DoubleClick is an Internet advertising company that tracks Internet
user behavior in order to better target banner ads. In order to add
more information to these profiles of individual behavior, DoubleClick
completed a merger on November 24, 1999 with Abacus Direct, a giant
in offline marketing information. To be able to merge DoubleClick's
already collected information with the data in the hands of Abacus Direct,
DoubleClick had to personally identify all the information they previously
On February 10, 2000, EPIC filed a complaint
with the Federal Trade Commission (FTC) alleging that DoubleClick's
decision to personally identify their profiles constitutes "unfair and
deceptive" business practices. Not only did DoubleClick deceive consumers
by claiming in multiple earlier privacy policies that information collected
would remain anonymous, the company also unfairly collects and links
information about Internet users without their knowledge or control.
Later, DoubleClick revealed in a document
filed with the Securities and Exchange Commission that the FTC is currently
investigating the company's privacy practices. In addition to the ongoing
FTC investigation, DoubleClick faces several class action lawsuits,
legal action from the Michigan Attorney General's office, and an informal
inquiry from the New York State Attorney General's office.
On March 2, DoubleClick CEO Kevin O'Connor released a statement
that says the company made a "mistake by planning to merge names with
anonymous user activity across Web sites in the absence of government
and industry privacy standards.''
On January 22, 2001, the FTC released a letter
announcing that it had closed its investigation of DoubleClick.
Who is DoubleClick?
DoubleClick Inc. is an Internet
stored on your computer to determine what sort of ads you might be interested
in seeing based on your viewing habits. In the course of recording your
viewing habits, DoubleClick is collecting information about your interests
and tastes that includes the things you buy, the stories you read, and
the websites you visit. Recently, the company has created controversy
by personally identifying - linking up with a name or address -- these
profiles of viewing habits.
How do cookies track users?
Cookies are small text files stored on Internet browsers that assign
unique numbers to individual users. These cookies are usually placed
on Internet users' computers by websites without their knowledge. Every
time that a user returns to the site that placed a cookie on their browser,
the cookie is sent back from your user to the original website, providing
a way to "remember" over time particular individuals.
DoubleClick has chosen to take advantage of this technology for the
purpose of learning about the behavior of Internet users. DoubleClick's
banner advertisements appear across the Internet on thousands of different
kinds of sites. Whenever one views a DoubleClick banner ad -- this does
not require clicking on an ad -- you are downloading an image from DoubleClick.
With the download, DoubleClick also places a cookie on users' browsers.
If, like the majority of Internet users worldwide, you already have
a cookie on your browser, then DoubleClick knows where you downloaded
one of their ads. By keeping track of users surreptitously, DoubleClick
is keeping a detailed record, often referred to as a profile, about
what sites you visit.
Who is Abacus?
Abacus Direct Corp. is a
company that collects information about consumers' purchasing habits
through a database that tracks catalog subscriptions and purchases.
Through this database, Abacus knows your credit card numbers, personal
address, telephone number and information about your household income,
family makeup and other habits.
What is the Abacus Alliance?
The Abacus Alliance is an unidentified consortium of companies that
are passing on personal information such as names and addresses volunteered
on their sites to DoubleClick. These actions by Abacus Alliance members
is what allows DoubleClick to personally identify profiles.
What is the scope of DoubleClick advertising?
The most recent estimates indicate that DoubleClick serves ads and
tracks users on more than 11,000 websites. In the four years of its
existence, DoubleClick has collected roughly 100 million profiles of
Internet users. According to Media Metrix, 45.8% of Internet users in
the United States visited DoubleClick Network web sites in a single
month (December 1998).
Are some of your favorite sites part of the DoubleClick advertising
network? A partial list of websites operating within the DoubleClick
network is available divided up by the following categories: Auto,
What are the privacy problems with the merger?
Many of the privacy problems with the recent merger stem from the inability
of the vast majority of consumers to either control the collection of
information concerning Internet user behavior or the linking of profiles
with real identities.
These personally identified profiles are currently used for the delivery
of targeted online advertising. But, the fact that these profiles become
personally identified allows for potential offline uses. Perhaps law
enforcement authorities may want to know what stories you have been
reading. Perhaps an employer would want to know what websites a prospective
employee visits on their free time.
The pervasive nature of DoubleClick's profiling will also fundamentally
change the online experience for the growing number of Internet users.
One of the unique features of the Internet and the World Wide Web has
been the non-discriminatory manner in which resources and products have
been provided. In the current environment, single websites collect information
about their customers behavior after they have established a business
to customer relationship. DoubleClick's reach and scope allows them
to use information collected about you without your knowledge on any
of the thousands of websites on which they operate. DoubleClick could
end the presumption of anonymity that most Internet users currently
What should be done about DoubleClick?
EPIC's complaint filed with the Federal Trade Commission presents the
following as relief for consumers that have been injured by DoubleClick's
unfair and deceptive business practices:
A. Initiate an investigation into the information collection
and advertising practices of DoubleClick and the Web sites on which
DoubleClick places advertisements and/or generates cookies on the computers
of Internet users;
B. Order DoubleClick to destroy all records it created concerning
Internet users during any period of time in which DoubleClick or any
of its business partners were assuring the anonymity of the information
C. Order DoubleClick to obtain the express consent of any Internet
user about whom DoubleClick intends to create a personally-identifiable
record, and to develop such means as are necessary to ensure that
the user has access to the complete contents of the record;
D. Order DoubleClick to pay a civil penalty equal to fifty percent
(50%) of the revenues it obtained as a result of the practices described
herein, or such other civil penalty as may be appropriate;
E. Permanently enjoin DoubleClick from violating the FTC Act, as
alledged herein; and
F. Provide such other relief as the Commission finds necessary to
redress injury to consumers resulting from DoubleClick's violations
of the FTC Act.
DoubleClick's privacy practices are neither an isolated incident nor
will it likely be the last. Online profiling of known users is clearly
invasive and should end. Online profiling of unknown users may be acceptable
if there is (a) a robust technology that maintains anonymity and (b)
a legal framework that supports anonymity. Without such a legal framework,
there are no reassurances that profiles that are collected under the
promise of anonymity will stay that way.
EPIC strongly supports the Organization for Economic Co-operation and
Privacy Guidelines as providing proper legal safeguards for privacy
protection in the online and offline world.
Senate Testimony on Online Privacy from July 1999 (PDF)
Federal Trade Commission
Page on Marketing and Privacy
Smith's Page on Internet Privacy Issues
If your questions have not been sufficiently answered by this sheet,
please e-mail us.