"They are watching you," the Internet service provider asserts in a TV spot that began running last week. "Compiling your information. Invading your privacy. At EarthLink, we would never do that. We just provide the totally anonymous Internet."
The ad campaign, by TBWA Chiat/Day, underscores growing consumer concern about prying online marketers--fears that have become mainstream enough to be turned into a marketing opportunity itself. EarthLink rivals including AOL Time Warner's America Online have long advertised their privacy features as a way to attract new customers. Regardless of whether such ads can resolve the question of who protects consumers best, they could bring greater scrutiny to the privacy policies of ISPs.
"The ISP is the absolute gateway for consumers to get onto the Internet. They're in the position to see virtually everything that a consumer does; very often these privacy policies don't make that clear," said Ray Everett-Church, an attorney who runs privacy consultancy Privacyclue.com.
At least one Internet analyst said EarthLink may have gone too far in touting its service as "anonymous" in its bid to compete in a tough market.
"It sounds like EarthLink is grasping at straws," said Bruce Kasrel, a senior analyst at Forrester Research, who pointed to the difficulty in standing out among the thousands of ISPs. The company faces tough competition in various realms, such as price and offerings, he said, which is a disadvantage when rivals can provide portal deals or free services.
Not a solid promise?
"It's not really a solid promise to say that they're going to protect your privacy when all they're really protecting is stuff like names and addresses that can be gotten a million other ways," said Kasrel. Consumers understand their privacy is lost with these services, he said.
Nevertheless, privacy experts say companies that disclose their practices within their privacy policies are legitimate. Most of the major ISPs have reasonable privacy policies that reassure consumers that they're not doing anything untoward with their customer data. Even many free ISPs, such as Juno Online Services, where consumers enter a quid pro quo agreement to give up their personal information in exchange for a subsidized service, are explicit about what they share with third parties and why.
"The reality is, like EarthLink, we do not give out consumer individual subscriber information to anyone," said Charles Ardai, chief executive of Juno, which runs a free and a paid service.
For its part, AOL said it has created "a gold standard for Internet privacy" and will continue to do so.
Still, some ISPs are forging extremely close relationships with marketers, which might make some consumers uncomfortable. The pliability of some Net access providers has encouraged several companies, such as Predictive Networks and Idealab-backed Compete.com, to collect and analyze consumer data via ISPs to market targeted promotions to Web visitors.
Predictive Networks, used in low-cost Net connections from AT&T WorldNet and PSINet, gathers data about consumers based on the sites they visit and then delivers targeted advertising to those visitors, all while maintaining the consumer's anonymity, according to the company. Using Predictive, AT&T WorldNet can subsidize its discount $4.95 a month service by selling promotional deals to marketers.
The business model for Idealab-germinated Compete.com also is based on giving dot-coms "immediate, actionable insight about what consumers are doing, buying and looking for on their own site, their competitors' sites and across the Internet," according to its site. But again, this is done anonymously.
Although the 7-month-old company doesn't list any partners on its site, Compete.com says it "currently draws from the click-stream data of over 7 million Web users tracked on the top 200,000 Web sites," to create detailed Web audience reports.
Banking on privacy
EarthLink launched its privacy campaign last week as part of a "real Internet" branding strategy, the company's first major marketing push since it started six years ago.
The company plans to spend between $50 million and $60 million on traditional advertising this year, including outdoor spots later this spring. Although the company did not give specifics on upcoming ads, a representative said that it would talk about practical privacy tools in future ads.
In the current ad, the company said, it intended to highlight its promise not to track Web surfing activities.
"We don't follow our users around, sell their information in aggregate or personally," explained Claudia Caplan, vice president of brand marketing for EarthLink, contrasting its service with competitors.
Caplan said the ad targets AOL in particular as well as free ISPs, which may sell access to their customers to third parties for marketing purposes.
Privacy advocates said they largely see it as a positive that EarthLink proposes to lock away its subscriber information, but many question the validity of any privacy claims that don't go hand in hand with allowing people to see what's going on behind the scenes.
More generally, privacy experts pointed out that few ISPs guarantee genuine online anonymity--a word used in EarthLink's ad.
Data about consumer travels on the Internet and about e-mail communications is vulnerable to government investigations, as well as civil suits, privacy advocates say. Faced with warrants for information in a criminal case, ISPs are required by law to forfeit personally identifiable information.
Of utmost concern to civil libertarians is the FBI's e-mail monitoring technology, formerly called Carnivore, which allows the federal agency to survey the contents of e-mail for criminal investigations but could be used more generically.
"E-mail is an open book"
"A word to the wise: No matter how much an ISP protects its consumer privacy, if the government allows the FBI to use the Carnivore system (at ISPs), your e-mail is an open book," said Emily Whitfield, a spokeswoman for the national American Civil Liberties Union in Washington, D.C, who noted that the system is already in use.
EarthLink previously went to court to fight against the installation of Carnivore on its servers and won.
For civil cases such as divorce proceedings, ISPs aren't legally required to divulge a customer's identity, but many do.
"Most of these ISPs, the minute you throw a subpoena their way they're like a 6-month-old puppy; they kind of roll over and show you their belly. That's a big concern," said Privacyclue.com's Everett-Church, pointing to so-called John Doe suits in which plaintiffs pressure ISPs to get the names and addresses of the accused.
Although EarthLink doesn't immediately roll over--it gives subscribers notice of a civil suit and gives them 10 days to contest it--privacy advocates said there are other remedies that would go further in helping consumers.
"The best thing that companies can do (to protect consumer privacy) is not record information in the case of these John Doe lawsuits. It's possible just not to record data, because then it would be hard to trace it back to consumers," said Richard Smith, chief technology officer for the Denver-based Privacy Foundation.
On this point, EarthLink says it knows when a subscriber logs on or off the network but not where that person travels online. Furthermore, the company said it only keeps such data for 30 days. "In the event of a large (criminal) case, we would be able to give that information over," said Steve Dougherty, director of systems vendor management for EarthLink.
Despite shortfalls, privacy advocates say ISPs can take steps to protect consumers' privacy.
ISPs can block a subscriber's IP address, making it nearly impossible to detect a subscriber's location, which can be tracked for targeted advertising or other purposes.
AOL, for example, issues IP addresses that make it look like most subscribers are from the same point in Virginia, its headquarters. EarthLink, on the other hand, says that its IP addresses are "obscured" because they are issued from a large pool of addresses, although they can be pinpointed to the city level.
Another privacy concern for some ISP customers involves a vulnerability in Windows that can expose a consumer's disk drive to anyone on the Internet. The disk-sharing function uses certain ports, and ISPs can block all traffic to these ports so that their subscribers are protected.
EarthLink doesn't block ports "because there are valid uses for them," said Dougherty. Uses for them include file sharing for an in-house printer, he said.
Although ISPs are increasingly touting their privacy features in general, consumers are largely clueless when it comes to details because of the complexity of standard privacy policies.
"These disclosures are buried in the user agreements, and even if consumers read through the five or 10 pages, it still may not sink in," Privacyclue.com's Everett-Church said.