However, business and government can work together to ensure that this new electronic medium is home to a clean, well-lit marketplace. We need to examine the facts and tell the full truth about e-commerce and the choices before us. A truthful dialogue will distinguish between online privacy concerns about e-commerce and deep public passions about medical and financial privacy. Consumers are genuinely fearful about having their health or financial records widely collected or distributed; they are far more ambivalent about sharing their preferences for golf over skiing fiction over poetry, or Anne Klein over Calvin Klein.

A thoughtful discussion on Internet privacy will recognize the similarities and differences between the security of online and offline information. Internet privacy policies are a recent invention. Two years ago the FTC reported that only 10 percent of the most popular Web sites posted privacy policies. This year the figure has nearly topped 90 percent. Many businesses have made significant efforts to meet consumer privacy concerns. Still, more must be done. Too many privacy policies are too hard to read, too long, and too convoluted to be of any help to consumers. We suggest some basic principles for online privacy protection.

First, consumers' personal information belongs to them. It should not be taken from them without their knowledge or permission. Second, consumers should be empowered to control the use of their personal information. We must give consumers the tools to make an informed choice about whom they are sharing their personal information with. Third, consumers should be able to seek enforcement of consumer protection laws when a business improperly acquires or uses their personal information. These principles can be applied easily and effectively to e-commerce. Just as offline marketers are encouraged to comply with Fair Information Practices, every Web site and Internet advertiser should strive to satisfy four basic standards: notice, choice, access, and security.

If these standards are followed, consumers will have more choices, not less. Mandatory and readable disclosure statements of privacy policies can empower consumers to decide whether they want to continue an online transaction. If privacy is important to them, Web sites with more stringent privacy policies will have a competitive advantage. Congress can play a catalytic role by insisting on simple and convenient postings of privacy policies. Internet users should not have to click five times to translate legalese before they know what a site will do with their personal information. Crystal-ball gazers could never have predicted even two years ago many of the innovations that have occurred on the Internet. Rather than trying to prescribe every detail of what businesses must do to protect consumer privacy, government should articulate online privacy goals and allow businesses the flexibility they need to meet these goals. Building in accountability and government enforcement will ensure that we achieve the desired results.

We walk a fine line: Congress can arm consumers with information so they feel confident they are making the right choices to protect their personal information, but it must do so without shutting down the industry's potential for growth or choking the free flow of information. By making the right choices, we can foster an Internet that lives up to its promise and potential: empowering consumers, creating economic growth, and ushering in the next generation of innovation in the Information Age. John F. Kerry is US senator from Massachusetts. Carly Fiorina is president and CEO of Hewlett Packard.