Fair Information Practices

Fair information practices are the shared baseline behind most privacy law: tell people what personal data is collected and why, give them a choice about uses beyond the original purpose, let them see and correct what’s held, keep it secure, and back all of that with real recourse. They apply to any site that collects personal information, at sign-in, at checkout, or on a subscription form. No single law imposes them everywhere. Instead, privacy law is fragmented across jurisdictions and kinds of data, and each framework builds its own requirements on this same base: GDPR in the EU, HIPAA (Health Insurance Portability and Accountability Act) for U.S. health data, COPPA (Children's Online Privacy Protection Act) for children’s data, and CalOPPA (California Online Privacy Protection Act) and CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act) in California. Fair information practices are a compliance floor, not a design pattern by themselves — they set what a site must disclose and allow, while Privacy Policy and Privacy Preferences cover how that gets built into the actual interface a customer sees.

Fair information practices are a compliance floor, not a design pattern by themselves — they set what a site must disclose and allow, while Privacy Policy and Privacy Preferences cover how that gets built into the actual interface a customer sees.

The seven safe harbor principles

These seven principles were the core of the safe harbor framework, which let American companies self-certify their handling of EU residents’ data. That mechanism has since been replaced, but the principles remain the clearest itemized statement of the baseline:

Notice — tell people what data you collect, why, who you might disclose it to, and how they can limit that use.
Choice — let people opt out of disclosure to third parties or use beyond the original purpose; require affirmative opt-in for sensitive information specifically.
Onward transfer — apply notice and choice before passing data to a third party; if that third party is acting as your agent, bind it to the same principles contractually.
Access — let individuals see, correct, amend, or delete their own data, except where that’s disproportionately burdensome or would violate someone else’s rights.
Security — take reasonable precautions against loss, misuse, and unauthorized access, disclosure, alteration, or destruction.
Data integrity — keep data relevant, reliable, accurate, complete, and current for its stated purpose.
Enforcement — back the other six with real, affordable recourse mechanisms, verification that commitments are actually implemented, and consequences for noncompliance.

The Federal Trade Commission’s (FTC) four practices (U.S. domestic baseline)

Safe harbor only ever covered U.S. companies handling EU residents’ data, and far less legal structure governs purely domestic U.S. sites. An FTC report recommended four practices as a reasonable general-purpose baseline for them, without making any of them legally binding:

Have a clear, conspicuous Privacy Policy. Typically footer-linked on every page, but made especially prominent on the homepage, checkout, and account-creation pages.
Let people choose how their information is used beyond its primary purpose. A shipping address collected to fulfill an order is a primary use; using the same address for marketing is a secondary use requiring separate choice — see Privacy Preferences for how that choice gets surfaced in an interface.
Tell people what information you hold about them, through an Account Management facility that lets them review and correct it.
Take reasonable precautions to protect it — secure connections, security-tested custom software, current security patches, clear internal handling policies, and periodic audits.

Patterns

Principles

Standards

Sources

The Design of Sites: Pattern Group E — Building Trust and Credibility is the source for the seven safe-harbor principles and the FTC’s four-practice domestic baseline documented above.