sites must disclose their information practices before
collecting data. includes identification of collector, uses of
data, other recipients of data, nature of collection (active/
inactive), voluntary or required, consequences of refusal, and
steps taken to protect confidentiality, integrity, and quality of
the data.