TrustArc

TrustArc

Type	Private
Industry	Internet Privacy
Founded	1997
Headquarters	835 Market Street, San Francisco, California, USA
Key people	CEO: Chris Babel - CFO: Tim Sullivan - VP Product: Kevin Trilli - VP Marketing: Dave Deasy
Number of employees	130
Website	www.trustarc.com

TrustArc (formerly TRUSTe) is a technology compliance and security company based in San Francisco, California. The company helps corporations update their technology so that it complies with government laws, or operates using best practices.^[1]

History

TrustArc (formerly TRUSTe; originally named eTRUST until a copyright conflict was found) was founded as a non-profit industry association in 1997 by Lori Fena, then executive director of the Electronic Frontier Foundation (EFF), and Charles Jennings, a software entrepreneur, with the mission of fostering online commerce by helping businesses and other online organizations self-regulate privacy concerns.^[2] Toward this end TrustArc launched its flagship Privacy Seal Program, providing privacy seals to websites who abide by a set of fair information privacy practices and agreed to participate in the company's consumer privacy dispute resolution service.^[3]

TrustArc was developed from an earlier program named Privacy Assured launched in 1996 by Tim Dick, CEO of WorldPages which was later acquired by BT. The initial five members were match.com, Four11 / Yahoo!, NetAngels, I/PRO (first web metrics company), and WorldPages. Within two months, over 30 companies had joined Privacy Assured, with more waiting. Privacy Assured approached EFF about setting up an independent entity and learned that EFF was contemplating an internet privacy initiative. Tim Dick brought in his former colleagues at Boston Consulting Group which did a landmark pro-bono study which established much of the internet privacy principles in use today, and on which TrustArc remains built.

TrustArc's founding Executive Director, Susan Yamada, formerly editor of Upside Magazine, served until 2001. In 2000, TrustArc became the first organization to join the U.S. Department of Commerce's, and the European Union's Safe Harbor framework, and subsequently launched its EU Safe Harbor Seal Program.^[3] The US-EU Safe Harbor was agreed upon by the U.S. Department of Commerce and the European Union to provide a framework for American companies to comply with European data and privacy standards.

In 2001, TrustArc became a Children's Online Privacy Protection Act (COPPA) Safe Harbor organization for the Federal Trade Commission^[4] and thereafter launched its Children's Privacy Seal Program.

Fran Maier, co-founder of Match.com,^[5] joined TrustArc as Executive Director in 2001.^[6] One of the first efforts was to address consumer issues with spam or unwanted email.^[7] Maier resigned her position in 2012.

In 2008, TrustArc changed its structure from a non-profit industry association to a venture-backed for-profit company, raising its first round of capital from Accel Ventures. This raised questions about whether the organization is appropriately tough on the companies it certifies.^[8]

Chris Babel, former Senior Vice President of VeriSign's worldwide Authentication Services, joined TrustArc as chief executive officer in November 2009.^[9]

In 2013, TrustArc was approved by the European Interactive Digital Advertising Alliance (EDAA) as an official Certification Provider for the EU Self-Regulatory Programme for Online Behavioural Advertising (OBA).^[10] The same year, TrustArc was named the first approved Accountability Agent for the Asia-Pacific Economic Cooperation (APEC) Cross Border Privacy Rules (CBPR) System.^[11]

On Nov 17th 2014, the Federal Trade Commission announced that TrustArc had agreed to^[12] settle charges that it deceived consumers about its recertification program, and perpetuated its misrepresentation as a non-profit entity against a $200,000 penalty. From 2006 to 2013 TrustArc failed, in over 1000 instances, to conduct annual privacy checks on the companies it certified.^[13] Consumer organizations, the Center for Digital Democracy and the Consumer Federation of America, argued for higher penalties and more FTC oversight, but the FTC declined to increase the penalties.^[14]

On June 6, 2017, the company changed its name from TRUSTe to TrustArc^[15].

Meaning of TrustArc seal

The TrustArc seal does not indicate that a web site complies with any specific set of privacy rules, such as the European Union's Data Protection Directive. It indicates only that the site has self-certified as complying with the site's own privacy statement and TrustArc's program requirements.^[16]

Enforcement

TrustArc claims to enforce its privacy rules, and operates a "Watchdog" operation which accepts consumer complaints. TrustArc described its enforcement process in a filing with the U.S. Federal Trade Commission in 2000.^[17] From 2000 to June 2004, TrustArc published "Watchdog Reports" reporting their enforcement actions.^[18] The final report, for June 2004, shows 256 reports received and 130 reports closed. All 130 reports were resolved with "Issue Handled with no changes necessary to the Privacy Statement nor the Site". In no case was an enforcement action taken. In 2004, no enforcement actions were taken. In 2003, one enforcement action was taken, out of over a thousand complaints.^[18] After June 2004, TrustArc ceased reporting on enforcement actions, despite the statement in its FTC filing that it would publish such reports at least twice a year.

In 2012, TrustArc published a "Transparency Report" which did not list individual enforcement actions, but did indicate that, after over 4000 consumer complaints, TrustArc took only 9 enforcement actions during 2012, 3 of which resulted in termination of TrustArc endorsement.^[19]

Dr. Benjamin Edelman of the Harvard Business School found in January 2006 that sites with TrustArc certification were 50% more likely to violate privacy policies than uncertified sites.^[20] Dr. Edelman has also reported that TrustArc does not go far enough to punish seal holders that break TrustArc's rules and that the organization is not quick enough in revoking the seal on companies that violate privacy standards.^[21]

In 2002, Wired Magazine questioned whether TrustArc could be trusted, noting that rather than revoking privacy seals for violations, "TRUSTe officials often seemed to be covering for their clients".^[22]

In 2008, a Galexia Consulting study reported that TrustArc had terminated only one customer for non-compliance in the previous eleven years, despite a number of significant privacy violations which had received press coverage. "The most significant criticism of trustmarks is that in practice they have proved to be virtually worthless in the face of major privacy breaches. Their privacy standards are low to begin with, but even these rules are simply not enforced against large, paying members."

See also

• Verisign
• WebTrust

References

External links

• Official website