Take the 2-minute tour ×

On our website we collect an awful lot of personal information. People upload their CVs, and when they use their social networks to log in, we collect information from there too.

We use this information for marketing, and may sell access to this data to 3rd parties.

These are covered in the T&C's of our website. We say that if you sign up, you accept the T&C's (no checkbox, it just says that). That's it.

What's the best way on making sure everything is done legitimately?

share|improve this question
Do you want to specify which country you are operating in? I can see from your profile that you've got a .co.uk website, so I'm answering for UK law. –  paulmorriss May 6 '11 at 13:09

3 Answers 3

up vote 1 down vote accepted

1) Clearly state in your privacy policy that you collect personal data from their account and social networks and may sell this information to third parties. Write this in plain english.

2) Clearly state in your TOS that by using your website that the user allows you to access and sell their personal information.

Those two steps should cover your butt legally. (I am not a lawyer and as always you should consult an actual attorney for a professional opinion).

The following steps are good netiquette and should help avoid complaints and controversies.

3) Put a copy of your TOS in your registration page. Don't just link to it, put the actual content there so it is impossible to miss/avoid. (I put it in a textarea so it does't take up a lot of space and scrolls but this can be accomplished other ways as well).

4) Whenever you update your privacy policy notify members via email and their control panel that it has been updated. Posting a note in the footer of your website is also a good idea.

5) Allow members to opt out of your service and delete all of their information. This includes no longer selling their information to third parties.

6) If you are in the US, become a member of the Better Business Bureau.

share|improve this answer
Just to add, we ended up paying a law firm to audit our compliance and produce the necessary documentation. If you are an enterprise and intend to sell the business, you really must be able to show you have been compliant. The only real way to do this is with a lawyer. –  chrism2671 Mar 17 '12 at 16:41

I find this resource from the Information Commissioners Office useful for wording these sort of things: http://www.ico.gov.uk/for_organisations/data_protection/topic_guides/privacy_notices.aspx

You may find the small business checklist useful: http://www.ico.gov.uk/for_organisations/data_protection/topic_guides/online.aspx

For the whole subject of Data Protection I often refer to this document: http://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/the_guide_to_data_protection.pdf

As for spamming laws, they fall under the Privacy and Electronic Communications regulations. In particular you can't send marketing emails to domestic subscribers (i.e. people at their non-work emails) without prior consent unless relevant to a recent purchase.

share|improve this answer

Just to add to the other points here. If you're in the EU and you have any check-boxes that ask the user if they would like to receive a newsletter/revieve offers from your partners/etc., these must be Opt-In, rather than Opt-Out. (Ie. no 'Uncheck this box if you don't want to recieve...')

share|improve this answer
That may be true for other EU countries but in the UK the document I first link to says "Whilst it’s acceptable to use both opt-ins and opt-outs, they shouldn’t be used in a way that will confuse people". However your example, with it's double negative, is pretty confusing! –  paulmorriss May 6 '11 at 14:16

Your Answer


