Top Ranking Company

This report has been prepared by Privacy International following a six-month investigation into the privacy practices of key Internet based companies. The ranking lists the best and the worst performers both in Web 1.0 and Web 2.0 across the full spectrum of search, email, e-commerce and social networking sites.

The analysis employs a methodology comprising around twenty core parameters. We rank the major Internet players but we also discuss examples of best and worst privacy practice among smaller companies.

The report was compiled using data derived from public sources (newspaper articles, blog entries, submissions to government inquiries, privacy policies etc), information provided by present and former company staff, technical analysis and interviews with company representatives.

Because the 2007 rankings are a precedent, Privacy International will regard the current report as a consultation report and will establish a broad outreach for two months to ensure that any new and relevant information is taken into account before publishing a full report in September.

Which companies?

Ideally we would like to be able to look at all companies in all sectors, but for now we have limited ourselves to online service companies. We created a list of consumer-facing companies based on a number of 'top 50', 'top 100', and 'top 500' resources using criteria including:

* market share
* services offered
* number of users
* site traffic

We have solicited comments from experts around the world about companies that we may have unintentionally omitted. For the time being we have excluded coverage of companies operating under mandatory data collection regimes such as those in the financial sector (e.g. online banking and payment schemes) and the travel industry (e.g. airlines and travel agencies).

Categorising companies has become increasingly difficult. The amount of mergers and acquisitions sometimes makes it quite difficult to differentiate stand-alone companies from conglomerates. We had to judge when it was appropriate to differentiate between companies and services. For instance, Windows Live Space is part of Microsoft, but because it offers services that are quite specific and because of the size of the user base, we took the decision to treat it as a distinct organisation. Meanwhile, Google is a company comprising many services, but its practices and ethics are very much part of its brand and image as a whole, and so we treated it as one single entity. We ranked Orkut as a separate entity even though it is owned by Google.

We are open to recommendations for other companies that we should include in future ranking reports. Ideally we should be able to segment the report findings into various sectors. For instance, we could identify the best and worst practices within social networking sites, search engines and location-based services. We are looking into expanding our company list in the future, but we must also conduct research and consult widely on how looking at specific service dynamics will affect the methodology. It should also be noted that due to resource constraints many of the companies on our current list operate predominately in the English language. We hope to broaden the language base in future rankings. Due to these constraints we have currently omitted some of the largest companies on the Internet.

The companies we included in this consultation study are:

* Amazon
* AOL
* Apple
* BBC
* Bebo
* eBay
* Facebook
* Friendster
* Google
* Hi5
* Last.fm
* LinkedIn
* LiveJournal
* Microsoft
* Myspace
* Orkut
* Reunion.com
* Skype
* Wikipedia
* Windows Live Space
* Xanga
* Yahoo!
* YouTube

We also reviewed the practices of other companies that are not necessarily market leaders. Through investigation and research, sometimes spurred by communications we receive from concerned members of the public, we identified a number of smaller companies who sometimes exercise a complete disregard for the sensitivity of their customers' personal information.

We are also searching for companies that exhibit positive privacy practices. We have been able to identify a number of these companies and hope to report on them more fully in our September report.