ccording to a pair of studies recently released by the Wharton School of Business, on-line shopping could be in trouble: Although total spending was up in 1999, the average number of dollars spent per Internet user was down.
Meanwhile, a growing number of Internet users are dropping out and going permanently off line, the reports found.
The researchers at Wharton, who have tracked more than 23,000 Internet users since 1997, say that the single biggest factor depressing on-line sales is concern about privacy - and specifically, monitoring by third parties.
A second big factor is an unwillingness to trust the on-line business with private data.
Web surfers are right to worry: What you do on line reveals a tremendous amount of information about who you are, what you believe, how you spend your money, and what you do with your time. It's all too easy for Web businesses to correlate this information into a detailed profile.
There are two ways that consumers can be harmed by an on-line profile. First, it can reveal information a person might wish to keep secret. Second, the information itself can be incorrect or incomplete, causing the revealed picture to be not just invasive, but unfair and misleading.
For example, last November I bought some videos from Amazon.com. Then, on a whim, I went to Amazon's recommendations page to see what movies Amazon computers thought I would like, based on my previous book and video purchases. One of the movies was ''Goodbye, Emma Jo,'' which turned out to be an erotic lesbian film. I had never bought pornography, although I had purchased women's fiction and literature. Now, since I bought the ''Emma Jo'' movie, every time I ask Amazon for movie recommendations, about half turn out to be about lesbians.
I find this whole situation somewhat amusing. But somebody else might be offended, or might be worried that Amazon is spreading misleading information to other companies.
The Internet business community realizes that on-line privacy is an issue that's not going away, so over the past few years companies like Amazon have taken steps to address some consumer fears. Many Web sites have posted a so-called privacy policy that explains what kind of personal information they collect and what they do with it. Some companies (but not Amazon) have signed up with TRUSTe (www.truste.com) or BBB Online (www.bbbonline.com), organizations that promise to enforce these voluntary privacy policies.
As it turns out, Amazon's privacy policy says: ''Amazon.com does not sell, trade, or rent your personal information to others. We may choose to do so in the future with trustworthy third parties, but you can tell us not to by sending a blank e-mail message to never@amazon.com.''
Whether or not that is a legally binding promise is hard to tell. Certainly if I were depending on Amazon's policy, and it were to change, I wouldn't have much recourse.
Another big problem with these privacy policies is that they are all written in English. That means that you have to take the time to find each site's privacy policy and read it before you can decide whether you wish to do business.
An alternative to these English-language policies is for companies to use some kind of unambiguous computer language to describe their privacy practices. You then could program your computer to download automatically the privacy policy for every site you visit and warn you if the site's policy offends your sensibilities.
That's the idea behind the World Wide Web Consortium's Platform for Privacy Preferences (P3P) project. Beyond screening out Web sites that refuse to respect your privacy, the system also can transfer your personal information to Web sites that you deem acceptable. For example, some Web sites won't let you browse their pages unless you provide them with your name, e-mail address, and zip code. With P3P, you could program your computer to automatically provide this information if the site met your privacy criteria.
There's been a lot of industry support behind P3P, with public testimonials from AOL, IBM, Microsoft, Netscape and others. It's quite possible that this technology will be built into your Web browser before the end of the year.
But not everybody thinks that P3P is the answer to the Internet's privacy dilemma. One problem with the system for automatically sending personal information to Web sites is that P3P makes it harder for users to provide false information, a technique used by many surfers to protect their privacy today. Another problem with P3P, as it is envisioned currently, is that it transmits a tremendous amount of personal information about the user to the Web site, but little information about the Web site is sent to the user to assist in making a privacy judgment.
''What type of business is it? Is it a private or a public company? Where is it incorporated? Is it a subsidiary of another company, and if so, which one? Unfortunately, P3P does not allow a user to ask any of these important questions,'' writes Christopher D. Hunter, a doctoral candidate at the Annenberg School for Communication, in an article he recently finished on the topic. The fundamental problem with P3P, argues Hunter, is that it does not ensure an individual's privacy, only ''industry's view of privacy.''
Alas, this is a general failing on the Internet today. An important principle in data protection is for individuals to be able to see their records and correct factual errors. But there is no way for me to get into Amazon.com's database and convince its computers that I have no special interest in movies about lesbians.
Hunter's article, which makes for excellent reading about both P3P and on-line privacy in general, can be found at www.asc.upenn.edu/usr/chunter/p3p.html.
Technology columnist Simson Garfinkel can be reached at chat.simson.net/. His book, ''Database Nation: The Death of Privacy in the 21st Century'' will be published this month.
Dow:
