Only 3.5% of the 30,000 Web sites reviewed by Enonymous.com were judged to have a "four-star" privacy rating, the top mark given by the survey--and 77.2% had no privacy policy. The survey, conducted over the past nine months, assessed how each site handled information gleaned from its customers, according to Tim Kane, one of the report's authors.

"Most of the 30,000 got zero stars, which means they didn't have a policy," Kane says. "If a site never sells data, and the company never contacts you unless you request it, that site qualifies for four stars." About a quarter of the sites surveyed have a privacy policy, good or bad.

Enonymous.com, which offers consumers a free plug-in that notifies them about the privacy policy of sites they visit, began the study for use with its plug-in but expanded the survey to help augment its site, Kane says. The company also has joined with PC Data Online, a Reston, Va., market-research firm, to begin a continuing survey of PC Data's top 1,000 Web sites to monitor changes in privacy policy.

The report also disclosed that for-profit companies may not be the worst transgressors on the Web. Says Kane, "We found that only 14% of the dot-orgs and 3% of the dot-edus have privacy policies, compared with 25% of the dot-coms."

--Matthew G. Nelson