http://online.wsj.com/article/SB10001424052748704416904575502261335698370.html

SEPTEMBER 19, 2010

'Cookies' Cause Bitter Backlash

Spate of Lawsuits Shows User Discomfort With Latest Innovations in Online-Tracking Technology

By JENNIFER VALENTINO-DEVRIES and EMILY STEEL

Tools that track users' whereabouts on the Web are facing increased regulatory and public scrutiny and prompting a flurry of legal challenges.

Since July, at least six suits have been filed in U.S. District Court for the Central District of California against websites and companies that create advertising technology, accusing them of installing online-tracking tools that are so surreptitious that they essentially hack into users' machines without their knowledge. All of the suits seek class-action status and accuse companies of violating the federal Computer Fraud and Abuse Act and other laws against deceptive practices.

In 2001 and 2003, courts ruled that websites could place small text files called "cookies" on machines. Cookies allow sites to remember users, so they don't have to log in user information on each visit. But they can also be used to track users across websites, compiling a profile of a user's browsing interests.

The earlier decisions said tracking across websites was legal. Since then, online tracking has become the foundation of the $23 billion online advertising industry. The industry says tracking tools help subsidize content, allowing many websites to be free to users.

The new lawsuits challenge the older rulings because modern tracking tools are more sophisticated than early cookies.

In one of the lawsuits, filed last week in the Central District of California, three California residents sued Cable News Network, Travel Channel and others over alleged tracking of Web surfing on mobile phones using technology that the suit says is particularly difficult to delete. A spokesman for Scripps Networks Interactive Inc., which controls the Travel Channel, said the company doesn't comment on pending litigation. Time Warner Inc., which owns CNN, declined to comment.

Another suit, filed earlier this month, accuses Fox Entertainment Group and the American idol.com website of using a new kind of cookie--known as a Flash cookie--that can "re-spawn" tracking files that users have deleted, without users' knowledge. News Corp., which owns Fox Entertainment Group as well as The Wall Street Journal, declined to comment on the litigation.

The tools cited in the suits are part of an "arms race" in tracking technologies, said Chris Hoofnagle, director of the Berkeley Center for Law & Technology's information-privacy programs. Some users, uncomfortable with tracking, now routinely block or delete cookies. "There are some in the industry who do not believe that users should be able to block tracking, so they are turning to increasingly sophisticated tools to track people," he said.

One such technology involves "Flash cookies," which use Adobe Systems Inc.'s popular Flash program to save a small file on a user's computer. Flash is the most common way to show video online. Flash cookies can be useful for remembering preferences, such as volume settings for videos. But marketers also can use Flash cookies to track users online.

Last year, researchers including Mr. Hoofnagle at Berkeley found that some Flash cookies were being used to re-create regular browser cookies that users had deleted. (The researchers included Ashkan Soltani, a technology consultant who later helped The Wall Street Journal analyze popular websites for its "What They Know" series, which has been documenting the increasing scope and intrusiveness of the tracking industry.)

Adobe and the Network Advertising Initiative, an industry group, condemn the practice of using Flash cookies to re-spawn deleted cookies.

The Flash-cookie suits allege that companies violated federal law by thwarting users' attempts to limit tracking. The most recent, which involved American idol.com, cites online advertising technology company Clearspring Technologies Inc. as the originator of these cookies. A similar lawsuit in August against Clearspring cited the Journal's "What They Know" series on the growing prevalence of tracking technologies.

In August, Clearspring CEO Hooman Radfar said in a statement on the company's blog that the company doesn't use Flash cookies for tracking. He said that it used Adobe Flash local storage to count visitors to sites and how long they spent on the site. The company says the claims in the suit are "factually inaccurate," adding, "Clearspring does not and never did collect, store, or sell Personally Identifiable Information."

Mobile tracking is also on the rise, as online advertisers attempt to reach consumers on smartphones. Lawyers involved in the suit over mobile websites say companies are using technology that makes it difficult for users to block or prevent tracking. That suit alleges that a company called Ringleader Digital Inc. tracks users of Apple Inc.'s iPhone by assigning each phone a unique ID number, similar to a cookie. If a user deletes the ID number, the suit claims, it respawns itself moments later.

Apple declined to comment on the use of the iPhone in the alleged practices, but Apple CEO Steve Jobs has previously said companies should ask consumers "every time" if they want to use their data.

Ringleader Digital says it is evaluating the lawsuit carefully and intends to defend its practices vigorously. The company says users can delete the ID number from their iPhones. It also says users can opt out of the tracking by going to the company's website.

"We are working on new ways for consumers to be able to verify for themselves that their opt-outs have taken effect," the company said in a statement.

Congress and regulators also are looking more closely at online tracking. Two bills have been introduced in the House of Representatives that would restrict the practice. The Federal Trade Commission is expected to issue new privacy guidelines by the end of the year and is considering a do-not-track registry, similar to the do-not-call list for telemarketing, that would allow consumers to opt out of behavioral targeting.

"We're examining these types of issues both as a policy matter and in connection with non-public investigations," said Jessica Rich, deputy director of the FTC's bureau of consumer protection.

--Shira Ovide contributed to this article.

Write to Jennifer Valentino-DeVries at jennifer.valentino@wsj.com and Emily Steel at emily.steel@wsj.com