Consumer Law & Policy Blog

Video Professor sues anonymous griping posters, demands their identities

by Greg Beck

Video Professor, a company that uses infomercials to sell computer-training lessons, sued 100 anonymous "John Doe" posters who expressed their opinions about the company on various online forums, including infomercialratings.com. The company's lawsuit claims that the griping posters violated federal trademark laws by saying negative things about the company, and committed defamation and several violations of state law. After filing suit, the company sent subpoenas to the operator of the websites, demanding the release of the posters' identifying information and the IP addresses from which they made the posts. Here's the complaint and the company's motion to subpoena the anonymous posters' identity.  The challenged posts are here and here. 

The Internet has become the preeminent forum for consumers to share information about products and services online. Courts have recognized that the First Amendment protects the right to post criticism anonymously, noting the risk that critical opinions would be chilled if the identity of anonymous critics could too easily be revealed. Indeed, Video Professor's own website advises consumers to search for customer reviews online:

[I]f you decide to use a lesser-known merchant, there are a few things you can do to check out the seller and make sure he’s legit. For one, you can visit the Federal Trade Commission’s Web site for links to consumer protection resources, including lists of complaints lodged against businesses. You also have the option of searching the business section of a major search engine, where you can view company profiles and customer reviews of that company’s products and services. Last but not least, you can request that a seller send you a catalog or other information about his or her company.

My colleague Paul Levy sent a letter to Video Professor today objecting to the subpoena.

Concurring Opinions on Privacy Issues

The Concurring Opinions Blog has a couple of interesting recent posts on consumer privacy issues.  First, Frank Pasquale blogs here about what type of privacy regulation is appropriate for Google and responds to an editorial in the Economist comparing Google to financial institutions, given that both serve as repositories of information about people.  Second, Neil Richards has a posting here titled "Why There's No First Amendment Right to Sell Personal Data."  That's a subject that has drawn scholarly attention before.  See, e.g., Eugene Volokh, Freedom of Speech and Information Privacy: The Troubling Implications of a Right to Stop People From Speaking About You, 52 Stan. L. Rev. 1049 (2000); Daniel J. Solove, The Virtues of Knowing Less: Justifying Privacy Protections Against Disclosure, 53 Duke L. J. 967 (2003).

Study Finds More Mortgage Originations When A Bank is Located in a Low- to Moderate- Income Neighborhood

O. Emre Ergungor, an economist for the Fed, reports in his paper, "Bank Branch Presence and Access to Credit in Low-to-Moderate Income Neighborhoods" on some effects of locating bank branches in low-to-moderate income neighborhood.  Here's the abstract: 

Banks specialize in lending to informationally opaque borrowers by collecting soft information about them. Some researchers claim that this process requires a physical presence in the market to lower information collection costs. I provide evidence in support of this argument in the mortgage market for low-income borrowers. Mortgage originations increase and interest spreads decline when there is a bank branch located in a low-to-moderate income neighborhood.

The paper can be downloaded at http://ssrn.com/abstract=951197.

Comparing Search Engine Privacy Policies

CNET compared the privacy policies of the major search engines and found that, on the whole, they are becoming more responsive to their users' privacy concerns. However, of the five largest search engines, only Ask.com said it would not keep records of its users' searches. For its part, Google recently announced that it would anonymize its users' search records after 18 months.

Consumer lists are not so innocent if you can't opt out

Last Friday, the Christian Science Monitor published the following op-ed piece I wrote:

Protection of personal information has drawn increasing attention because of problems such as identity theft, the Hewlett-Packard pretexting scandal, and data losses by major corporations and government agencies. Congress and the states have responded by enacting numerous statutes to protect consumers. But one type of information that has received less attention is the sale of consumer lists.

While most consumers probably understand that mailing and similar lists exist, many may be surprised by the type of information available. Want a list of Jewish donors broken down by age and the presence of children? Check the Web. One broker offers lists of the members of more than 40 ethnic groups. Or maybe you would like one of the dozens of lists of users of particular medications. Lists can be broken down by income, geography, marital status, age, and gender.

The sale of such lists raises several issues. One issue is simply privacy. To be sure, some list creators offer consumers an opportunity to opt out of the sale of information about them. But federal law imposes no obligation to offer an opt-out, and even compilers who offer an opt-out may not explain that the failure to opt out may land consumers on a list organized by ethnicity or other private information. Of course, list sellers have little incentive to tell consumers things that may cause them to opt out because lengthier lists are more valuable.

The availability of lists also permits marketers to engage in discrimination. Federal law bars discriminating on the basis of national origin, for example, in lending, but it does not prevent a seller of products from sending mailings only to members of a favored group. Sellers can also fine-tune their solicitations and make different offers to different groups.

Finally, while it seems unlikely that a person wishing to commit hate crimes would purchase a list of members of a particular ethnic group to commit improper acts, the fact that such lists are available is nevertheless cause for concern.

Rather than enacting comprehensive privacy regulation, the US has proceeded ad hoc, passing legislation in response to particular privacy invasions. For example, Congress answered last year's Hewlett-Packard pretexting scandal by enacting a pretexting statute. As a result, privacy laws are a jumble of irreconcilable rules.

If you buy a Harry Potter book and video, federal law bars the seller from disclosing that you bought the video, but nothing prevents the seller from selling information about your book purchases. That is because Congress was outraged in 1987 when a newspaper published the video rentals of then-Supreme Court nominee Robert Bork. But no one published a list of his book purchases.

Congress has also regulated the sale of consumer financial data, credit reports, and health information, in part because they involve particularly sensitive matters. But the types of information on consumer lists may be just as sensitive. Congress should protect consumer privacy by establishing rules to govern the collection and sale of consumer information. At a minimum, it should require list compilers to disclose to consumers the types of lists they could appear on and allow them to opt out. This way the rights of those who wish to protect their privacy are respected.

Consumers Opt In to Receive Text Message Ads

Opponents of opt-in systems for advertising (in which sellers send ads only to consumers who have agreed to receive them) sometimes claim that no one would ever opt in to receive ads, and so the systems won't work.  But yesterday's New York Times E-Commerce Report, headlined "Reaching More Customers With a Simple Text Message," tells a different story.  A quote:

Earlier this year, Moosejaw [Mountaineering, a Michigan retailer,] began sending out text messages to more than 1,000 of its customers who had signed up to receive them. The campaign caught on quickly, with recipients often sending messages back to the retailer and receiving loyalty program points as a reward.

Opt-in systems may be unattractive to sellers because they may reach fewer consumers and are more expensive for sellers than opt-out systems (in which sellers send ads to consumers unless the consumers have objected to receiving them), but at least some consumers are willing to opt in for messages they think are right for them.

Google and Privacy

Privacy advocates have lately been concerned about Google for a number of reasons.  Google reportedly retains records of user searches for eighteen months, has access to the emails of those using its gmail service, and can tell which addresses its users have searched for on Google maps, among other things.  Google's intended acquisition of Doubleclick has prompted EPIC, US PIRG and CDD to file a complaint with the FTC seeking an investigation into the privacy consequences of the acquisition (you can read the initial complaint here and supplementary materials here; EPIC has a page of information about the deal here).   

Google itself says quite a bit about privacy.  Highlights of its privacy policy appear here and from there you can jump to the full privacy policy.  Among the highlights is this quote: "We make good faith efforts to provide you access to your personal information upon request and to let you correct such data if it is inaccurate and delete it, when reasonably possible."  So on June 28, I sent Google the following email through its web site:

I have reviewed Google's Privacy Policy.  I would like to know what specific information, if any, Google retains about me.  For example, I would like to see a list of the search requests I have made that Google retains. 

Thank you.

I haven't yet heard back.  Google's web page through which I sent the email says "We'll review your note and follow up with you only if we require more info or we have additional info to share."  Consequently, I'm not sure if I will in fact hear back from them. 

Which ISPs Are Spying on You?

Frustrated by incomprehensible privacy policies, Wired asked the eight largest Internet Service Providers for straight answers about what records they keep on the Internet activities of their subscribers.  Four of them responded "with a mix of timeliness and transparency."  Only one answered the question, "How long do you retain records of the IP addresses assigned to customers?"  This information can be used to track  subscribers to particular Internet posts, emails, or other activities on the Internet.

The Spy Act Protects Corporations, Not Consumers

by Greg Beck

  Ed Foster at Infoworld analyzes H.R. 964, the Spy Act, Congress' latest response to spyware, and finds it seriously lacking.  The bill includes exemptions that would allow hardware and software vendors to spy on their customers and collect private information, without notice, "for network or computer security purposes, diagnostics, technical support, or repair, or for the detection or prevention of fraudulent activities."  Worse, the law explicitly preempts state laws regulating unfair or deceptive conduct similar to that covered by the law.  All private rights of action will be eliminated, and enforcement authority will be exclusively vested in the FTC and state attorneys general.

It is pretty apparent that the law is not designed to protect consumers, but to protect companies from liability for spying on their customers.  For example, it appears that Sony would be immune from liability under the law for its secret installation of its software "rootkit" on customers' computers, which in 2005 opened the computers up to attacks by viruses and sparked multiple lawsuits.

The bill was approved last week by a subcommittee of the Energy and Commerce Committee and now goes to the full committee for approval with strong bipartisan support.

More Google Privacy Fears

By Greg Beck

Google won at least partial praise from privacy advocates last month with its announcement that it plans to purge identifying information from its database of web searches after 18 to 24 months.  But recent news again raises concerns about Google's privacy policies.

First, Google announced that it plans to acquire DoubleClick, Inc., which distributes Internet-based ads and tracks which ads web browsers click.  The merger raises fears that Google could combine its existing massive databases of its users' search habits with Doubleclick's equally massive database on users' behavior to create a combined database of Web users and their browsing habits. 

Google and DoubleClick claim that they will not merge the data in this way, but critics are not mollified.  The merger prompted three consumer groups, the Electronic Privacy Information Center, PIRG, and the Center for Digital Democracy, to file a complaint with the Federal Trade Commission raising privacy and antitrust concerns.  Although Google's privacy policy discloses that it saves personally identifying information, the objecting consumer groups argue that Google's practices are nevertheless deceptive because the disclosure is difficult to find and because survey data shows that most Google users don't know that Google stores personally identifiable data along with a user's search history.

Second, Google has announced a new service to track every website that web browsers click on from its search results.  The service includes one critical feature that is worthy of praise:  it is completely voluntary.  Google's privacy policy, however, doesn't rule out saving this data even without a user's consent, and, in fact, specifically provides that "Google may present links in a format that enables us to keep track of whether these links have been followed."  Google does store information about which websites users visit in at least some circumstances.  Moreover, when a user clicks on a link from Google's search results, the user's browser is sent to Google's own server before being sent to the requested web page, in a way that would allow Google to track which sites users click.  Google's policy raises concerns that it can link data on which websites its users visit with personally identifying information and that, once again, consumers might not realize the amount of privacy they are sacrificing whenever they search the web.