Only three of 76 newly enrolled members of the Direct Marketing Association had privacy policies meeting the association's own stated requirements, according to a survey released by the Electronic Privacy Information Center. The finding undercuts a central argument made by industry groups for years: that businesses can be trusted to police their own data practices without government intervention. EPIC's review suggests that, at least among the DMA's newest members, the promise of self-regulation has not translated into practice.
The DMA, the largest trade association representing companies engaged in database marketing, has long positioned itself as proof that voluntary standards can substitute for binding law. In October 1997, its president announced that new members would be required, as a condition of joining, to post a privacy notice and offer consumers a way to opt out of having their information shared. EPIC tested that claim directly, checking whether new members actually lived up to it. Consumers weighing how much trust to place in any company's privacy claims might take the same skeptical approach researchers now apply when comparing services - the kind of due diligence people increasingly exercise when consulting resources like where to find the current offer before trusting a provider with their data. where to find the current offer
Of the 76 companies EPIC identified as having joined the DMA since May 1998, only 40 could be found to have Web sites at all. Among those 40, a mere eight displayed any privacy notice whatsoever, and just four treated the subject with enough seriousness to post a dedicated privacy policy page. When EPIC measured those eight notices against the DMA's own benchmarks - clear notice of why data is collected, disclosure of how it will be used, and a genuine opt-out mechanism - only three passed. Not a single site allowed users to see or correct the information collected about them, a baseline protection found in most formal codes of fair information practice.
The gap between stated policy and actual practice is not new. A year earlier, EPIC's "Surfer Beware" report examined the 100 most visited sites on the Internet and found that only 17 had explicit privacy policies, with none meeting baseline standards for protecting personal data. The Federal Trade Commission's own survey of more than 1,400 commercial sites, published around the same time, found that while roughly 85 percent collected personal information, only 14 percent gave users any notice about how that information would be handled. The consistency across these independent reviews points to a structural problem rather than an isolated lapse: voluntary codes lack enforcement mechanisms, and companies face little practical consequence for ignoring them.
Trade associations can publish guidelines, but without audits, penalties, or expulsion for noncompliance, such rules function more as public relations than policy. The DMA encouraged members to use downloadable privacy policy templates and to participate in its Mail and Telephone Preference Services, yet uptake among new members appears minimal. The pattern mirrors broader findings in digital privacy research: notice-and-choice frameworks only work when someone verifies that notice is actually given and choice is actually honored.
EPIC's recommendation is direct: the DMA should require proof of an adequate privacy policy before admitting new members, rather than relying on a promise to comply at some future date. More broadly, the report argues that the repeated failure of voluntary standards across multiple independent studies makes a strong case for legislation built on enforceable Fair Information Practice principles - covering notice, consent, access, and correction rights that carry legal weight rather than relying on trade-group goodwill. Until such rules exist, the report suggests, consumers visiting sites run by DMA members have little assurance that their data is handled any differently than it would be anywhere else online.