Enforced Standards Versus Evolution by General Acceptance: A Comparative Study of E-Commerce Privacy Disclosure and Practice in the United States and the United Kingdom

We present data on privacy practices in e-commerce under the European Union’s formal regulatory regime prevailing in the United Kingdom and compare it with the data from a previous study of U.S. practices that evolved in the absence of government laws or enforcement. The codification by the E.U. law, and the enforcement by the U.K. government, improves neither the disclosure nor the practice of e-commerce privacy relative to the United States. Regulation in the United Kingdom also appears to stifle development of a market for Web assurance services. Both U.S. and U.K. consumers continue to be vulnerable to a small number of e-commerce Web sites that spam their customers, ignoring the latter’s expressed or implied preferences. These results raise important questions about finding a balance between enforced standards ∗University of Alberta; †University of Iowa; ‡Yale University. Discussions with John Dickhaut, Paul Healy, and Joel Reidenberg on our earlier work led to the present study and are gratefully acknowledged. Assistance from Michael Barrett in setting up the experiment in the U.K. is gratefully acknowledged. We also thank workshop participants at University of Alberta, Hong Kong University of Science and Technology, University of Houston, Yale University, and University of Waterloo Symposium on Information Systems Assurance for comments on earlier drafts. The authors alone are responsible for the article.