card company now includes in its solicitations a statement that it will not sell customer names to other companies. See John N. Frank, The Brouhaha over Privacy, Credit Card Mgmt., May 1996, at 32, 33; see also Knecht, supra note 213 (reporting that American Express, Citicorp, and Dow Jones & Co. allow consumers to opt out because of companies' desire not to upset their customers). Richard Murphy has collected two examples of companies which conspicuously tell consumers that they do not sell their mailing lists. One is Radio Shack, which posts signs to that effect near its cash registers. See Murphy, supra note 35, at 2413-14 nn.165 & 166.
316. Cf. Kang, supra note 84, at 1248 ("For numerous reasons . . . individuals and information collectors do not generally negotiate and conclude express privacy contracts.").
317. In some market sectors, in which all service in a particular geographical area is provided by a single seller - as is common with utilities and cable TV providers, for example - competition of any sort, including competition on privacy, may not exist, because there are no alternative service providers. See Privacy and the NII, supra note 4, at 20. That problem may be solvable by regulation, however, just as other problems created by the necessarily monopolistic nature of some service providers are solved.
318. Jones, supra note 161, at 139; see also Kang, supra note 84, at 1255 ("Providing a menu of privacy options, with the necessary detail to comprehend them, would draw attention to unsavory privacy practices that the collector may not want to highlight."); Murphy, supra note 35, at 2414 ("Raising the privacy issue may evoke negative reactions in consumers who otherwise would not have thought about the issue.").
319. Mary Jones notes too that consumers are not in a position to verify claims that information is in fact secure. In addition, Jones observes, businesses typically do not use a practice mandated by regulation as a promotional tool. Among the examples she cites are statutorily required consumer benefits like unit pricing, full warranties, full disclosures in product descriptions, affirmative disclosures in product descriptions, and ingredient listings. See Jones, supra note 242, at 139.
320. See, e.g., E. Patrick McGuire, Industrial Product Warranties: Policies and Practices 10 (1980) (describing study of 369 manufacturers that found 57% did not advertise warranty terms, for such reasons as terms are too complex, lengthy, and extraneous to seller's main advertising goals);
321. Ian Ayres & F. Clayton Miller, "I'll Sell It to You at Cost": Legal Methods to Promote Retail Markup Disclosure, 84 Nw. U. L. Rev. 1047, 1055-56 (1990) (reporting that car dealers do not disclose markups even though different dealers use different markups and consumers pay third parties for markup information).
322. See Gary Levin, DMA to Battle Tougher Privacy Laws, Advertising Age, Nov. 2, 1992, at 15 (noting that DMA President Jonah Gitlitz urged DMA members to adopt opt-out policy to stave off threat of legislation).
323. See Schwartz & Reidenberg, supra note 1, at 309 n.5, 332; Foxman & Kilcoyne, supra note 25, at 113; Evan Hendricks, DMA Will Raise $2.6 Million War Chest to Fight U.S. & State Privacy Measures, Privacy Times, Apr. 22, 1992, at 2.
324. For a discussion of DMA's motivation in starting opt-out lists, see Alan F. Westin & Michael A. Baker, Databanks in a Free Society; Computers, Record-Keeping and Privacy 166 (1972).
325. See, e.g., Organization for Econ. Cooperation & Dev., Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1981); Canadian Standards Ass'n, Model Code for the Protection of Personal Information (1996); Privacy Protection Study Comm'n, Personal Privacy in an Information Society (1977); Privacy and the National Information Infrastructure, supra note 55; U.S. Dep't of Health, Educ. & Welfare, Records, Computers and the Rights of Citizens (1973).
326. See FTC, Privacy Online, supra note 39, at 7, 8.
327. However, by including only the names of those consumers who wish to receive mailings, and who are thus presumably more open to direct marketing purchases, the companies may make their lists more valuable. Whether the list ultimately increases or decreases in value is a function of whether list purchasers will increase what they pay per name for a "pruned" list enough to compensate for the loss of the names, as well as a function of how many consumers actually opt out, how many do not opt out, and the costs of administering the opt-out program. See supra note 232 and accompanying text.
328. See, e.g., FTC, Session Two: Consumer Online Privacy II, supra note 144, at 223 (remarks of Martin Nisenholtz, President, New York Times Electronic Media Co. and Coalition for Advertising Supported Information and Entertainment) (noting that when subscribers ask Times to implement its web site privacy policy, Times incurs costs of around $5 per person to do so).
329. See D'Amato, supra note 103, at 501 (suggesting that magazine publishers could institute two-tiered subscription price: those who do not want their names sold would pay more); see also Foxman & Kilcoyne, supra note 25, at 109 ("One possible solution to this particular ethical dilemma would be to offer consumers a choice of paying interest that reflects the full costs of granting credit or allowing the personal information they provide to be used for unrelated, money-generating purposes to defray some of the costs of granting credit.").
330. Cf. Karl Dentino, Taking Privacy into Our Own Hands, Direct Marketing, Sept 1994, at 38, 40: Offer opt-out, but carefully. . . . [O]pt-out programs can be a double-edged sword. Ask someone if they want to stop getting phone calls - when 99 out of 100 are not relevant - and what answer do you think you'll get? It's human nature to overlook the offers you do respond to and find of interest. So there's an unconscious classification that happens, and profitable, responsive people might say "no" without really meaning it. To complicate things further, the people who select the opt-out option might be the most responsive segment of your customer base, A person who goes through the physical act of reading the opt-out offer and responding accordingly is a person who takes the time to read and throughtfully consider direct mail offers.
331. Cf. William C. Whitford, The Functions of Disclosure Regulation in Consumer Transactions, 1973 Wis. L. Rev. 400, 436-37 (discussing possibility that one purpose of consumer regulation is to create illusion that law is pro-consumer without actually helping consumers).
332. See Avery Katz, The Strategic Structure of Offer and Acceptance: Game Theory and the Law of Contract Formation, 89 Mich. L. Rev. 215, 225 (1990).
333. Id.
334. Id. at 226.
335. Under the Cable Communications Policy Act of 1984, as amended by the Cable Television Consumer Protection and Competition Act of 1992, 47 U.S.C. §§ 521-558 (1994), cable television companies may not sell their subscriber lists unless they give subscribers the opportunity to opt out. See generally Michael I. Meyerson, The Cable Communications Policy Act of 1984: A Balancing Act on the Coaxial Wires, 19 Ga. L. Rev. 543, 615-17 (1985).
336. See Richard E. Nisbet & Lee Ross, Human Inference: Strategies and Shortcomings of Social Judgment 45 (1980);
337. Jonathan Shedler & Melvin Manis, Can the Availability Heuristic Explain Vividness Effects?, 51 J. Personality & Soc. Psychol. 26 (1986);
338. Margaret G. Wilson et al., Information Competition and Vividness Effects in On-Line Judgments, 44 Organizational Behav. & Hum. Decision Processes 132 (1989). A story makes the point even more clearly: Some years ago, federal regulation required a bank to send its customers a mailing explaining their rights concerning electronic fund transfers. Perhaps mischievously, the bank promised in 100 of the pamphlets that it would send $10 to any customer who sent in his or her name and address on a sheet of paper with the word "regulation." No one responded to the promise.
339. See Alan Schwartz & Robert E. Scott, Commerical Transactions: Principles and Policies 1142 (2d ed. 1991).
340. See Nisbet & Ross, supra note 258, at 51; Robert E. Gehring et al., Recognition Memory for Words and Pictures at Short and Long Retention Intervals, 4 Memory & Cognition 256 (1976);
341. Roger N. Shepard, Recognition Memory for Words, Sentences, and Pictures, 6 J. Verbal Learning & Verbal Behav. 156 (1967).
342. See, e.g., John C. Bergstrom & John R. Stoll, An Analysis of Information Overload with Implications for Survey Design Research, 12 Leisure Sci. 265 (1990);
343. Kevin L. Keller & Richard Staelin, Effects of Quality and Quantity of Information of Decision Effectiveness, 14 J. Consumer Res. 200, 211 (1987);
344. Naresh K. Malhotra, Information Load and Consumer Decision Making, 8 J. Consumer Res. 419 (1982). For a critical analysis of the Keller & Staelin study,
345. see Robert J. Meyer & Eric J. Johnson, Information Overload and the Nonrobustness of Linear Models: A Comment on Keller & Staelin, 15 J. Consumer Res. 498 (1989).
346. Keller and Staelin's response appears at Assessing Biases in Measuring Decision Effectiveness and Information Overload, 15 J. Consumer Res. 504 (1989).
347. For law review discussions of information overload, see Melvin Eisenberg, Text Anxiety, 59 S. Cal. L. Rev. 305 (1986);
348. David M. Grether et al., The Irrelevance of Information Overload: An Analysis of Search and Disclosure, 59 S. Cal. L. Rev. 277 (1986);
349. Robert E. Scott, Error and Rationality in Individual Decisionmaking: An Essay on the Relationship Between Cognitive illusions and the Management of Choices, 59 S. Cal. L. Rev. 329 (1986).
350. See, e.g., Katz, supra note 254, at 273.
351. Schwartz & Reidenberg, supra note 1, at 280.
352. Id.
353. See N.Y. Gen. Oblg. Law § 5-702 (McKinney 1989) (requiring consumer agreements to be "[w]ritten in a clear and coherent manner using words with common and every day meanings"). Arguably, the Plain Language Law does not apply to the Privacy Notice because the statute governs only written agreements, and the Notice may not be an agreement Still, properly construed, the Plain Language Law should have some persuasive effect on virtually all documents for consumers.
354. The Flesch Reading Ease score was 28; the scale ranges from zero (hardest) to 100 (a fourth grade level). Scores between zero and 30 are considered to require a college education or more. By contrast, the Flesch Reading Ease score for this Article is 42.8. The Flesch-Kincaid Grade Level required for comprehension of the Privacy Notice was 15.1, higher than the 12.4 Grade Level of this Article.
355. Cf. Charles D. Raab et al., Application of a Methodology Designed to Assess the Adequacy of the Level of Protection of Individuals with Regard to Processing Personal Data: Test of the Method on Several Categories of Transfer 161 (1998) ("[S]ome companies that offer an opt-out require consumers to send a letter separately from an order and to a different address.").
356. 15 U.S.C.A. § 1681a(d)(2)(A)(iii) (West Supp. 1999). The sharing of personal information among corporate affiliates could be particularly significant for companies with subsidiaries serving different consumer markets. One writer has raised, for example, the possibility of Citibank declining mortgage applications because of information provided a Travelers' insurance agent, now that the two companies have merged, or a consumer receiving a solicitation from Quick & Reilly, a brokerage house, because the consumer made a large deposit in a Fleet Bank account, given that Fleet owns Quick & Reilly. See Leslie Wayne, Privacy Matters: When Bigger Banks Aren't Better, N.Y. Times, Oct. 11, 1998, § 4 at 4.
357. Wayne, supra note 267, § 4 at 4.
358. Id.
359. Office of the Comptroller of the Currency, U.S. Treasury Dep't, Remarks by Julie L. Williams, Acting Comptroller of the Currency. Before the Banking Roundtable Lawyers Council (May 8, 1998) 〈http://www.occ.treas.gov/ftp/release/98%2D50a.txt〉;
360. see also Office of the Comptroller of the Currency, U.S. Treasury Dep't, Remarks by Julie L. Williams. Acting Comptroller of the Currency, Before the Consumer Bankers Association (Oct. 26, 1998) 〈http://www.occ.treas.gov/ftp/release/98-109a.txt〉.
361. See Larson, supra note 4, at 90; David J. Klein, Note, Keeping Business out of the Bedroom: Protecting Personal Privacy Interests from the Retail World, 15 J. Marshall J. Computer & Info. L. 391, 398 (1997) ("List creators generally place [opt-out provisions] in the fine print with other boilerplate terms of the contracts; thus the clause is not readily apparent to most consumers.") (footnotes omitted); Lewyn, supra note 115, at 60, 61; Privacy Rights Clearinghouse, supra note 71, at 27.
362. See FTC, Session Three: Consumer Online Privacy, supra note 85, at 218. Mary E. Fise, General Counsel of Consumer Federation of America, remarked: While a few attempts are being made in this area, for the most part, we found disclosure to be in small print. In many cases, it was written in legalese and it was placed not near the information collection area, but rather was accessible on a link contained on the first page of the site. We had also recommended last year that whenever possible that disclosure be audible to the child and in no case did we ever find that to be the case now. While we didn't find adequate disclosure for children and their parents, we did find lots of other kinds of disclosure[,] . . . particularly on limitations on liability. Id.
363. More recently my cable company republished its privacy notice in a brochure titled "Your Cable Equipment and Services." The brochure runs 20 pages, and the privacy notice - the last item in the booklet - begins on page 17 and concludes on page 20. The brochure arrived in an envelope with the bill and pay-per-view listings. The privacy notice is preceded in the text by sections headed "Credit for Service Outage," "Complaint Procedures for Non-Billing Disputes," and "Employee Identification."
364. See also Waldrop, supra note 228, at 48 (quoting Georgetown University Professor Mary Cuban's statement, made at 1994 DMA meeting, that "fifty percent of catalogers don't give their customers a convenient way to remove their names from the company's list").
365. George S. Day, Assessing the Effects of Information Disclosure Requirements, J. Marketing, Apr. 1976, at 42,47; see also Eskridge, supra note 207, at 1163-64.
366. Although the ABA form is a substantial improvement over the cable company notice, it is still subject to criticism. The notice appears at the end of a two-page form. Unlike other questions on the form, it is not numbered, and so readers short on time (and what lawyer is not) may not realize immediately that it calls for a decision. Another model comes from a form - the product of an agreement between American Express and the New York Attorney General's Office. In 1992, they entered into an Agreement of Voluntary Assurances under which American Express agreed to notify its cardmembers "in a clear, conspicuous and understandable manner" in a form of at least ten-point type, with a heading that was printed either in boldface or a different color from the remainder of the notice, that they had a right to opt out of American Express mailing lists by writing or calling a toll-free number. A copy of the agreement is reproduced at American Express/New York Attorney General Agreement Announced, PR Newswire, May 13, 1992.
367. The field has its own journal - the Journal of Consumer Satisfaction, Dissatisfaction and Complaining Behavior. A bibliography updating scholarship in this field was published in the Journal in 1993 and contained 1700 entries. See 6 J. Consumer Satisfaction, Dissatisfaction & Complaining Behav. 217 (1993). The leading article is Arthur Best & Alan R. Andreasen, Consumer Response to Unsatisfactory Purchases: A Survey of Perceiving Defects. Voicing Complaints, and Obtaining Redress, 11 L. & Soc'y Rev. 701, 712 (1977) (reporting that only 30.7% of consumers perceiving problems voice complaints).
368. See E. Scott Maynes, Consumer Problems in Market Economies, in Encyclopedia of the Consumer Movement 158-59 (Stephen Brobeck ed., 1997).
369. See id. at 158.
370. Id. at 163; cf. Howard Latin, "Good" Warnings, Bad Products, and Cognitive Limitations, 41 UCLA L. Rev. 1193, 1216 (1994) ("Once it is recognized that decisionmaking capacities are limited and that people have many competing demands made on their time and attention, the failure of consumers to read some product warnings becomes foreseeable and inevitable.").
371. Maynes, jupra note 278, at 158-59.
372. Negative-option purchases are regulated by the FTC. See 16 C.F.R. § 425.1 (1999).
373. Bruce A. Craig, Negative-Option Billing: Understanding the Stealth Scams of the '90s, 7 Loy. Consumer L. Rep. 5, 6 (1994);
374. see also Meg Cox, For the Nation's Troubled Book Clubs, Main Selection of This Year Is Change, Wall St. J., July 24, 1992, at B1 ("[R]eceiving main selections [members] don't want but have forgotten to cancel is one of the most annoying aspects of book clubs.").
375. The FCC examined 50 cases of positive-option offers and 22 cases of negative-option offers. See FCC, Inside Wire Survey (July 18, 1988). The FCC study is no longer available, but is discussed in Dennis D. Lamont, Comment, Negative Option Offers in Consumer Service Contracts: A Principled Reconciliation of Commerce and Consumer Protection, 42 UCLA L. Rev. 1315, 1330-31 (1995);
376. see also Owen R. Phillips, Negative Option Contracts and Consumer Switching Costs, 60 S. Econ. J. 304, 305 (1993) ("[U]nder a negative option . . . in the Rocky Mountain region, about 75% of the customers did not deny the service and so received it. In the Northwest where a positive option was required to begin the service, about 75% of the telephone customers did not respond and so did not receive it").
377. See William Walker, NDP Set to Ban Negative Billing and Cable Subscribers Could Get a Break, Toronto Star, Feb. 24, 1995, at A3;
378. see also Ian Austen, Rogers Demands Dismantling of Stentor, Calgary Herald, Jan. 27, 1995, at D14 (reporting cable company official predicted lower number of subscribers unless negative option used);
379. Robert Brehl, Rogers TV Woes Don't Hit Shares, Toronto Star, Jan. 7, 1995, at C2 (reporting that cable company forecasts "dramatically" fewer subscribers if negative option not used).
380. See Kathy Clayton, Subs to TCI: We Want Our $1 Encore, Cable World, July 1, 1991, at 1, 20.
381. See 38 Fed. Reg. 4896, 4902 (1973) (regarding use of negative-option plans by sellers in commerce). The FTC cautioned, however, that "some of these same parties stated that such an assumption was based on opinion since they had never fully operated a positive option system." Id. It declined to find that negative-option selling is inherently unfair in that it relies, in substantial part, on exploitation of subscribers' natural preoccupations with or diversions to more important or pressing personal affairs, and on traits of human character such as procrastination or forgetfulness in order to impose liability upon subscribers for merchandise which subscribers may not want and have taken no affirmative steps to obtain. Id. In so doing, the Commission took into account the claims of industry representatives that consumers joining book and record clubs were familiar with club procedures. See id. at 4902-03.
382. See Craig, supra note 283, at 8.
383. Id. at 9. If a merchant configures a negative-option offering that remains below consumer and enforcement levels of concern, and if that offering is made to a large customer base that will be billed regularly, negative-option billing has the potential to provide substantial additional income to the billing merchant Id.
384. See Westin & Maurici, supra note 128, at 34 (reporting 79% of computer users, 80% of Internet users, and 76% of Internet purchasers prefer privacy self-regulation to government regulation of Internet, and feel that government should regulate only if self-regulation fails); Westin, Whatever Works, supra note 128 (finding that in 1995, 72% of public preferred good voluntary privacy policies by business, if those are provided, over legislation; in 1997, 70% of survey respondents favored voluntary privacy policies over government regulation but 58% of survey respondents wanted legislation to protect online privacy now).
385. See, e.g., Banking Indus. Tech. Secretariat, The Bankers Roundtable, Privacy Principles Implementation Plan 2; Direct Mktg. Ass'n, Inc., Direct Marketing Association Guidelines for Ethical Business Practice 13; Interactive Serv. Ass'n, Principles on Notice and Choice Procedures for Online Information Collection and Distribution by Online Operators; Letter from Donald D. Kummerfeld, President, Magazine Publishers of Am., to Donald Clark, Secretary, FTC (Mar. 31, 1998); Smart Card Forum, Guide to Responsible Consumer Information Practices; Letter from Kerry C. Stackpole, President & Chief Executive Officer, Electronic Messaging Ass'n, to Robert Pitofsky, Chairman, FTC (Mar. 31, 1998). These documents are reproduced in FTC, Privacy Online, supra note 39. See also Evan Hendricks, Advertisers Unveil 'Goals 'for Electronic Privacy, Privacy Times, Feb. 15, 1996, at 3; Evan Hendricks, Bankers Issue 'Best Practices' Guidelines for Customer Data, Privacy Times, Dec. 17, 1996, at 4 (discussing Consumer Bankers Association guidelines).
386. See Rajiv Chandrasekaran, Direct Marketing Group Adopts New Guidelines; Rules Are an Attempt to Avoid Intervention by Federal Regulators, Wash. Post, Oct. 16, 1997, at C3. The DMA had previously taken the position that marketers should notify consumers of the uses to which their information might be put and provide consumers with an opportunity to opt out. See Privacy and the NII, supra note 4, at 23-24.
387. See Cramming and Spamming Hearings, supra note 68 (testimony of Jerry Cerasale, Senior Vice-President, Direct Marketing Association).
388. See FTC, Self-Regulation & Privacy Online: A Report to Congress (1999).
389. See Jeri Clausing, Group Proposes Voluntary Guidelines for Internet Privacy, N.Y. Times, July 21, 1998, at D4;
390. Robert O'Harrow, Jr., Firms Prepare Plan for Protecting Privacy on Internet, Wash. Post, June 20, 1998, at D3. The Alliance's website is at 〈http://www.privacyalliance.org〉.
391. See Industry Hopes Seal-of-Approval Programs Will Meet Privacy Self-Regulation Challenge, 67 U.S.L.W. 2396, 2397 (Jan. 12, 1999) [hereinafter Seal-of-Approval Programs] (reporting 424 sites licensed by TRUSTe, including all major Internet portal sites and 45 of top 100 Internet sites; to qualify for TRUSTe seal, web site must display privacy policy, notify consumers what information is collected, who is collecting it, how information will be used, insure security of personal information, and provide mechanism for correcting errors).
392. TRUSTe's web site is at 〈http://www.truste.org〉.
393. TRUSTe was recently criticized by privacy advocates for failing to audit Microsoft, one of its biggest donors, after Microsoft was accused of collecting consumer data surreptitiously. TRUSTe did scold Microsoft. See Jeri Clausing, On-Line Privacy Group Decides Not to Pursue Microsoft Case, N.Y. Times, Mar. 23, 1999, at C5.
394. See Seal-of-Approval Programs, supra note 296, at 2397. To earn a BBB seal, participants must disclose to visitors to the site, among other things, the type of information collected, the methods available to consumers to correct erroneous information, and whether the information is merged with other information obtained from third parties. The Better Business Bureau's program web site is at 〈http://www.bbbonline.org〉.
395. See Culnan, supra note 39, at 7.
396. See Online Privacy Alliance, Senate Judiciary Committee Holds Internet Privacy Hearing (visited OcL 6, 1999) 〈http://www.privacyalliance.org/news/04211999_test/ibm_written.shtml〉 (statement of Dr. Irving Wladawsky-Berger, General Manager, Internet Section, IBM Corp.).
397. See Evan Hendricks, FTC-Industry Pact: Major Step Forward, or Deal with the Devil?, Privacy Times, Jan. 2, 1997, at 1, 2.
398. See, e.g., S. 2326, the Children's Online Privacy Protection Act of 1998: Hearings on S. 2326 Before the Subcomm. on Communications of the Senate Comm. on Commerce, Science, & Transp., 105th Cong. (1998) (testimony of Kathryn Montgomery, President, Center for Media Education) ("[T]he absence of a certifying seal is too subtle a means of educating Internet users."); Schwartz & Reidenberg, supra note 1, at 217; Mark E. Budnitz, Privacy Protection for Consumer Transactions in Electronic Commerce: Why Self-Regulation Is Inadequate, 49 S.C. L. Rev. 847, 874 (1998) ("[T]he presence of great diversity in [the online] industry makes universal participation [by marketers] unlikely."); Culnan, Self-Regulation on the Electronic Frontier, supra note 178 (arguing that self-regulation has been ineffective because rules have not been applied equally to all firms within industry and because data compilers do not have direct contact with consumers); FTC, Session One: Database Study, supra note 21, at 188 (remarks of Beth Givens, Project Director, Privacy Rights Clearinghouse); id. at 319 (remarks of Evan Hendricks, Editor and Publisher, Privacy Times) ("There has been a long history of failure of self-regulation meeting privacy concerns in this country going back to . . . [the] late 1970s."); FTC, Session Two: Consumer Online Privacy II, supra note 144, at 152 (remarks of Russ Smith, Publisher, Consumer.Net); id. at 175 (remarks of Jean Ann Fox, Director of Consumer Protection, Consumer Federation of America; Vice-President, Consumers Union) ("[S]elf-regulatory efforts and voluntary guidelines are very positive and useful, but not sufficient There are always bad actors that don't comply with the best efforts of the leaders in the industry."); id. at 188 (remarks of Leslie L. Byrne, Director, Office of Consumer Affairs) ("I am not convinced that self-regulatory schemes do much in terms of enforcement or anything other than give appearance of doing something to hold the wolves from the door."); Pasnik & Fise, supra note 42.
399. But see Robert J. Posch, Jr., Keep the Privacy Debate in Context, Direct Marketing, May 1, 1997, at 1 (stating that DMA's self-regulation "has always proved successful.");
400. Fred H. Cate, Privacy in the Information Age 108 (1997) (arguing that critiques are misplaced and fail to reflect recent successes of self-help model);
401. Lisa Rosenthal, The IRSG Principles: A Promising Self-Regulatory Program to Curb Misuse of Non-Public SSNs, 19 At Home with Consumers 3 (1998) ("[S]elf-regulation is more prompt, flexible, and effective than government regulation [and] can bring the accumulated judgment and experience of an industry to bear on issues that may be difficult for the government to define with bright-line rules.").
402. See supra note 223 and accompanying text.
403. Schwartz & Reidenberg, supra note 1, at 217.
404. See id.
405. See id. at 338-39; see also FTC, Session One: Database Study, supra note 21, at 288 (remarks of Robert Biggerstaff, who has 30 years of experience in the database field) ("I know people personally who have followed up with complaints and complained time and time again and are basically told eventually that DMA doesn't take any action against their people, they have no ability to take any action against their members."). But see Direct Marketing Association, Inc., Supplemental Comments of the Direct Marketing Association, Inc. (July 6, 1997), in Public Workshop on Consumer Information Privacy 〈http://www.ftc.gov/bcp/privacy/wkshp97/ comments2/dma027a.htm〉 (stating that DMA will refer non-complying members to DMA Committee on Ethical Business Practice which publishes compilation of cases it reviews).
406. See Schwartz & Reidenberg, supra note 1, at 309.
407. See id. at 338-39.
408. For a discussion of the relative merits of self-regulation and government regulation in the privacy context, see Swire, supra note 202.
409. See Electronic Privacy Info. Ctr., Surfer Beware II: Notice Is Not Enough (visited Oct. 6, 1999) 〈http://www.epic.org/reports/surfer-beware2.html〉.
410. Id. (quoting Patricia Faley, Vice-President of Consumer Affairs, Direct Marketing Association, Inc.).
411. See Culnan, supra note 39, at 8.
412. See Evan Hendricks, Look-Up Service Spokesman Doubts Efficacy of FTC-Industry Agreement, Privacy Times, Mar. 6, 1998, at 1, 2.
413. See In re GeoCities, FTC File No. 9823015 (1998); Evan Hendricks, FTC, GeoCities Settle Internet Privacy Case, Privacy Times, Aug. 14, 1998, at 2-3. The consent decree can be found at 〈http://www.ftc.gov/os/1998/9808/geo-ord.htm〉 (visited Sept. 24, 1998).
414. See 47 C.F.R. § 64.1200(e)(2) (1999).
415. See Evan Hendricks, Telemarketers Accused of Ignoring Junk Phone Law, Privacy Times, June 12, 1998, at 5-6;
416. see also William M. Bulkeley, Congress's Cure for Junk Calls Turns into Skepticism at the FCC, Wall St. J., May 19, 1992, at B6 (reporting that consumers on Florida's "don't call" list who continue to receive unsolicited calls took their names off list).
417. See Kang, supra note 84, at 1272.
418. See, e.g., FTC Truth-in-Lending Rescission Regulation, 12 C.F.R. § 226.15(b) (1999); FTC Holder-in-Due-Course Regulation, 16 C.F.R. § 433.2 (1999).
419. See, e.g., Arthur Young & Co., Warranties Rules: Warranty Content Analysis 36 (1979); Jacqueline Schmitt et al., Impact Report on the Magnuson-Moss Warranty Act 16, 18, 19 (1980); Michael J. Wisdom, Note, An Empirical Study of the Magnuson-Moss Warranty Act, 31 Stan. L. Rev. 1117, 1145 (1979).
420. See generally Robert L. Jordan & William D. Warren, Disclosure of Finance Charges: A Rationale, 64 Mich. L. Rev. 1285, 1320-22 (1966);
421. Homer Kripke, Gesture and Reality in Consumer Credit Reform, 44 N.Y.U. L. Rev. 1, 5-8 (1969); Whitford, supra note 253.
422. See supra notes 267-70 and accompanying text.
423. See Pub. L. No. 90-321, 82 Stat. 146 (1968) (codified as amended at 15 U.S.C. §§ 1601-1693 (1994)).
424. See Michael M. Greenfield, Consumer Law 229 (1995); Pridgen, supra note 117, § 4.01 at 4-2.
425. See, e.g., Pridgen, supra note 117, § 4.01 at 4-1 to 4-2 ("[T]he disclosures were overly burdensome to creditors and too cumbersome to be of much use to the average consumer.").
426. See Pub. L. No. 96-221, 94 Stat. 168 (1980). See generally Ralph J. Rohner, Truth in Lending "Simplified": Simplified?. 56 N.Y.U. L. Rev. 999 (1981).
427. Some enforcement apparatus would also be needed for an opt-in system, if one were to be adopted.
428. See supra notes 223-315 and accompanying text.
429. "Default rules fill the gaps in incomplete contracts; they govern unless the parties contract around them." Ian Ayres & Robert Gertner, Filling Gaps in Incomplete Contracts: An Economic Theory of Default Rules, 99 Yale L.J. 87, 87 (1989);
430. see also W. David Slawson, The Futile Search for Principles for Default Rules, 3 S. Cal. Interdisc. L.J. 29, 29 (1993) ("Default rule analysts call a law a default rule if a contract could preempt it."). For an argument that opt-in rules do not run afoul of the First Amendment, see Kang, supra note 84, at 1277-82.
431. See generally Scott Shorr, Note, Personal Information Contracts: How to Protect Privacy Without Violating the First Amendment, 80 Cornell L. Rev. 1756 (1995);
432. Jonathan P. Graham, Note, Privacy, Computers, and the Commercial Dissemination of Personal Information, 65 Tex. L. Rev. 1395,1434-38 (1987) (arguing that privacy legislation would not violate First Amendment).
433. In the online context, it may soon be possible for the consumer to set the default. Internet browsers are currently in development which would permit the consumer to identify his or her privacy preferences. See FTC, Privacy Online, supra note 39, at 9. That may be helpful to consumers who are technologically savvy enough to take advantage of that option - and who possess up-to-date browsers - but will obviously be of little aid to consumers making purchases through means other than the Internet. That is especially important in consumer transactions, because the stakes involved are generally so low that large transaction costs may exceed the value of the transaction and make the transaction uneconomic.
434. Cf. Howard Beales et al., The Efficient Regulation of Consumer Information, 24 J.L. & Econ. 491, 522-23 (1981): [T]here is usually an advantage in designing disclosure remedies that leave as large a role as possible to normal market forces, to restrict the market as little as possible. The goal should be not to specify the exact information to be disclosed and the exact manner in which it will be disclosed but to give sellers the proper incentives to make these decisions on their own. This reduces the consequences of a bad decision by the government since it avoids forcing sellers to disclose information in an ineffective manner or to disclose information which, because of a change in circumstances, is no longer desired by consumers. It also increases the effectiveness of the remedy by harnessing sellers' own incentives to develop the most effective ways of informing consumers. Thus, innovation should be encouraged by leaving sellers latitude to experiment
435. The FCC did so in interpreting the Telecommunications Act of 1996. See 63 Fed. Reg. 20,326 (1998); see also Evan Hendricks, FCC Backs 'Opt-In' for Phone Companies' Secondary Use of Customer Data, Privacy Times, Feb. 20, 1998, at 4. The FCC's interpretation has been challenged in court. See U.S. West, Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999) (vacating FCC's order).
436. See Cavoukian & Tapscott, supra note 235, at 181-82.
437. See, e.g., Symposium on Default Rules and Contractual Consent, 3 S. Cal. Interdise. L.J. 1-444 (1993).
438. See Ayres & Gertner, supra note 327.
439. Id. at 91.
440. See id. at 97.
441. Id. at 99.
442. See id. at 99-100. Robert Scott calls default rules adopted for such reasons "information-forcing default rules." Robert E. Scott, A Relational Theory of Default Rules for Commercial Contracts, 19 J. Legal Stud. 597, 609-11 (1990);
443. see also Alan Schwartz, The Default Rule Paradigm and the Limits of Contract Law, 3 S. Cal. Interdisc. L.J. 389, 390-91 (1993): [L]et a set of parties, say retailers, understand the commercial subject and the law relevant to it while the other set of parties, say consumers, does not. An information-forcing default rule is chosen because it is unfavorable to sophisticated parties; the new contract the sophisticated parties propose to displace the unfavorable default is supposed to inform the unsophisticated parties of the subject's relevance and of the terms that will govern disputes unless these parties speak up.
444. Ayres & Gertner, supra note 327, at 103-04.
445. In a later article, Ayres and Gertner argued that "the introduction of transaction costs can actually exacerbate the inefficiencies of strategic bargaining - so the gains from contracting can fall by more than the size of the transaction costs." Ian Ayres & Robert Gertner, Strategic Contractual Inefficiency and the Optimal Choice of Legal Rules, 101 Yale L.J. 729, 733 (1992). That suggests that providing businesses both the capacity and an incentive to inflate transaction costs is particularly troublesome.
446. For a thoughtful application of Ayres and Gertner's approach to privacy in cyberspace, see Kang, supra note 84, at 1251-59 (concluding that default rule should be opt-in by using somewhat different analysis).
447. See 2 Richard A. Lord, A Treatise on the Law of Contracts §§ 6:3, 6:49, at 17-18, 561 (14th ed. 1991); 1 Joseph M. Perillo, Corbin on Contracts § 3.18, at 402-07 (rev. ed. 1993). Some exceptions appear in Restatement (Second) of Contracts § 69 (1981).
448. Courts will, however, sometimes infer a tacit agreement to modify a contract from silence. See Corbin on Contracts, supra note 341, § 3.18 at 564.
449. 47 U.S.C. § 543(f) (1994). This section also provides that "a subscriber's failure to refuse a cable operator's proposal to provide such service or equipment shall not be deemed to be an affirmative request for such service or equipment" 47 U.S.C. § 543(f); see also 47 C.F.R. § 76.981 (1999).
450. See 16 C.F.R. § 425 (1999).
451. 16 C.F.R. § 425.1(a)(1).
452. See 16 C.F.R. § 425.1(a)(2)(ii).
453. See David W. Barnes & Lynn A. Stout, Cases and Materials on Law and Economics 23 (1992).
454. See Laudon, supra note 87 ("The costs of using personal information to invade the privacy of individuals is far lower than the true social cost because part of the cost of invading privacy is borne by the individual whose privacy is invaded.").
455. An example may make it clearer. Suppose the benefit of adding a particular name to a database is 80¢, and that the cost to the database company of inputting the data is 20¢ (for typing, electricity, purchasing and maintaining equipment, and the like). In that case, if the company is not required to compensate the person whose name is added, the company will make a 60¢ profit by adding the name, and so should do so. But if the cost to the feelings of the individual whose name is added is one dollar - the externality - the addition of the name will lead to a net loss to society of forty cents. That is arrived at by subtracting the gain to the company (600) from the loss to the individual ($1). That is not an optimal allocation of resources. On the other hand, if the company is required to pay the person whose name is included in the database one dollar for adding the name - thus internalizing the externality - the company will bear the 40¢ loss. A rational company will not wish to incur such a loss and so ought not to add the name. In fact, a company should not add a name to its database unless the value to the company of adding the name exceeds the cost of $1.20. Only when that happens will it be efficient to add a particular name. By making the company bear the costs of increasing the size of its database, as well as obtaining the benefits, society would more readily reach an optimal result
456. See Privacy and the NII, supra note 4, at 15-16.
457. See supra notes 78-98 and accompanying text.
458. See Knecht, supra note 213, at B1.
459. Judge Posner argues that magazines should be able to sell their subscriber lists to other magazines without obtaining the consent of their subscribers for two reasons. See Posner, supra note 53, at 398-99. First, the transaction costs to the magazines of obtaining consent "would be high relative to the value of the list" Id. at 398; see also D'Amato, supra note 103, at 501. Second, "the costs of disclosure to the individual are small . . . . [B]ecause the information about the subscribers that is disclosed to the purchaser of the list is trivial[,] the purchaser cannot use it to impose substantial costs on the subscribers." Posner, supra note 53, at 398-99; see also D'Amato, supra note 103, at 500 ("I can hardly understand why people complain about getting mail solicitations. A piece of mail does not intrude upon their privacy, and in any event the recipient has the simple alternative of throwing it out without opening it."). Posner explains: "If, therefore, we believe that these lists are generally worth more to the purchasers than being shielded from possible unwanted solicitations is worth to the subscribers, we should assign the property right to the magazine; and the law does this." Posner, supra note 53, at 398. I address the issue of the value of the list in light of transaction costs in the following paragraphs in the text A problem in Judge Posner's reasoning is that it is not demonstrable that the cost to subscribers of disclosure is small. While the subscribers may receive some benefits from the sale of the subscription list - in the form of cheaper subscription rates, because the magazine has another source of revenue, and in receiving solicitations for products that the subscribers might wish to purchase - the survey evidence and other information about consumer preferences discussed above shows that many consumers are troubled by the sale of lists of consumers. See supra notes 128-179 and accompanying text. The difference between what Judge Posner's view would predict and what the surveys and other evidence suggests may possibly be explained by Judge Posner's decision to treat privacy as an intermediate good rather than a good having value in its own right.
460. See Headden, supra note 5, at 40; see also Report to the Congress, supra note 27, at 8 ("Lists can range in price widely, generally anywhere form $35 to $250 per thousand names."); Knecht supra note 213, at B1 (stating that in 1995, U.S. News & World Reports charged about eight cents per name, reported to be "about average for magazines with affluent well-educated subscribers"); Paula C. Squires, Transactions Go into a Database; Businesses Compile Dossiers on Customers, Richmond Times Dispatch, July 28, 1996, at A-12 (noting that R.L. Polk & Co., which compiles information provided by consumers when they return product registration cards, maintains database containing some 36 million people; in recent years, it has sold its data for $74 per 1000 names). The Lotus "Marketplace: Households" project was abandoned after consumer protests, as discussed in supra notes 176-78 and accompanying text It proposed to charge $695 for the first 5000 names and eight cents each for additional names. See Branscomb, supra note 188, at 18.
461. See Kevin DeMarrais, Big Brother Is Watching Your Database, The Record, Apr. 30, 1995, at A1. Metromail's lists reportedly include sufferers of asthma, diabetes, ulcers, and other illnesses. See Headden, supra note 5, at 44. Prices may also vary depending on the information provided. For example, one service, which provides lists of college students, charges $40 per thousand names; adding zip codes, class year, and major would increase the cost by a total of $20 per thousand. See Gandy, supra note 4, at 91. Similarly, different occupations are valued differently. Space scientists at $45 per thousand command less than either sociology department heads at $60 per thousand or high school math teachers at $65 per thousand. See id. One telephone company charges more for newly connected customers - $90 or more per thousand - than for existing customers, at $50 to $55 per thousand. See Evan Hendricks, Bell Virginia's Plan to Sell Customer Names Draws Criticism, Privacy Times, Aug. 2, 1995, at 4, 5.
462. See Consumer Fed'n of Am., Supplemental Comments: Unsolicited Commercial E-Mail, in Consumer Information Privacy Workshop (June 18, 1997) 〈http://www.ftc.gov/bcp/privacy/ wkshp97/comments2/ftcpriv2.htm〉 (reporting that one million e-mail addresses are available for $89; 30 million e-mail addresses are available for $149).
463. See supra note 330 and accompanying text.
464. See Evan Hendricks, What Price Privacy? Free PC Has an Offer, Privacy Times, Feb. 15, 1999, at 3-4;
465. see also Matt Richtel, Despite Privacy Concerns, Free PCs Attract Many Consumers and Schools, N.Y. Times, Feb. 25, 1999, at G7 (reporting that more than a million consumers have signed up). The company currently disclaims any intention to disclose consumer information to others, but because it can sell advertising on the computers, it can still advertise directly to consumers who accept the offer.
466. See Munro, supra note 82.
467. See Jonathan Berry et al., Database Marketing: A Potent New Tool for Selling, Bus. Week, Sept 5, 1994, at 56.
468. See also Larson, supra note 4, at 8-9 ("Recently a swank Boston hotel offered me five bucks to answer a survey. In 1990 American Airlines, citing plummeting cooperation rates, gave survey respondents a $25 travel certificate.").
469. Judge Posner did note that some magazines seek this information. See Posner, supra note 53, at 398 n.13 ("A few magazines offer the subscriber the option of having his name removed from the list of subscribers that is sold to other magazines. But this solution is unsatisfactory to the subscribers (presumably the vast majority) who are not averse to all magazine solicitations.") (emphasis in original). The cost of obtaining the consumer's permission might be greater when the subscription is started without a communication from the subscriber to the publisher, as sometimes happens. For example, after I purchased some children's clothing for my daughters from a catalog company, the company ordered a subscription to a parenting magazine for me, presumably to induce me to continue buying their products. I never communicated with the publisher; in time, the subscription lapsed. A legal rule which prohibited the publisher from selling my name without my permission would require a publisher that desired to obtain such permission to convey separately to me a wish to have such permission, in addition to my sending back my consent. That would increase the cost of using my name, but probably not by very much, and in any event such gift subscriptions are probably not common enough to justify taking them into account in formulating privacy rules.
470. Cf. Schwartz, supra note 206, at 24 (arguing that when businesses collect data in membership applications "and provide an opportunity to decline outside use of these data[,] . . . the transaction costs for all the parties are minor whether viewed at the moment of negotiating the agreement (the ex ante costs) or complying with it (the ex post costs)").
471. See Regan, supra note 102, at 233; see also Posch, supra note 301 (quoting DMA President H. Robert Wientzen as saying: "Mechanically and cost-wise, [opt-in makes it] much too difficult to achieve the penetration that you need to make e-mail direct marketing a viable concept.").
472. See Information Issues, supra note 192, at 41 (remarks of Ellen M. Kirsh, Vice-President and General Counsel, America Online, Inc.).
473. See FTC, Session Two: Consumer Online Privacy I, supra note 123, at 109-10 (remarks of Rosalind Resnick, President, Net Creations, Inc.). The company's website can be found at 〈http://www.postmasterdirect.com〉.
474. See Letter from Rosalind Resnick, President, Net Creations, Inc., to FTC (visited Oct. 18, 1998) 〈http://www.ftc.gov/bcp/privacy/wkshp97/comments2/ftcoptin.html〉.
475. For example, BonusMail, at 〈http://www.mypoints.com〉,
476. provides consumers with frequent-flyer miles and other rewards for receiving e-mail, while CyberGold, at 〈http://www. cybergold.com〉, pays consumers to read ads.
477. See Teresa Riordan, Patents, N.Y. Times, Feb 1, 1999, at C2.
478. See Larson, supra note 4, at 101.
479. See Mark D. Uehling, Database Marketing: Here Comes the Perfect Mailing List, Am. Demographics, Aug. 1991, at 10 ($15 fee); What Price Privacy?, supra note 30, at 360; see also Blackman, supra note 54, at 462. In 1992, Equifax spun the division - now called Buyer's Choice Media - off as an independent company. See Waldrop, supra note 228, at 46 (quoting Keith Wardell of Buyer's Choice Media).
480. See Goodwin, supra note 47, at 161. Consumers also received bounties for signing up new members.
481. See Maynes, supra note 278, at 158.
482. See id.
483. See 15 U.S.C. § 1691(d)(2) (1994).
484. Equal Credit Opportunity Act Amendments and Consumer Leasing Act: Hearings on S. 483. S. 1900, S. 1927, S. 1961, and H.R. 6516 Before the Subcomm. on Consumer Affairs of the Senate Comm. on Banking, Hous., and Urban Affairs, 94th Cong. 339 (1975) (testimony of Robert Myers, Chairman, Legislative Steering Committee, National Retail Merchants Association).
485. See Board of Governors, Federal Reserve Sys., Exercise of Consumer Rights Under the Equal Credit Opportunity and Fair Credit Billing Acts, 64 Fed. Reserve Bull. 363, 365 (1978). The 59¢ figure appears to have been based on information provided by Sears in response to a Federal Reserve inquiry.
486. See 1990 Equifax Report, supra note 45, at 92. They were dealing with all the provisions of a statute that bars lenders from considering certain criteria in making lending decisions and asking certain questions, provides for punitive damages, and has led to other changes in lending practices. See, e.g., 15 U.S.C. § 701(a)(1) (1994) (barring lenders from discriminating on the basis of race, color, religion, national origin, sex, or marital status); 15 U.S.C. § 706 (1994) (providing for punitive damages of up to $10,000 for individuals and up to lesser of $50,000 or one percent of creditor's net worth for class actions); 12 C.F.R. § 202.5(c)-(d) (1999) (implementing regulation forbidding asking of certain questions). On ECOA, see generally Greenfield, supra note 322, at 337-94 and Pridgen, supra note 117, ch. 3.
487. See, e.g., Robert J. Banta, Negotiability in Consumer Sales: The Need for Further Study, 53 Neb. L. Rev. 195, 196-97 (1974) ("[M]any banking and financial institutions argue that if they were subject to consumer defenses, consumer credit might vanish or become so expensive as to be prohibitive.");
488. Daniel D. Cutler, The Continuing Struggle for Automotive Safety, 15 Seton Hall Legis. J. 453, 463 n.65 (1991) (stating that car manufacturers estimated airbags would cost consumers $1100 each);
489. Jeff Sovern, Good Will Adjustment Games: An Economic and Legal Analysis of Secret Warranty Regulation, 60 Mo. L. Rev. 323, 338 (1995) ("Proposals designed to aid consumers often elicit predictions of . . . setbacks for consumers, and the predictions have sometimes proved fanciful. Thus, some forecast that sellers would stop warranting goods if Congress passed the Magnuson-Moss Warranty Act, and obviously sellers still furnish warranties.") (footnotes omitted).
490. See Privacy and the NII, supra note 4, at 15; see also Gandy, supra note 9, at 137 (making similar proposal).
491. Privacy and the NII, supra note 4, at 25.
492. See id. at 26.
493. Larson, supra note 4, at 10.
494. Report to the Congress, supra note 27, at 14. After listing various items that some commenters regard as sensitive and others did not, the report observes: A determination of what is sensitive is largely subjective. . . . [I]nformation that one person considers not to be sensitive, because it reveals little, may be sensitive to another person. Thus, while a current telephone number may not be considered sensitive, or even private, to people who have their numbers listed in the local telephone directory, it may be highly sensitive for someone who has an unlisted number. Id. at 15.
495. See supra note 138 and accompanying text This preference is consistent with economic theory. See George J. Stigler, An Introduction to Privacy in Economics and Politics, 9 J. Legal Stud. 623, 625-26 (1980): [I]f all credit-history information, for example, were "owned" by the debtor, and there were not a special difficulty in enforcing this ownership because of the public good character of information, this inherent partnership in producing information would create no special problems. I would have an established credit record with the merchant with whom I customarily dealt, and be charged for credit according to the cost of dealing with me (including the cost of learning my payment habits). Another merchant, to whom I denied access to my regular merchant's information, would charge for credit appropriately to his ignorance of my credit worthiness, so in general it would pay me to ask the regular merchant to supply the credit record to others. This would be true even if I were a poor credit risk: the new merchant would extend credit only at high charges to those who refused to reveal their previous records. In the long run, in a sequence of many repetitive transactions, even a poor credit risk can do no better than to deal with informed creditors. . . . The economy of the multiple use of the same information should be accommodated no matter how the ownership of the information is assigned. The failure of contracts to emerge which specify that the creditor may not sell the consumer credit information is in the interest of debtors, for whom credit would otherwise be more expensive.
496. Cf. Ayres & Miller, supra note 244, at 1076 ("Requiring . . . costs disclosure when the costs of communicating are higher than the value of the information to consumers would force retailers to provide a service whose value is less than its costs.").
497. Most uses of consumer information are unregulated. A few exceptions exist, however. For example, when Congress amended the Fair Credit Reporting Act in 1996, it created an opt-out system for prescreening. See 15 U.S.C. § 1681 (Supp. IV 1998). The statute forbids consumer reporting agencies to use information about consumers who object to the prescreening process. See 15 U.S.C. § 1681b(e) (Supp. IV 1998); see also Mass. Ann. Laws ch. 93, § 51A (Law. Co-op. Supp. 1998). The federal statute also requires consumer reporting agencies to establish a notification system for consumers to opt out See 15 U.S.C. § 1681b(e)(5). Consumer reporting agencies must maintain toll-free telephone numbers for consumers to express their preferences and advertise the availability of the opt-out system. Those who obtain the names and addresses of consumers through prescreening must notify the consumers whom they solicit of the consumer's right to opt out See 15 U.S.C. § 1681m(d)(1)(D)-(E) (Supp. IV 1998). It remains to be seen how effective this particular opt-out system will be. Similarly, consumers may obtain from the Postal Service an order barring specified people from mailing them materials which are "erotically arousing or sexually provocative." 39 U.S.C. § 3008 (1994). The Postal Service order must also forbid the mailer from selling the consumer's name to others. Telemarketers are required to maintain a list of consumers who have told the telemarketer that they object to receiving marketing calls, and to refrain from calling consumers on the list See 47 C.F.R. § 64.1200(e) (1999); see also supra note 48. Some states have also created opt-out systems. California now requires credit card issuers that sell consumer information to notify the cardholder before the sale and offer the cardholder the opportunity to opt out See Cal. Civ. Code § 1748.12(b) (West Supp. 1998). A card issuer must either provide cardholders with a preprinted opt-out form or maintain a toll-free telephone number for that purpose. See Cal Civ. Code § 1748.12(b). The statute does not apply to information furnished to credit reporting agencies by the card issuer. See Cal. Civ. Code § 1748.12(e)(2) (West Supp. 1998). Virginia also has an opt-out statute. The statute bars merchants engaged in the sale of goods from a "fixed retail location in Virginia" from selling "to any third person information which concerns the purchaser and which is gathered in connection with the sale, rental or exchange of tangible personal property to the purchaser at the merchant's place of business" unless the merchant gives notice to the consumer. Va. Code Ann. § 59.1-442 (Michie Supp. 1999). The merchant may give that notice "by the posting of a sign or any other reasonable method." Va. Code Ann. § 59.1-442. Merchants who give the requisite notice may still not sell consumer information about any consumer who objects to the sale. The statute has several limits. First, it does not apply to services. Second, it is limited to merchants with a retail outlet in Virginia. Third, it is not clear whether the statute extends to mail-order sales or sales made over the telephone - are such sales made to the purchaser at the merchant's place of business? In addition Quebec has enacted an opt-out law for mailing lists. See Act Respecting the Protection of Personal Information in the Private Sector, S.Q., ch. 17, § 13 (1993) (Can.). The president of the Commission charged with enforcing the statute reported a year after its adoption: "There has been no catastrophe in Quebec. It's business as usual. The implementation of this important piece of legislation is running smoothly." Cavoukian & Tapscott, supra note 235, at 187 (remarks of Paul-Andre Comeau, President, Commission d'Access à l'Information); see also Paul-Andre Comeau & Andre Ouimet, Freedom of Information and Privacy: Quebec's Innovative Role in North America, 80 Iowa L. Rev. 651, 668 (1995) ("The legislation is considered viable in that enterprises can 'live with it' The decisions taken spontaneously by some enterprises outside Quebec provide indirect proof of this as they use the same consent form in their transactions with their customers or members in the rest of Canada as well as Quebec."). Three states have passed statutes regulating unsolicited commercial e-mail. California and Nevada require that unsolicited e-mail advertisements inform the recipient how to notify the sender that the recipient declines to receive further e-mail advertisements from the sender.