Informative Informants A privacy policy need not require you to wrestle with legalese. If you like legalese, see the European Commission's Legal Advisory Board Data Protection Directive at www2. echo.lu/legal/en/dataprot/dataprot.html. But simply summarized, it states that you, at a minimum, should clearly identify who you are and unambiguously ask for consent for data collection. This may be difficult if your site attracts traffic from linked sites and reciprocal hosting agreements. Explain why the data is being collected and its intended use, and clearly state whether or not you intend to distribute the data either individually or in aggregate. Information stored in cyberspace has consequences in the real world, so give the user a mechanism to review what's stored on said user, as well as a means to correct mistakes.

Stored information about a user may include transaction history in addition to registration data. Web software vendors would do well to include a way for customers to confirm registration data and review past transactions in a secure way online as part of package functionality. Building self-service into the package becomes another way to differentiate your product from the competition. Leading vendors will take this a step further. Identification of consumers has as much to do with how they act and what their preferences are as it does with the information they voluntarily disclose on registration forms. By deducing demographics and preferences from the pages visited and the relationship between those pages, package vendors can supplement registration data and add value without requiring more disclosure of personal information.

My own take is that, at a minimum, you should provide a statement of intended use that you can live with and that shows respect for your customers.

Lawyers & Committees? Wherever there's a legal wrangle, odds are a standards group isn't far behind. Sure enough, the W3C has released a working draft of the Platform for Privacy Preferences Project (P3P) that defines protocols and data elements to standardize the exchange of personal information. This effort has been endorsed by all the usual suspects. In the not-too-distant future, your site's lack of a privacy policy will be as evident as a lack of SSL. Perhaps users will withhold personal data unless the browser detects privacy protection.

Here's the bottom line: A clear, published, enforceable privacy policy will encourage people to register at your site, provide accurate information and buy from you. In this way, protecting user privacy improves your site's ROI and helps you reach your goals.

Brian Walsh is the founder of bwalsh.com, a Portland, Ore., consulting firm specializing in Internet and client/server product strategies, development and testing. He can be reached at www.bwalsh.com.