Privacy fighters chase Realnetworks into court

Realnetworks is facing legal action from several irate users of its Realjukebox software, accusing the company of violating the privacy of millions of Internet music listeners by secretly gathering personal information.

The first case, a $500 million class action suit, was filed by Jeffrey Wilens in California Superior Court, swiftly followed with a case filed in the Federal District Court for the Eastern district of Pennsylvania on behalf of four Realnetworks users from Colorado, Kansas and Pennsylvania.

Hitting a sour note

It all turned sour for Realnetworks earlier this month when security consultant Richard Smith discovered that the Realjukebox software was relaying information to Realnetworks about what music and CDs he was listening to, which songs were recorded on the hard drive, and the type of portable MP3 player he owned. It also passed on an ID number that identified who he was.

The culprit was the globally unique identifier (GUID), a unique serial number which Realjukebox issued for each user. This meant users' personal registration information such as name and email, which they offered freely at the time of registration, could be identified from the GUIDs.

Using Realjukebox's Get Music service update, usage information like encoding options, type of portable device used, total song tracks in music database, how the user chose to receive automatic music downloads, and their genre preference, was secretly sent to Realnetworks.

"This monitoring system has the potential to be used as a powerful profiling system to help market new CDs and related products at the expense of personal privacy," said Smith in a report.

The company insists it was only collecting 'aggregate' statistics on how Realjukebox was being used, but despite quickly issuing a patch to block Realjukebox collecting such data, as well as an apology, its customers are far from satisfied.

An apology is not enough

Privacy advocates were the first to criticise Realnetworks. "A simple apology is not good enough. The privacy of the users of this popular piece of software should have been respected in the US and elsewhere," Yaman Akendiz, director of pressure group Cyber-Rights & Cyber-Liberties (UK), told vnunet.com.

Now the users are speaking up, with the Wilens suit seeking to recover $500 for each of the estimated one million Realjukebox users in California. The lawsuit alleges that Realnetworks' conduct violated the user's "Right of Privacy" under the California State Constitution, and also constituted trespassing and unfair business practices.

Jeffrey Spencer, counsel for Wilens said: "While we recognise that Realnetworks has, now that it was caught with its proverbial hand in the cookie jar, supposedly disabled the spying function, that does not begin to address the question of damages suffered by the consumers, nor ensure there will not be additional surreptitious activity."

Seek and destroy

The Federal suit demands that, under the Computer Fraud and Misuse Act, a court order be issued to force Realnetworks to undergo an independent audit to investigate the gathering of personal information. They also request that this data be destroyed, but that a record is kept of its prior existence.

To appease critics, the company last week launched a consumer privacy initiative that it says will help consumers give informed consent before personally identifiable information is gathered about them or used.

However, these lawsuits show that the damage was already done and how easy it is for companies to collect detailed, personal information over the Web without consumers' knowledge and build a personal profile of each user. That information can then be used in direct marketing campaigns or even detect copyright violations.

With so many sites offering music and software downloads, consumers must become more aware of the potential risks when divulging information.