On the Web, It's 1984

Note: Please see below for a letter to the editor regarding this story.

Comet Cursor is a little downloadable program that lets you replace the dull old Windows arrow cursor with an image of Kenny from South Park or other cartoon characters. But until privacy advocates put out the word in late November, Comet users had no way of knowing that Kenny, who usually mumbles incomprehensibly, turns into a chatterbox on your system, reporting back to Comet Systems Inc. (www.cometsystems.com) on what Web sites you visited and what you did while there.

Comet is hardly the only offender in an assault on Web surfers' sense of privacy. In late October, an embarrassed RealNetworks (RNWK) issued a fix that stopped its RealJukebox MP3 music player from surreptitiously sending back reports on the selections users had downloaded from the Web. And many America Online Inc. (AOL) customers who had changed settings to stop annoying offers of credit cards and online photo services discovered that the pop-up windows had mysteriously come back.

Privacy and security concerns have been around since the Internet became a mass medium. At first, the major worry was about the theft of credit-card information, but this has faded because there have been hardly any reports of problems. On the other hand, privacy issues seem to be getting more serious as Web site operators find ever more sophisticated ways to track their visitors' activities.

Consumers have helped bring this assault upon themselves with their dogged insistence that all information and services on the Web should be free. Deprived of the ability to make money the old-fashioned way, dot.coms, many of which give away all of their services, seek ways to ''monetize their visitors.'' That's Netspeak for selling information gathered at Web sites and for delivering customers to online merchants who will kick back a portion of the proceeds.

There are no U.S. laws or regulations governing the uses of information collected from adults on Web sites, whether by asking visitors for personal information, by tracking what people do at the site, or even by planting a snooping module in downloaded software. And while you can always refuse to give information that identifies you on any Web site, there's nothing you can do to stop the owner from collecting the ''clickstream'' of all your actions on the site.

OPTING OUT. The idea that someone is watching and taking notes on everything I do gives me the creeps, even if there is no personally identifying information attached. And the idea that an innocent-looking piece of software might be sending back regular reports on my activities is Orwellian.

Neither Web site privacy policies nor outside watchdogs offer people much protection. Comet has a strong policy statement that promises not to give information to outside parties without permission--but it fails to mention Comet Cursor's snooping. The company defends its actions by saying that no personal data were ever associated with the information collected and that personal information was never supplied to third parties.

As for AOL, it notifies members that the request to opt out of pop-up ads expires after a year--on the fourth screen of details about the policy. ''Most of our members don't mind the renewal process for opt-outs,'' says spokeswoman Trisha Primrose. ''During the course of a year the industry changes so quickly, we can offer our members different services.'' Entities such as TrustE and BBBOnline certify sites meet privacy standards, but their requirements are minimal.

E-commerce may be young, but it's time for it to grow up. Customers deserve to be treated with respect. That means no secret spy mechanisms in downloaded software and no obscure ''gotchas'' buried in privacy policies. Sites should think twice about the resentment that collecting and selling clickstream information will breed in customers.

At a minimum, visitors should have a simple way to opt out of any surveillance. When a customer expresses preferences about the handling of an account, or the presentation of ads or offers, those settings should remain in effect until the account holder changes his or her mind. And no personal information should be disclosed to third parties without explicit permission. Otherwise, a government that has been watching privacy issues with a wary eye may step in with regulations. Even worse, potential customers could start voting with their clicks, nipping e-commerce in the bud.

BY STEPHEN H. WILDSTROM