Article of Interest - Legal Issues
Profits vs. privacy?
By
Frances Katz - Staff
AJC - Wednesday, June 20, 2001
Ask Jeeves' buyout of eTour, mailing lists raising eyebrows
The sale of Atlanta-based eTour's assets --- including its database of 4.5
million registered users --- to Internet search engine Ask Jeeves has raised
issues of privacy on the Web that could have far-reaching impact on the
e-commerce industry.
On May 22, eTour.com sold the user database along with its direct Web site delivery technology and a proprietary direct e-mail marketing technology. Also acquired were eTour's client base of advertisers including Coca-Cola, Nestl, Ralston Purina and eBay.
"One thing that was really compelling was eTour's opt-in mail capability," said Paul Wehrley, Ask Jeeves' vice president of business development, of the acquisition. "It's something we don't have and our advertisers are asking for. They have 2 million unique e-mail subscribers who all asked to receive e-mail. The information they get about their users and their robust registration system will complement our registration system, and we will cross-sell and up-sell to eTour's estimated 5 million users."
However, the sale has been met with raised eyebrows from members of the Internet community who say eTour's sale of the 2 million member e-mail list is a direct violation of its stated privacy policy.
In eTour's privacy statement, the company says it will not give out the name, home address or e-mail addresses of its users to any third parties without the user's permission "for any reason, at any time, ever."
The Electronic Privacy Information Center, or EPIC, and others believe that constitutes deceptive business practices, based on the wording of the Federal Trade Commission Act.
In a letter dated May 25, the EPIC sent a letter to the FTC and state attorneys general calling for a halt to the eTour acquisition because of what it believes to be deceptive trade practices. The letter said in part:
"EPIC asks the Federal Trade Commission and State Attorneys General to block the sale of personal information from eTour Inc. to Ask Jeeves Inc. as an unfair and deceptive trade practice.
EPIC also wishes to point out that the exchange of personal data between eTour Inc. and Ask Jeeves Inc. is part of a growing problem and recommends proactive solutions to prevent such scenarios from occurring in the future."
EPIC went on to say that eTour.com has posted a privacy statement in "at least" four different locations on its Web site stating that it will not share any personal information collected by the company with any third party.
Section 5 of the FTC Commission Act says that online companies must honor any promises they make to consumers. If they fail to do so, according to the commission, they are violating FTC code.
When asked about the EPIC letter, FTC spokesman Claudia Farrell said the agency can't comment on any letters or petitions that have been received.
Ask Jeeves says it's not doing anything wrong.
Heather Staples, vice president of corporate communications for Ask Jeeves, said the acquisition is based on guidelines the FTC created in another case --- involving the sale of user names by ToySmart, a failed dot-com that was prosecuted by the FTC for violating its privacy policy by selling names after the company failed.
"They basically said companies that have customer lists subject to consumer privacy agreements may be sold if they are sold as part of an ongoing business," she said. (Toysmart was selling its list apart from the rest of its business.)
Staples also said the company must be sold to a "qualified buyer," which the FTC defines as a company in a related market and one that agrees with the privacy policy of the acquired company.
"This is a very recent guideline and eTour complies with both of those criteria," she said, adding that the company is also taking additional steps beyond eTour's policy to make sure users' privacy is protected.
"We have issued an e-mail to all the users and offered them an opportunity to opt out of the list," Staples said.
In addition, the company is also working with a privacy organization called Trust-e. "We want to make sure we handle this in the right way with respect to consumer privacy."
Staples said she didn't know EPIC was petitioning the FTC to halt the transaction.
"They didn't know how Ask Jeeves intended to use the customer list," she said. "They just didn't have the full information. We think that if you can't sell the customer list it's a loss for the consumer in the long run."
"It is important what the FTC does in terms of eTour," said Andrew Shen, a senior policy analyst at EPIC who co-wrote the letter to the FTC. He believes he has found more than a few holes in Ask Jeeves' acquisition logic.
"To be quite honest, I think it's an open and shut case," he said. "In this case, allowing eTour to let it sell its information is a violation of state and federal consumer law. Companies can't say they're going to do one thing and then go off and do another. In this specific case, eTour should be prohibited from selling the names because of the statements it made to the public."
Ask Jeeves sent e-mail to all of eTour's registered members on June 2 detailing the deal with eTour and told eTour members it was working to integrate the privacy policies of the two companies into one privacy policy. It also offered users the opportunity to terminate their membership with eTour.
Offering eTour members that opt-out option may be one way to skirt the wrath of the FTC, according to Forrester Research analyst John McCarthy.
"If it is giving the users the opportunity to opt out, that will work in its favor," he said. "Clearly it's going to force the issue of how accountable you are by the language you use. Amazon reworded its privacy policy to say if the company ever did go out of business, it could sell its customer lists to third parties."
"They took a lot of flak for it," McCarthy said. "But they did it anyway."
McCarthy said Ask Jeeves and others may be able to get away with buying and selling lists because there are no hard and fast rules regarding Internet privacy on the Web at the FTC or anywhere else.
"We call it the 'privacy paradox,' " said Colin Crowell, an aide to Rep. Ed Markey (D-Mass.), ranking member of the House Subcommittee on Telecommunications and the Internet.
"If you post a privacy policy and you violate that policy, the FTC can prosecute you. But the paradox is that if you post no privacy policy at all and then engage in daily acts of data pillaging across the Internet you are free to do so because you have not been deceptive. You have not told people you would do otherwise."
Crowell said current regulations are insufficient to protect consumers, "which is why we'll need a law eventually."
Forrester's McCarthy said privacy policies aren't an issue unless a company is in trouble.
"Companies that are doing fine and dandy it's not an issue. When they are forced into a spot where they have to choose, between being forced to violate their own privacy policy and forced to sell what is, to be quite honest, one of their primary assets," McCarthy said.
"When you get right down to it, none of these companies has much to sell at the end of the day. This is the only way they can cut their losses," McCarthy said.
EPIC's Shen said simply posting a privacy statement on a Web site is not enough to protect consumers.
In the long run, Shen said the current system is not a very good way to protect Internet users.
"Placing these policies at the FTC is not very efficient," Shen says. "Consumers should have a way to complain on their own."
Despite the swirling debate around Ask Jeeves' snapping up eTour's mailing list, the company maintains it is doing more, not less, to protect users' privacy.
"In the offline world, this kind of thing (selling mailing lists from one company to another) is rampant," says Ask Jeeves' Staples. "There's a new hysteria around the question of privacy. The average person actually has more privacy now than they used to."
Ask Jeeves
Can a dot-com sell its mailing list and not violate its
privacy policy?
> "ETour Inc. has stated repeatedly that it would
never, in any circumstance, disclose personal information to any third party. To
EPIC's knowledge, Ask Jeeves Inc. prior to May 22, had no ongoing commercial
realationship with eTour Inc., as a partner, subsidiary or a parent company.
Thus, Ask Jeeves Inc. should be considered a third party."
--- Excerpt from a letter to the Federal Trade
Commission from the Electronic Privacy on the Internet Center, arguing that the
acquisition of eTour by Ask Jeeves violates eTour's privacy policy and may be
deceptive to consumers, May 2001.
> The core privacy battle this Congress will focus on
is the Internet, with the industry pushing for opt-out and privacy advocates
holding out for opt-in.
--- Forrester Report "Surviving the Privacy
Revolution," February 2001.
> In principle, Americans do not like the idea of
tracking and profiling. By a 2-to-1 margin they say that tracking is an invasion
of privacy rather than a tool to help Web sites provide customized information
to users. Still, relatively few take steps to shield their identities.
--- Lee Rainie, director of Pew Internet and American
Life Project, testifying before a House subcommittee, May 2001.
> In general, majorities of consumers think it would be
best if businesses put good privacy policies in place voluntarily and saw to
their wide implementation. If they fail to do so, consumers want the law to step
in.
--- Dr. Alan Westin, president, Privacy and American
Business, testifying before a House subcommittee, May 2001.
/ TROY OXFORD / Staff
