'Free iPod' firm hit with privacy-breach suit
New York state accuses company of selling personal data on millions of users, violating posted policies.
In a civil complaint (click here for PDF) released Thursday, New York Attorney General Eliot Spitzer accused Washington D.C.-based Gratis Internet of deceptive business practices. The suit requests monetary penalties and an injunction against the activity in question.
The suit, filed in the state's supreme court in Manhattan, marks the latest chapter in Spitzer's charge against what he has labeled the largest deliberate breaches of privacy in Internet history. Earlier this month, the attorney general announced a $1.1 million settlement with Datran Media. The e-mail marketer had been accused of buying at least 6 million files from Gratis, despite knowing that the transaction ran contrary to the seller's privacy policy.
In Thursday's filing, the state claims that Gratis violated its own privacy policies by collecting and selling personal information on more than 7 million users, over a period of three and a half years. Gratis sold the information to three independent e-mail marketers, including Datran, in 2004 and 2005, according to the suit. Those marketers went on to fire off tens of millions of unsolicited e-mails to the addresses obtained, the complaint alleged.
The activity allegedly occurred through six Gratis-owned sites: FreeiPods.com and FreeCondoms.com (which it continues to operate), and similar sites offering free DVDs, CDs and video games that were discontinued earlier this year.
In order to secure the "free" goods, visitors must sign up for at least one promotion offered by Gratis' third-party business partners, such as Blockbuster Video, BMG Music Service and CitiBank. They earn freebies by persuading a requisite number of friends to register as well. Gratis receives payments from its partners ranging from $20 to $70 for each participating customer, the court filing said.
The state claims that between 2000 and 2004, Gratis pledged explicitly and repeatedly on its sites to "never" give out, sell or lend its customers' information to anyone, even its business partners.
The current privacy policy posted at FreeiPod.com, last updated on March 21, appears to differ from the documents quoted in the state's complaint. For instance, it now says a registrant's personal information may be shared with those business partners, but it does provide ways for users to opt out of receiving messages from commercial sponsors.
In a statement sent to CNET News.com, Gratis forcefully denied the allegations, saying the company "at no time in its history ever sold its list to anyone or allowed a company to purchase consumer data, nor has it ever considered doing so, nor will it ever in the future." The company maintained that it has always acted in a responsible and trustworthy manner in its dealings with consumers.
The New York suit drew a chorus of praise from privacy advocates, who said the attorney general's action should send a strong message to companies thinking about putting their client lists up for sale.
"Without strong enforcement, privacy policies are meaningless," said Marc Rotenberg, the executive director of the Electronic Privacy Information Center.