EPIC Files Complaint with FTC against DoubleClick

(February 11, 2000) The Electronic Privacy Information Center filed a complaint with the FTC alleging that DoubleClick's online privacy practices constitute unfair and deceptive trade practices.

The Electronic Privacy Information Center (EPIC) filed its 11 page Complaint with the Federal Trade Commission (FTC) on February 10. EPIC is a Washington based advocacy and litigation group which focuses on privacy issues involved in computer and Internet technologies.

DoubleClick is company specializing in online advertising and marketing. It states in its web site that "We specialize in developing the solutions which make advertising work on the Internet for Web publishers and Web advertisers." The EPIC complaint focuses on its "DART" technology, an acronym for "Dynamic Advertising Reporting and Targeting." This involves the use of "cookies" to keep track of the web use of individual browsers which visit web sites with DoubleClick managed ads.

DoubleClick states that "DART matches advertiser-selected target profiles with individual user profiles and delivers an appropriately targeted ad."

In contrast, the EPIC Complaint alleges that:

"DoubleClick Inc. has engaged, and is engaging, in unfair and deceptive trade practices by tracking the online activities of Internet users and combining that tracking data with detailed personally-identifiable information contained in a massive, national marketing database. DoubleClick Inc. engages in these activities without the knowledge or consent of the affected consumers, and in contravention of public assurances that the information it collects on the Internet would remain anonymous."

"This complaint against Doubleclick is a critical test of the current state of privacy protection in the United States," said Marc Rotenburg, Executive Director of EPIC. "We are looking to the Federal Trade Commission to see whether companies that break their promises and collect personal information in an unfair and deceptive manner will be held accountable."

The FTC is the federal agency with a broad consumer protection mandate. It has authority under the Federal Trade Commission Act to bring civil actions against commercial entities which engage in unfair and deceptive trade practices.

However, except in the area on advertising to children, the FTC has no specific statutory authority over online advertising or data collection processes, unless they are unfair and deceptive. FTC officials have repeatedly questioned whether the FTC has authority to take action against a business based solely on its privacy practices, or lack thereof. Of course, there are several bills pending in the Congress which would greatly expand FTC authority in this area.

However, FTC officials add, if a company publishes a privacy policy, and then violates that policy, that could be unfair and deceptive. The FTC did take action against GeoCities last year for this.

Hence, the EPIC complaint focuses on DoubleClick's previously published privacy policies, and alleges that they have been violated.

The EPIC complaint alleges that DoubleClick, which recently merged with catalog database firm Abacus, will combine anonymous Internet profiles in the DoubleClick database with the personal information contained in the Abacus database. This, alleges EPIC, would violate earlier privacy policies which stated that DoubleClick does not maintain personally identifiable information.

The complaint states that DoubleClick published a privacy policy in 1997 which states that "DoubleClick does not know the name, email address, phone number, or home address of anybody who visits a site in the DoubleClick Network. All users who receive an ad targeted by DoubleClick's technology remain completely anonymous."

EPIC also complains about DoubleClick's opt out policy. It states that "DoubleClick's "Privacy Policy" purports to offer users the ability to "opt-out" of the information sharing ..."

The problem with this, according to EPIC, is that consumers who visit web sites which carry DoubleClick ads receive cookies, and are profiled, from those third party web sites. "The vast majority of Internet users who receive cookies from DoubleClick never visit the DoubleClick Web site and therefore never learn of the "opt-out" procedures described by the company."

The complaint asks the FTC to conduct an investigation, enjoin DoubleClick, order DoubleClick to destroy records on consumers, fine DoubleClick, and order it "to obtain the express consent of any Internet user about whom DoubleClick intends to create a personally-identifiable record, and to develop such means as are necessary to ensure that the user has access to the complete contents of the record".