Every time I send out a survey using my Zoomerang or SurveyMonkey accounts, there is always at least one wise guy among the respondents who dings me for risking their privacy with these tools. But do they have a point? Last week I decided to finally find out.
Let's call it a privacy-impact assessment (PIA) for online-survey services.
A PIA tries to answer two main questions: Will a system, process or product create risk to personal privacy? And, if so, what can be done to mitigate that risk? When I think about using these tools myself, three more questions come top of mind:
* Will the online-survey company in any way access or use my survey responses or contact lists?
* How will the company secure my survey responses?
* Does the company offer tutorials to users like me on how to conduct a survey that protects privacy?
So those are the criteria I took with me when I visited the Web sites and called the contact centers of the two leading online-survey products, Zoomerang and SurveyMonkey. What did I find out?
1. Similar business models
First, this is another case of a lot of personal data being stored in the northwestern United States. MarketTools parent company of Zoomerang, is based in downtown San Francisco, while SurveyMonkey maintains headquarters in Menlo Park, Calif., with data operations in Portland, Ore.
Both are survivors of the dot-com bust. Walter Good and three other market-research professionals co-founded MarketTools in 1998 in the San Francisco Bay area. I spoke with Good, who pinpointed the birth of Zoomerang to a Minneapolis meeting his team had with the CIO of General Mills. Their idea was to use the Internet to revolutionize consumer research and bring it to the masses. The CIO, Gail Fuget, loved the concept, and soon General Mills and Procter & Gamble were investors.
Now employing 550 people, MarketTools provides other market-research software products in addition to Zoomerang. Housed in an upscale, downtown San Francisco office building where Google takes up three floors, MarketTools also maintains concentrations of employees in Minneapolis, Chicago, New York and its European headquarters in London. The company's current leaders joined the firm in 2005 and 2006, and the company's Web site reports that strong growth occurred in 2009. Zoomerang's business model is to attract users to its free service and then entice them to upgrade to packages that run as high as $600 per year.
For its part, SurveyMonkey followed a similar trajectory. Ryan Finley launched the company in Madison, Wis., after he left college in 1999. After moving to Portland, Finley hired his brother Chris in 2002 and eventually saw revenue hit a reported $30 million in 2008. A venture-capital fund bought SurveyMonkey in 2009, installed its current management team and moved its headquarters to the Bay area. A former Yahoo executive now runs the company, which employs 31. The company's business model is also to attract users to its free service and then upsell them to a premium service, which in SurveyMonkey's case costs $240 per year.
2. Privacy programs
Do the leading online-survey companies maintain privacy programs? It's hard to tell by external appearances. The companies aren't visible in the privacy community, and their Web sites don't indicate that they have someone in charge of privacy. I did find out by contacting the companies that Stuart Loh, corporate counsel for SurveyMonkey, is responsible for privacy, and Chris Robertson, security manager at MarketTools, handles privacy for Zoomerang.
On the plus side, both companies joined the privacy-seal program of San Francisco-based Truste and are also self-certified to the U.S.-EU Safe Harbor. Neither has suffered a publicized privacy breach that I could find, in spite of all of the sensitive corporate data they must host.