Most companies have Web pages now, even if it's just a one-page [online] brochure. Now, the question is what do you do with it? Just having a Web site is not enough.

But you should be prepared for it.

I haven't seen one single case of a company posting a [privacy] policy and abusing it. We've done what [the FTC] asked and abided by it. What more can we do?