|
Tech Law Journal |
 |
| News, records, and analysis of legislation, litigation, and regulation affecting the computer, internet, communications and information technology sectors | |
|
|
|
| |||||
|
• Tech Law Journal converted a PDF version of the Complaint in the EPIC web site into HTML. • Footnotes have been converted into endnotes and two way hyperlinked. • Hypertext links to entities have been added. • This document has been edited for HTML, but not for content. • Copyright Tech Law Journal. All rights reserved. Before the
Complaint and
Request for Injunction, Request INTRODUCTION 1. This complaint concerns the information collection practices of DoubleClick Inc. and its business partners. As is set forth in detail below, DoubleClick Inc. has engaged, and is engaging, in unfair and deceptive trade practices by tracking the online activities of Internet users and combining that tracking data with detailed personally-identifiable information contained in a massive, national marketing database. DoubleClick Inc. engages in these activities without the knowledge or consent of the affected consumers, and in contravention of public assurances that the information it collects on the Internet would remain anonymous. The public interest requires the Commission to investigate these practices and to enjoin DoubleClick Inc. from violating the Federal Trade Commission Act, as alleged herein. PARTIES 2. The Electronic Privacy Information Center ("EPIC") is a public interest research organization in Washington, DC. EPIC is a project of the Fund for Constitutional Government ("FCG"). FCG is a non-profit charitable organization established in 1974 to protect civil liberties and constitutional rights. EPIC's activities include the review of governmental and private sector policies and practices to determine their possible impacts on individual privacy interests. Among its other activities, EPIC has prepared reports and presented Congressional and administrative agency testimony on Internet and privacy issues. 3. DoubleClick Inc. ("DoubleClick") was organized as a Delaware corporation on January 23, 1996. DoubleClick's principal offices are located at 41 Madison Avenue, 32nd Floor, New York, New York 10010. At all times material to this complaint, DoubleClick's course of business, including the acts and practices alleged herein, has been and is in or affecting commerce, as "commerce" is defined in Section 4 of the FTC Act, 15 U.S.C. § 44. 4. DoubleClick's business partners include more than 1,000 companies that have agreed to display DoubleClick advertising on the Web sites they operate and to enable the [begin page 2] placement of "cookies" on the computers of Internet users who visit their Web sites. At all times material to this complaint, such companies' course of business, including the acts and practices alleged herein, has been and is in or affecting commerce, as "commerce" is defined in Section 4 of the FTC Act, 15 U.S.C. § 44. THE IMPORTANCE OF PRIVACY PROTECTION 5. The right of privacy is a personal and fundamental right in the law of the United States. The privacy of an individual is directly affected by the collection, use and dissemination of personal information. The opportunities for an individual to secure employment, insurance and credit, to obtain medical services, and the rights of due process may be endangered by the misuse of certain personal information. 6. U.S. privacy law has by tradition protected the privacy of consumers in the offering of new commercial services enabled by new technologies. For example, the Cable Act of 1984 protects the privacy of cable subscriber records created in connection with interactive television services. The Electronic Communications Privacy Act of 1986 protects the privacy of electronic mail transmitted over the Internet. The Video Privacy Protection Act of 1988 protects the privacy of rental records for video recordings of commercial programs made available to the public for home viewing. 7. Many Americans are today "concerned" or "very concerned" about the loss of privacy, particularly with regard to commercial transactions that take place over the Internet. One recent poll has indicated that the "loss of personal privacy" is the number one concern facing the United States in the twenty-first century. 8. The Federal Trade Commission today plays a critical role in protecting consumer privacy, particularly with respect to the offering of commercial services over the Internet, and the resulting collection and use of personal information. STATEMENT OF FACTS DoubleClick's Tracking of Online Activities 9. DoubleClick is a leading provider of Internet-based advertising. The company places advertising messages on Web sites that are part of the "DoubleClick Network," which consists of highly-trafficked Web sites grouped together by DoubleClick in defined categories of interest. Participating sites include AltaVista, The Dilbert Zone, Macromedia, U.S. News Online, PBS Online, Multex Investor Network, Travelocity and Major League Baseball. 10. DoubleClick tracks the individual Internet users who receive ads at Web sites in the DoubleClick Network. When a user is first "served" an ad, DoubleClick assigns the user a unique number and records that number in the "cookie" file of the user's computer. [begin page 3] When the user subsequently visits a Web site on which DoubleClick serves ads, DoubleClick reads and records that unique number. DoubleClick has acknowledged that "Web sites usually place certain information ('cookies') on a user's hard drive usually without the user's knowledge or consent."[1] 11. Using the unique numbers contained in cookies, DoubleClick's "DART" technology enables advertisers to target and deliver ads to Web users based on pre-selected criteria. As a user visits Web sites that utilize DoubleClick's technology, DART collects information regarding the user and his or her viewing activities and ad responses. According to DoubleClick, "[t]he sophisticated tracking and reporting functionality incorporated into DART provides advertisers with accurate measurements of ad performance based on selected criteria."[2] In early 1999, the company described the technology as follows:
Among other capabilities, DART technology allows advertisers "to track a user to the advertiser's own Web site to determine what actions a user takes following a click-through." 12. Through the use of cookies and DART technology, DoubleClick's collection of consumer information is extensive. In December 1998, the company received over 5.3 billion requests for the delivery of ads generated by approximately 6,400 Web sites. DoubleClick estimates that more than 48 million users worldwide visited Web sites within the DoubleClick Network during December 1998. According to Media Metrix, 45.8% of Internet users in the United States visited Web sites within the DoubleClick Network during the same month. During the fourth quarter of 1998, DoubleClick placed approximately 18,000 Internet advertisements for over 2,300 advertisers. In calendar year 1998, DoubleClick's DART technology delivered approximately 34 billion advertising impressions worldwide. [begin page 4] 13. DoubleClick reportedly has compiled approximately 100 million Internet user profiles to date. DoubleClick's Prior Assurances of Anonymity 14. DoubleClick has publicly represented that any information it collected about Internet users and their online activities was, and would remain, anonymous. Thus, the "Privacy Policy" displayed at the DoubleClick Web site in 1997 (attached hereto as Exhibit A) provided:
The "Privacy Policy" displayed at the DoubleClick Web site in 1997 did not state that it was "subject to change," or otherwise indicate that the assurance of anonymity was in any way conditional.[3] Likewise, the "Privacy Policy" displayed at the DoubleClick Web site in 1998 (attached hereto as Exhibit B), when the company served some 34 billion advertising impressions, provided:
The "Privacy Policy" displayed at the DoubleClick Web site in 1998 did not state that it was "subject to change," or otherwise indicate that the assurance of anonymity was in any way conditional. 15. DoubleClick's business partners have similarly represented that DoubleClick cookies generated at their Web sites were anonymous and that no personally-identifiable [begin page 5] information would be collected by DoubleClick or its business partners as a result of the placement of DoubleClick cookies. DoubleClick's Acquisition of Ababus Direct 16. On June 13, 1999, DoubleClick entered into an agreement to acquire Abacus Direct Corporation ("Abacus"), a leading provider of specialized consumer information and analysis for the direct marketing industry. 17. Abacus created and directs the Abacus Alliance, a cooperative arrangement through which more than 1,050 direct marketers contribute their customers' purchasing histories to Abacus for inclusion in a comprehensive database. As of December 31, 1998, the Abacus database contained over 88 million detailed buyer profiles compiled from records of over 2 billion catalog purchasing transactions. Abacus claims that the Abacus Alliance members include over 75% of the largest consumer merchandise catalogs in the United States. The database is continually enhanced as members contribute current sales transaction information and as additional companies join the Abacus Alliance. 18. Since at least as early as 1998, the Abacus database has contained information identifying and tracking the activities of Internet users. On November 2, 1998, Abacus formed a strategic alliance with Catalog City, Inc., an on-line catalog Web site offering on-line shopping services to catalog shoppers, to jointly promote each others services and share certain "e-commerce data." That information includes consumer e-mail addresses and phone numbers, online transactions and "click data."
19. Subsequent to entering into the agreement to acquire Abacus, DoubleClick began to distance itself from its earlier assurances that users would "remain completely anonymous." A revised "Privacy Policy" posted on the DoubleClick Web site in or around June 1999 (attached hereto as Exhibit C) stated:
[begin page 6]
20. Under the heading of "Future Plans," DoubleClick stated as follows in its revised "Privacy Policy" posted on the DoubleClick Web site in or around June 1999:
There is no indication that DoubleClick's business partners, who operate the Web sites at which Internet users convey personally-identifying cookies to DoubleClick, made similar revisions to the privacy statements posted at their Web sites. 21. On November 23, 1999, DoubleClick completed its acquisition of Abacus. For the first time, DoubleClick stated that "personally-identifiable information" (including "the user's name, address, retail, catalog and online purchase history, and demographic data") would be combined with "non-personally-identifiable information collected by DoubleClick from Web sites on the DoubleClick Network." Specifically, a revised "Privacy Policy" currently (as of February 9, 2000) posted on the DoubleClick Web site (attached hereto as Exhibit D) states as follows:
[begin page 8] The Inadequacy of DoubleClick's "Opt-Out" Procedure 22. The most recent version of DoubleClick's "Privacy Policy" purports to offer users the ability to "opt-out" of the information sharing activities described above. It states, in pertinent part:
23. The vast majority of Internet users who receive cookies from DoubleClick never visit the DoubleClick Web site and therefore never learn of the "opt-out" procedures described by the company. DoubleClick cookies are placed on users' computers when users visit third-party Web sites that display ads placed by DoubleClick. Users are rarely given notice by such third-party Web sites that they need to visit the DoubleClick Web site in order to understand DoubleClick's data collection activities or learn about any available "opt-out" procedures. 24. A large percentage of DoubleClick cookies are placed on the computers of users who visit the AltaVista Web site. Approximately 18.7% of DoubleClick's revenues for the nine months ended September 30, 1999, resulted from advertisements delivered on or through the AltaVista Web site. Approximately 41.2% of DoubleClick's systems revenues for the nine months ended September 30, 1999, resulted from AltaVista billings.[4] 25. Visitors to the AltaVista Web site are not provided notice that their use of the AltaVista site will result in the placement of DoubleClick cookies on their computers. The AltaVista "Privacy Policy" displayed on February 9, 2000 (attached hereto as Exhibit E) provides, in pertinent part:
The AltaVista "Privacy Policy" does not contain any reference to DoubleClick. Inaccurate Information Posted by DoubleClick's Partners 26. Some third-party Web sites that generate DoubleClick cookies do inform users of their relationship with DoubleClick and that DoubleClick places cookies on the computers of users who visit such third-party sites. Some of those Web sites continue to assure users that they will remain anonymous. For instance, the "Privacy Stuff" page at the Dilbert TV Web site (attached hereto as Exhibit F) displayed the following information on February 9, 2000:
VIOLATIONS OF SECTION 5 OF THE FTC ACT 27. Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits unfair or deceptive acts or practices in or affecting commerce. DoubleClick's Activities Constitute Deceptive Trade Practices 28. DoubleClick has publicly represented that any information it collected about Internet users and their online activities was, and would remain, anonymous. [begin page 10] 29. In truth and in fact, DoubleClick intends to combine data it has consistently described as "non-personally-identifiable information" with users' names, addresses, retail, catalog and online purchase histories, and other personally-identifiable information contained in the Abacus database. Therefore, DoubleClick's representations concerning the anonymity of information it collected and collects about Internet users were, and are, deceptive practices. DoubleClick's Activities Constitute Unfair Trade Practices 30. DoubleClick's collection of information about Internet users, through the placement of cookies on users' computers and the linkage of cookie-generated data with information contained in the Abacus database, is performed without the knowledge or consent of the great majority of Internet users who receive DoubleClick cookies. Users who receive DoubleClick cookies on their computers do not knowingly access the DoubleClick Web site. Many of DoubleClick's partners, who operate the Web sites which generate DoubleClick cookies, provide either no information or inaccurate information about the placement of such cookies and the manner in which data about users will be collected or used. As a result, the great majority of users who receive DoubleClick cookies neither know that their activities are being monitored, nor are aware of any "opt-out" procedures that might be available. 31. DoubleClick's collection of information about Internet users, through the placement of cookies on users' computers and the linkage of cookie-generated data with information contained in the Abacus database, without the knowledge or consent of Internet users, is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers and not outweighed by countervailing benefits to consumers or competition, and therefore is an unfair practice. 32. DoubleClick has publicly represented that any information it collected about Internet users and their online activities was, and would remain, anonymous. 33. DoubleClick's plan to combine "non-personally-identifiable information" with users' names, addresses, retail, catalog and online purchase histories, and other personally-identifiable information contained in the Abacus database, in violation of its representations to the contrary, is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers and not outweighed by countervailing benefits to consumers or competition, and therefore is an unfair practice. Consumer Injury 34. DoubleClick's conduct, as set forth above, has injured consumers throughout the United States by invading their privacy; using information obtained through the placement of DoubleClick cookies in ways and for purposes other than those consented to or relied upon by such consumers; causing them to believe, falsely, that their online [begin page 11] activities would remain anonymous; and undermining their ability to avail themselves of the privacy protections promised by online companies. 35. Absent injunctive relief by the Commission, DoubleClick is likely to continue to injure consumers and harm the public interest. 36. Absent injunctive relief by the Commission in this matter, other companies will be encouraged to collect personally-identifiable information from consumers in an unfair and deceptive manner. 37. Absent injunctive relief by the Commission in this matter, the privacy interests of consumers engaging in online commerce and other Internet activities will be significantly diminished. REQUEST FOR RELIEF WHEREFORE, EPIC requests that the Commission: A. Initiate an investigation into the information collection and advertising practices of DoubleClick and the Web sites on which DoubleClick places advertisements and/or generates cookies on the computers of Internet users; B. Order DoubleClick to destroy all records it created concerning Internet users during any period of time in which DoubleClick or any of its business partners were assuring the anonymity of the information DoubleClick collected; C. Order DoubleClick to obtain the express consent of any Internet user about whom DoubleClick intends to create a personally-identifiable record, and to develop such means as are necessary to ensure that the user has access to the complete contents of the record; D. Order DoubleClick to pay a civil penalty equal to fifty percent (50%) of the revenues it obtained as a result of the practices described herein, or such other civil penalty as may be appropriate; E. Permanently enjoin DoubleClick from violating the FTC Act, as alleged herein; and F. Provide such other relief as the Commission finds necessary to redress injury to consumers resulting from DoubleClick's violations of the FTC Act. Respectfully Submitted, Copyright Tech Law Journal
ELECTRONIC PRIVACY INFORMATION CENTER February 10, 2000 FOOTNOTES [1] DoubleClick Inc. Form 10-K/A (Amendment No. 2) for Calendar Year Ended December 31, 1998. [2] Id. [3] The attached print-outs of material displayed at the DoubleClick Web site in previous years were obtained from cached copies of Web pages that EPIC accessed through the Google search engine at http://www.google.com/ [4] DoubleClick Inc. Form 10-Q for the Quarterly Period Ended September 30, 1999. |
|
