Advocacy group protests Macy's privacy policy

The Electronic Frontier Foundation began protesting Macy's flagship store in Union Square at noon Tuesday, complaining that the company's practice of collecting and sharing information through its online store and bridal registry puts far too much of a burden on consumers to protect their own privacy.

"Your personal information, including name, birth date and credit card number, is going to be shared with all of (Macy's) partners unless you say no. This isn't protecting anyone's privacy," said Debra Pierce, a staff attorney at the EFF.

"For example, you could be very well surprised when you get these e-mails or calls from companies who know an awful lot about your wedding plans," she added.

Kent Anderson, president of Macys.com, said the company's privacy practices are legal and standard.

"Part of our business is about managing customer information and relationships in the brick-and-mortar world for 140 years and in the online world for four years," he said.

"The privacy policy published has been clearly thought through, is legal and responsible."

The protest is part of a larger campaign by the nonprofit group to draw awareness to and change company policies that require consumers to "opt out" of data-sharing practices. Instead, civil liberties groups and privacy advocates are in favor of "opt in" programs, where consumers agree to share their personal information before it's collected. This is a point of contention between businesses and privacy groups on a number of fronts, including the delivery of targeted online advertising and sending e-mail marketing messages.

In addition, financial institutions are required to give consumers notification of their privacy policies and practices before a July 1 deadline under a safe harbor of the Gramm Leach Bliley Act. If consumers don't want their financial institutions to share information between divisions, for example, they must call a 1-800 number or send a letter to the company.

"The problem is that the default right now is for consumers to opt out," Pierce said. "We're protesting opt out because it puts the burden on the consumer, whereas if the default was opt in, consumers' privacy would be protected, and people don't always get that."

Macy's privacy policy states that the company collects information when they purchase goods online or register for bridal services online at WeddingChannel.com, its online wedding partner. Data collected can include names, addresses, e-mail addresses, phone numbers, credit card numbers and electronic gift card numbers. "We will also gather information on the person who will receive any gift you send," according to the policy.

Under a later section about its data-sharing practices, the company states that Macys.com "may share your personal information with unrelated outside companies so that they can directly market their products or services to you if we feel that a company offers products or services that we believe may be of interest."

The policy then gives customers the ability to opt out of such practices. Anderson said that roughly 1 percent to 2 percent of consumers have opted out.

The EFF, which urged protesters to wear wedding dresses, is encouraging people to write to Macy's opposing their practices by using a form letter on its site. The organization plans to target a new company with similar complaints every three weeks.