Many marketing professionals have a common temptation; they want to send as many marketing messages to as many people as possible, and they would love to send it to all folks who have ever been customers or clients of their business, and often times actually want to simply send to everyone whose email address they can obtain in any way.
Privacy professionals make many efforts to guide marketers on what is acceptable and not acceptable. After all, with the CAN SPAM Act, and many other laws and regulations, prohibiting marketers from sending marketing information to those who didn’t ask for them or didn’t opt-in to receiving them, sending unwanted marketing messages can get the business in trouble. And also consider the privacy notice posted on your business website; have you read it? Many of these notices state they will not send marketing messages to anyone unless they have opted-in to receiving them. Does yours state this or something similar?
Providing Choice is a Key Privacy Principle
There are two basic ways to obtain consent to send individuals marketing communications.
1) Opt-in requires the active specification of consent from an individual. The user must perform some action to allow a business to use their personal information to send marketing communications. There are many laws that require explicit opt-in, for at least certain types of personal information, such as in Mexico and the UK.
2) Opt-out automatically puts the individual’s personal information into some type of repository, such as a marketing database, and then requires the individual to take an action to get their personal information removed from that marketing database if they do not want to get such communications. This is often called “implicit consent” or “implied consent” since the individual did not take an action to be put in the database. This is not allowed in many countries outside the U.S. However, it is the most common practice within the U.S. This said, marketers everywhere should never use the opt-out option whenever there is sensitive personal information, such as financial information or health information, involved.
A basic privacy principle is giving individuals a choice for whether or not to receive marketing communications, and then documenting their consent. However, many times individuals may not even realize their consent is assumed if an implied consent method was used. In many cases this has been found by the FTC to be an unfair and deceptive business practice.
Examples
Let’s look at the wording of some actual examples I found online to help clarify the difference between opt-in and opt-out. Figures 1 and 2 are examples of opt-in choices.
Figure 1
:
:
:
:
:
:
Figure 2
:
:
:
:
:
What makes these opt-in choices? Because there are no pre-filled choices, and the individual has to purposefully and actively check one of the options to opt-in. This is often called explicit opt-in.
Figures 3 and 4 are examples of opt-out choices.
:
Figure 3
:
:
:
:
Figure 4
:
:
:
:
:
What makes these opt-out choices?
In Figure 3 the individual was automatically opted-in and must take a specific action to opt-out.
In Figure 4 the wording is misleading, but a common favorite type of choice method for many marketers. Instead to asking which types of communications are wanted (which would be opt-in) the individual is automatically included in all four communications and must take action to opt-out.
Bottom Line…
Don’t justify putting into place privacy poor practices to meet marketing objectives. You may end up with privacy related fines and penalties, and lost trust and revenues. Use opt-in whenever possible, and certainly whenever sensitive personal information is involved.
For related information that demonstrates how IBM’s Customer Identity Resolution can be used by organizations to conduct social marketing to existing customers on an opt-in basis, and the details about how they meet the opt-in requirements to support privacy, see http://www-03.ibm.com/press/us/en/pressrelease/43523.wss.
This post was brought to you by IBM for Midsize Business (http://goo.gl/t3fgW) and opinions are my own. To read more on this topic, visit IBM’s Midsize Insider. Dedicated to providing businesses with expertise, solutions and tools that are specific to small and midsized companies, the Midsize Business program provides businesses with the materials and knowledge they need to become engines of a smarter planet.
Tags: choice, data protection law, FIPs, GAPP, IBM, Information Security, information security risks, infosec, marketing, marketing privacy, midmarket, notice, OECD, PbD, privacy, Privacy by Design, privacy law, privacy principles, privacy professor, privacy risks, privacyprof, Rebecca Herold