Microsoft puts privacy policy on display

Microsoft has begun to incorporate new privacy policies and procedures in upcoming products, possibly in response to this month's settlement with the Federal Trade Commission.

The newest beta, or test, version of Windows Media Player 9 Series prominently displays Microsoft's privacy policy for the program and offers consumers options for controlling just how much information they share when using the product. Unlike competing products, Windows Media Player 9 Series presents consumers with these options the first time the program is used.

Microsoft is scheduled to release a widely available public beta of the media player Sept. 4 in Los Angeles.

"If the final build looks like the software (that CNET News.com) described, the implication is that Microsoft is taking consumer privacy very seriously indeed and marks a big change for the company," said Jupiter Research analyst Michael Gartenberg.

The changes follow a recent FTC settlement, in which Microsoft agreed to 20 years of government oversight of consumer privacy policies and procedures. Last year, 14 consumer and privacy groups filed a complaint with the FTC, alleging that Microsoft's online Passport authentication system violated Section 5 of the Federal Trade Commission Act.

While the 14-group complaint focused on Passport, Microsoft in its settlement with the FTC consented to widespread privacy changes and oversight that would conceivably affect other products. Among other things, the Redmond, Wash.-based company agreed not to engage in unfair or deceptive practices and to protect the security and privacy of personal information.

The settlement also prohibits Microsoft from misrepresenting its privacy and security practices and requires the company to create a program to protect the security, confidentiality and integrity of its consumers' personal information. The software giant also agreed to third-party authentication of its privacy policies and practices.

Microsoft was not immediately available to comment on the privacy policy changes.

Microsoft breaks new ground
Windows Media Player 9 Series may be one of the first new Microsoft products so clearly putting privacy policies and controls in the hands of consumers. Unlike competing products or earlier versions of Microsoft's media player, the privacy policies and settings option is the first thing a consumers sees the first time the product is started.

"Few companies offer the same level of privacy opt-in, particularly at launch, that are specific," Gartenberg said. "Often, privacy policies are hidden in license agreements that run longer than the Magna Carta and are seldom read by users ever, if at all."

"Welcome to Windows Media Player 9 Series," the opening screen of the Privacy Options panel reads. "Microsoft is committed to protecting your personal privacy. To enhance your experience with features including album art and pay-per-view-services, data must be sent and received over the Internet and/or saved on your PC. The options below enable you to customize these privacy settings."

The Privacy Options panel offers users four controls for setting how much information is retrieved or sent via the Internet.

Under the Enhanced Playback Experience option, users can determine whether they want to retrieve information from the Internet about CDs and DVDs, music files and any missing data about them and licenses for protected content. In the most recent media player beta, all three choices are set as "on" by default.

The Enhanced Content Provider Services option lets consumers control cookie settings, which is set to "off" by default in the recent beta. Consumers also can change the cookie-handling settings, but this also would affect other Microsoft programs, such as Internet Explorer. A cookie is a file that remote servers store on a local hard drive containing some type of identifying information that can include passwords, lists of Web pages visited and other information.

A third option, the Customer Experience Improvement Program, determines whether the user optionally sends information to Microsoft following a program crash. Microsoft collects the information for the purpose of improving product quality. The software giant said that many of the bugs fixed in last week's release of Office XP Service Pack 2 resulted from the customer feedback mechanism. The option is turned off by default in the recent media player beta.

The final control sets History, which tracks Web addresses accessed for downloading or streaming content from the Internet. History also is a feature of Internet Explorer. The option is turned off, in the recent media player beta.

In the Help file associated with these options, Microsoft clearly lays out what happens if the settings are left on or turned on. The options let the user control whether to "retrieve media information about CDs, DVDs, and other kinds of digital media files from WindowsMedia.com to create an enhanced playback experience; send configuration information to content providers to assist them in providing better services to you; send anonymous usage information to Microsoft to help us improve the Player and related services."

The Privacy Options panel also offers direct Web access to Microsoft's privacy policy statements for the new media player and also for WindowsMedia.com. The privacy statement Web page for the media player more clearly explains what information the program can retrieve or send and how consumers can change the settings.

The new posturing on privacy could be important as Microsoft adds subscription services to its media player. As first reported by CNET News.com, Microsoft has added premium subscriptions option into Windows Media Player 9 Series. The new Services tab initially allows consumers to sign up for a trial subscription to Pressplay, an online music service backed by Sony and Vivendi Universal. The move is part of Microsoft's increased emphasis on Web services and also an attempt to compete against similar offerings from rivals AOL Time Warner and RealNetworks, which are partners in a competing music service known as MusicNet.

Subscription services, which could use Windows Media Player 9 Series' built-in digital rights management (DRM) technology, would require consumers to disclose some personal information and also require cookies and other identifying files be stored on the local hard drive.

"As more applications become Web-aware in order to provide services and information back to the user, consumers need to be aware of the quid pro quo that's taking place and exactly what information is being provided to the vendors," Gartenberg said. "What Microsoft appears to have done here looks like a step in the right direction, if it makes it into the final product."

Flaws remain
Still, Microsoft does not serve up all the options that could affect user privacy or security in the program's first-use control. According to the media player's privacy statement, "Windows Media Player will periodically check a Microsoft Web site for updates. If one is found, you will be prompted that an update is available and if you consent the new software will be installed on your computer."

The privacy statement also noted that if the appropriate audio or video codecs--compression software used for media files--are not resident on the computer for playing content, "Windows Media Player will silently download it from a Microsoft Web site if you are connected to the Internet and the codec is available."

But users can go to the Options control to turn off both settings after the media player is started.

Microsoft also has enhanced the security of the media player and the amount of control users have over protecting their consumers from intrusion. Users can now determine whether to run scripts, and other options are tied directly to the Security Zone settings tied to other Microsoft products, such as Internet Explorer.

Privacy and media players are an increasingly hot item--and not just for U.S. regulators. The European Union, for example, is looking into regulating media players with respect to privacy. Microsoft's increased emphasis on privacy could help the company in Europe, particularly since the EU last year expanded an ongoing antitrust investigation to include media players.