UNITED STATES OF AMERICA
FEDERAL TRADE COMMISSION
WASHINGTON, D.C. 20580

Division of Financial Practices

December 13, 2002

Christine Varney, Esq.
Hogan & Hartson, L.L.P.
555 13th Street, N.W.
Washington, D.C. 20004

Re: Compaq Computer Corp. (Hewlett-Packard Co.)

Dear Ms. Varney:

As you know, the Division of Financial Practices staff has conducted an investigation into possible violations of Section 5 of the Federal Trade Commission Act by your client, the Hewlett-Packard Company ("HP"). The investigation considered whether HP’s Compaq division engaged in deceptive acts or practices by making misrepresentations in its Online Privacy Statement governing the collection and use of customer information. Among other things, Section 10 of the Privacy Statement states: "No Personally Identifiable Information is collected or shared through the Web beacons used on our Site, and the information collected does not permit us to identify users of our Site."

Our investigation revealed that, contrary to Section 10 of the Privacy Statement, HP has used a Web beacon on Compaq.com to transfer personally identifiable information ("PII") to Idea Integration Corporation ("Idea"). We also believe that the argument you have advanced to the contrary – that, because the PII was sent as part of the command that retrieved the beacon, it was sent before and not through the beacon – is inconsistent with the common understanding of Web beacons. Indeed, it is a common practice to transfer data through the retrieval command of a Web beacon, and it is generally understood that the term "Web beacon" encompasses that process. We therefore find it highly unlikely that the average consumer would recognize the distinction you are drawing or interpret the Compaq.com Privacy Statement as you propose.

Despite these concerns, the staff has determined to close the investigation for several reasons. First, our evidence shows that Idea used the information only to send emails to Compaq.com customers confirming their orders, one of the purposes listed in Sections 4 and 5 of the Privacy Statement. Second, the personal information transferred – first and last name, zip code, email address, as well as order number, order amount, and payment method – was information consumers would have reasonably expected to be used for this purpose. Finally, the PII transfer at issue has been discontinued. This closing is not to be construed as a determination that a violation may not have occurred, just as the pendency of an investigation should not be construed as a determination that a violation has occurred. The Commission reserves the right to take such further action as the public interest may require.

Sincerely,

 Joel Winston
Associate Director for Financial Practices