Truste reports on RealNetworks as FTC examines Net privacy

As part of a one-day workshop, the Federal Trade Commission is examining "online profiling," a growing trend in which firms piece together Net users' personal information and surfing habits to target them with advertising and new services.

"The use of conventional demographic information by advertisers to target consumers most likely to be interested in their products and services is a staple of the advertising industry and does not raise any eyebrows. Online profiling, however, looks like it may be a very different beast," FTC chairman Robert Pitofsky said during his opening statement today. "On a personal level, I find this more than a bit disturbing."

Profiling can be done by collecting data through online advertisements, Web site registrations and sales records, or cookies--small files Web sites quietly place on a person's computer that can be used to trace their steps or automatically generate a given site's password, for example.

The FTC's investigation comes on the heels of revelations that RealNetworks was assigning unique identification numbers to its popular music listening software that could have been used to track its 12 million users without their knowledge.

Privacy program Truste, which certifies RealNetworks' compliance with the data-collection policy on its Web site, said today that it is not revoking RealNetworks' seal. Privacy advocates and consumers had complained that RealNetworks hadn't previously disclosed the existence of the ID to the public.

"After an initial inquiry, Truste found that because the transmission of user data through RealNetworks' RealJukebox program did not involve collection of data on the RealNetworks Web site, the privacy incident was outside of the scope of Truste's current privacy seal program," Lori Fena, Truste's chairwoman, said in a statement. "However, because consumer trust is more important than legal technicalities for both Truste and RealNetworks, we have worked together to find a series of appropriate solutions."

RealNetworks has published a new software privacy policy to inform consumers about what personally identifiable information is collected about them via its products. Truste also said that it is setting up a working group to advise on how it can extend its privacy seal program to consumer software products.

"RealNetworks is going to extraordinary efforts to make sure that consumer privacy is protected in our client software products," Rob Glaser, RealNetworks' chief executive, said in a statement.

This not the first time Truste has sidestepped revoking a seal of a prominent company. Arguing that software falls outside of its scope, Truste took no action against Microsoft when it was discovered that the Windows 98 operating system could be exploited to surreptitiously collect user information.

Reacting to complaints two weeks ago, RealNetworks immediately disclosed the use of ID numbers in its privacy statement and offered users a patch that would replace their unique IDs with zeros in RealJukebox and RealPlayer 7. Users of RealPlayer can still turn on the IDs, which could enable them to play some content that requires authentication.

The stream of actions didn't come soon enough for Jeffrey Wilens, a RealNetworks RealJukebox user, who filed a $500 million class-action lawsuit against the company Friday in California Superior Court on grounds that RealNetworks' actions violated the state's unfair business practices law.

"He had no concept of the invasive nature of their software," said attorney Jeffrey Spencer, who is representing Wilens. "[RealNetworks] may have now taken steps in the right direction, but it's too little too late."

RealNetworks had no comment on the lawsuit.

In addition to its new policies, in an informal agreement with Truste, RealNetworks said it would conduct an outside audit of its privacy practices to ensure that concerns regarding RealJukebox have been addressed. At the urging of Truste, Microsoft's Hotmail also submitted to a third-party audit when a security hole was found in the free email service.

RealNetworks also said the RealPlayer 7 does not send the unique ID to the company as part of the electronic registration process, and therefore the company cannot associate the RealPlayer ID with any user's personal information--which the company has vowed not to store or give to a third party in any case.

Still, RealNetworks' scramble to reconcile its data-collection practices with its posted statements is the reason consumer advocates are asking the FTC today to endorse strict laws, not industry self-regulation programs, to shield online privacy.

"The risk of online profiling is that millions of secret electronic dossiers will be built and sold around the Internet without the average surfer even being aware of it," said Jason Catlett, founder of Junkbusters, a clearinghouse for privacy-protection measures. "Self-regulation has never worked--consumers need laws to give them strong enforceable rights."

How concerned are Net users about profiling?
In response to increased scrutiny surrounding online profiling, a coalition of Net advertising companies, including DoubleClick and AdKnowledge, told the FTC today that they would adopt policies to disclose to consumers what information is being collected about them and how to stop their information from being used for profiling.

In conjunction with the FTC workshop, DoubleClick also underwrote a study released today by Privacy & American Business, a nonpartisan think tank that has released several privacy reports at past FTC hearings.

The study examines how concerned Net users are about privacy and whether they are willing to give up sensitive information and submit to profiling in exchange for content and ads that target them personally.

The study, "Personalized Marketing and Privacy on the Net: What Consumers Want," found that 61 percent of those surveyed are interested in receiving banner advertisements that are tailored to their needs. A similar percentage would agree to let companies use their offline transactions and online activity for target marketing if they were accurately informed beforehand about how their data would be used and allowed to opt out if they didn't approve.

Between 71 and 78 percent of those who were interested in personalized Net services said, however, that they did expect companies to abide by their posted privacy policies. Moreover, 92 percent of the 1,011 respondents confirmed that they were "concerned" about privacy, with two-thirds stating that they were "very concerned" about the abuse of their personal information.

"The survey findings validate previous research indicating that Internet users expect assurances of notice and choice when engaging in online information exchange," Alan Westin, who conducted the survey, said in a statement. "This survey is unique in revealing that a majority of Internet users would allow companies to use information about their preferences from both online and offline sources in return for personalized messages."