Economic pressures are driving enterprises to search for ways to squeeze maximum returns from their customer relationships. Many enterprises are testing just how much intrusion customers will tolerate. Although these efforts seldom violate enterprises’ own privacy policies, they can result in a backlash from customers, privacy advocates and the media.
Enterprises today realize they must respect customer preferences about handling personal information. However, careful handling of customer information often frustrates marketing efforts, since the enterprise can no longer directly contact customers who have “opted out” of company contact. Because of competitive and financial pressures, some enterprises have been cutting corners, and have frequently paid the price in the form of customer ire. Worst-case scenarios include lost sales, lost customers and potential lawsuits.
We review some examples of companies that have pushed the customer privacy envelope too far, and we suggest some best practices for avoiding customer conflict.
Changing the Rules
In March 2002, Yahoo Inc. made changes to its privacy policy that allowed its users to selectively opt in or opt out for newly created categories of marketing activity. In the process, users’ preferences were reset to “opt-in” as the default for these new categories. Yahoo e-mailed its users informing them of the changes and gave them 60 days to reconfigure their settings before Yahoo began marketing against the new preferences. User outcry was swift, and the media covered the event in detail. Although most users did not cancel their Yahoo accounts, many had their impression of the Yahoo brand tarnished.
Best practice: Whether an enterprise uses opt-in or opt-out as the default says much about how it respects customer privacy. An opt-in default, which assumes that all customers have granted permission to be contacted unless they explicitly opt out, is a much more aggressive approach. Customers who have even a casual interaction with an enterprise can find themselves inundated with offers and e-mail. An opt-out default, although it limits the subset of customers available for contact, nonetheless communicates concern for customer preferences and helps identify the customer segment likeliest to respond to contact.
Breaking the Rules
In April 2002, Lycos sent e-mail to Lycos Network members who had opted out of Lycos’ Special Offer program. Lycos had made changes to the program, including the addition of a US$5,000 sweepstakes prize, which it felt would compel users who had opted out to reconsider. The e-mail included a link that, when clicked, would automatically reset the user’s opt-in settings for the Special Offer program. Even though users may have explicitly denied permission to be contacted, Lycos ignored the customers’ preferences for a “one time” contact.
Best practice: Simply put, a “no” is a “no.” It may be frustrating to be unable to contact customers in an attempt to influence their preferences, but enterprises must not violate their own privacy agreements. Other methods must be used to influence the customer without direct contact
Bending the Rules
In February 2000, online advertiser DoubleClick Inc. came under fire for its policy of using “cookies” to monitor Web-surfer activities across multiple Web sites. Its intention was to deliver targeted messages based on this information the next time a given cookie was detected. Users and privacy advocates objected, even though personal user information was not associated with the cookie. Even though a subsequent U.S. Federal Trade Commission investigation found that DoubleClick had not violated its privacy policy, the company continues to be hounded by class-action lawsuits and has suffered damage to its reputation and stock price.
Best practice: When exploring new and creative ways to utilize customer data, enterprises must consider the possible end results of these uses in privacy policy development. Adhering to the policy itself is not enough if customers view the enterprise’s practices as offensive. An enterprise should communicate openly and frequently with customers to ensure that its practices are acceptable.
Follow the Rules
Even acting within the letter of your privacy policy can lead to trouble if you run afoul of your customers’ expectations. In February 2002, Comcast began to monitor individual user activity of its new high-speed Internet service by tracking the users’ IP addresses as part of its process to cache frequently accessed content for performance improvement. Even though the IP data was purged after 36 hours and wasn’t being matched to individual user profiles, one user discovered the activity and spread the word. Following outcries from everyone from online privacy advocates to members of the U.S. Congress, Comcast discontinued its IP tracking.
Best practice: Be aware of what customer data your enterprise is collecting and how you are using it. Conduct an information audit to ensure that relevant data you collect is properly secured and that you are discontinuing unnecessary data collection. Collecting too much data can be as dangerous as collecting too little, and the usage of all collected data must be explicitly defined in your enterprise’s privacy policy.
Key Facts
Economic pressures are driving enterprises to search for ways to squeeze maximum returns out of their customer relationships.
Some companies have been trying methods to work around the restrictions they or their customers have put in place to protect their personal information. There is a growing trend within the general public to control and protect its personal information wherever it can exert control (for example, in business transactions).
Adhering to a privacy policy itself is not enough if customers view the enterprise’s practices as offensive.
To be successful, enterprises must understand how to achieve an appropriate balance between developing customer insight and maintaining the customer’s sense of privacy.
Bottom Line
Enterprises should resist the temptation to sidestep the restrictions of their own privacy policies. In most cases, such attempts will translate directly into customer anger, bad publicity, and, ultimately, lost sales and lost customers. Respect the stated preferences of customers and be candid in communicating what data you are collecting and how you are using it. When in doubt, err on the conservative side.
