• PC World
• »Security

WASHINGTON, D.C. -- The cost of complying with privacy legislation now pending in Congress could run well into the billions of dollars for companies doing business online, and drive some of them out of e-business.

Primary costs are in developing tracking software to help sites comply with the requirements of new laws, according to a report released Tuesday by the Association for Competitive Technology.

The total cost of pending privacy legislation to companies could run as high as $36 billion to cover the price of software to track compliance, says Robert Hahn, director of the American Enterprise Institute-Brookings Joint Center for Regulatory Studies.

He reached that figure by multiplying 361,000--about 10 percent of the total number of "active" and "purposeful" Web sites--by $100,000, which is what Hahn estimates the compliance software will cost. Hahn reached the $100,000 figure from data provided by 17 mostly Washington, D.C.-area consulting companies, which estimated labor and other costs of developing the software.

It may be conservative to estimate only 10 percent of Web sites would need software to comply with new privacy regulations, Hahn says. But even if only 5 percent need it, the cost to the companies would be $9 billion, he adds. He expects that many sites would stop collecting personally identifiable information or even close down if faced with a $100,000 bill.

Vendors Promise Self-Regulation

One reason software development would be so costly is the strict access provisions in some of the privacy bills, Hahn says. Several pieces of legislation require Web sites collecting personally identifiable information to allow customers to see that information and correct it. This could involve giving them online access to Web site databases, which would need to be secure.

The software would probably have to be custom-made for most Web sites because of the difficulty of integrating off-the-shelf products, says Jonathan Zuck, president of ACT, which is an advocacy group for the technology industry.

"These direct costs, coupled with an opt-in requirement, could endanger free online content and services that are paid for by targeted advertising and marketing," Zuck says. Some ACT members fear the proposals will mean their companies will need more lawyers than software developers, he adds.

Vendors are implementing their own privacy policies to meet customer requests, in hopes of maintaining a self-regulatory approach, Zuck says.

Web Surfers Want Control

Hahn says he hopes Congress won't push through online privacy legislation, because compliance costs warrant further study of the issue.

But an overwhelming majority of the public wants to maintain control of their personal data, say recent polls from the Gallup Organization, Harris Interactive, and other polling companies. They made a report to a Congressional panel at the same time that Hahn's report was released.

Although their polls sometimes show the public has unclear and inconsistent ideas about privacy, Web users are clearly concerned, the pollsters say. About 87 percent of online consumers in the United States are "privacy assertive," according to Alan Westin, president and publisher of the Privacy & American Business report. His presentation was one of several at a hearing before the House Committee on Energy and Commerce's Subcommittee on Commerce, Trade, and Consumer Protection.

Being "privacy assertive" means they refuse to give out personal information they feel is not necessary to complete a transaction. Among Internet users, 61 percent say they have opted against purchasing a good or service because they were unsure how their personal information would be used, Westin says.

But the public is "somewhat schizophrenic" about privacy, observes Representative Michael Doyle (D-Pennsylvania), noting that although some polls give clear information, others do not.

Perhaps Web users still need time to develop a "comfort zone," suggests another panel member, Ed Bryant (R-Tennessee).