May 25, 2001
Federal Trade Commission
600 Pennsylvania Avenue, NW
Washington, DC 20580
National Association of Attorneys General
750 1st Street, NE
Washington, DC 20002
Dear Commissioners and State Attorneys General,
EPIC wishes to alert you to a violation of federal and state consumer protection law that concerns the privacy of millions of Internet users. On May 22, Ask Jeeves, Inc. announced in a press release that it was purchasing certain assets belonging to eTour, Inc.1 These assets include personal information of millions of Internet users provided exclusively to eTour, Inc.2 Ask Jeeves, Inc. runs a search engine website at www.askjeeves.com. eTour, Inc. maintains a website at www.etour.com that primarily gives Internet users virtual tours of websites that appeal to a user's declared interests.
EPIC asks the Federal Trade Commission and State Attorneys General to block the sale of personal information from eTour, Inc. to Ask Jeeves, Inc. as an unfair and deceptive trade practice.
EPIC also wishes to point out that the exchange of personal data between eTour, Inc. and Ask Jeeves, Inc. is part of a growing problem and recommends proactive solutions to prevent such scenarios from occurring in the future.
Sale of personal information from eTour, Inc. to Ask Jeeves, Inc.
An Ask Jeeves, Inc. press release from May 22, 2001 states that the following assets were purchased from eTour, Inc.:-- The eTour.com Web property, which has more than 4.5 million registered users and 370,000 daily unique users according to the Jupiter Media Metrix April report;
-- eTour's direct Web site delivery engine, which provides users with guided tours of Web sites based on their personal interests;
-- A proprietary direct e-mail marketing technology with 2.2 million unique newsletter subscribers and more than 450,000 opt-in special offer subscribers;
-- A registration system that leverages rich demographic information to deliver highly specific content;
-- More than 230 vertical Web site "tours"; and
-- A strong advertiser base, consisting primarily of traditional advertisers.3
The assets purchased by Ask Jeeves, Inc. from eTour, Inc. include the registration information from an estimated 4.5 million users and a list of 2.2 million e-mail newsletter subscribers.
The eTour, Inc. registration form requires users to provide information about their interests, first name, zip code, state and country of residence, e-mail address, birth date and gender. The registration form also asks for profession, housing status (owning or renting) and household income level as optional information.4 The e-mail newsletter subscribers are presumed to provide at least an e-mail address to eTour, Inc.
eTour, Inc.'s declarations restricting sale of personal information
eTour.com represents, in at least four different locations on its website, that it will not share any personal information collected by the company with any third party.
The eTour.com Privacy Guarantee states, in bold, that "eTour will not give out your name, residence address, or e-mail address to any third parties without your permission, for any reason, at any time, ever."5
The eTour.com registration form states that "eTour will use this information, along with your interest selections, to find the web sites you are most likely to enjoy. We will NEVER share your personal information."6
The eTour.com Frequently Asked Questions page states, in response to the question "Is eTour going to give out my personal information to other companies?" that "eTour will never release any identifying information about you."7
The eTour.com Member Agreement states that "[a]lthough eTour will not release your identifying information to third parties, you may be asked by third party Web sites viewed via eTour to release such information. You are never required to release this information, and whether you do is optional and strictly up to you."8
These declarations, separately and together, clearly state to registered users and other visitors to the eTour.com website that personal information collected by the company will not be shared, released or given out to any third parties. Furthermore, those who provided personal information to eTour, Inc. acted in reliance on the representations made.
eTour, Inc. must be prohibited from selling personal information to Ask Jeeves, Inc.
Section 5 of the Federal Trade Commission Act ("FTC Act") prohibits "unfair or deceptive acts or practices in or affecting commerce."9 In earlier actions, the Federal Trade Commission has applied and enforced the FTC Act against companies that have misled consumers about their privacy practices.10 For example, in its complaint against Toysmart.com, the FTC states that:From at least September 1999 to the present, defendant Toysmart, directly or through its employees and agents, in connection with its collection of personal consumer information, expressly and/or by implication, represented that it would "never" disclose, sell, or offer for sale customers' or registered members' personal information to third parties.11
The FTC goes onto conclude that:In truth and in fact, Toysmart has disclosed, sold, or offered for sale its customer lists and profiles. Therefore, the representation set forth in Paragraph 15 was, and is, a deceptive practice.12
Toysmart's conduct, as set forth in Paragraphs 6-16 will injure consumers throughout the United States by invading their privacy.13
Many states also have consumer protection statutes that require companies to follow their publicly stated practices. In short, these federal and state statutes require companies to abide by their self-imposed obligations publicly made to consumers.
eTour, Inc. stated repeatedly that it would never, in any circumstance, disclose personal information to any third party. To EPIC's knowledge, Ask Jeeves, Inc., prior to May 22, had no ongoing commercial relationship with eTour, Inc. as a partner, subsidiary or parent company. Thus, Ask Jeeves, Inc. should be considered a third party.
Therefore, due to its public declarations to consumers that it would never share personal information with third parties, eTour, Inc. should be prohibited from selling its customers' personal information to third party Ask Jeeves, Inc. The FTC and State Attorneys General should use existing and established powers to prevent deceptive practices to halt this trafficking in personal data.
The sale of personal information by eTour, Inc. is part of a growing problem
The sale of personal information to third parties, as in the transfer of information from eTour, Inc. to Ask Jeeves, Inc., has always been a high priority issue for privacy protection. However, as the e-commerce industry is currently undergoing a tumultous period, it is likely that the public and policymakers will continue to confront scenarios similar to the one described in this letter. That is because some may consider the purchase of eTour, Inc. assets by Ask Jeeves, Inc. to be a merger or consolidation rather than an outright sale. According to some news reports, Ask Jeeves, Inc. is not merely purchasing personal data - it is in fact integrating eTour, Inc. services into its own.14
While this does not throw into question that eTour, Inc. must live up to its publicly made commitments, it does highlight the shortcomings of the current self-regulatory approach as applied to mergers, acquisitions and bankruptcies.
The failures of self-regulation as applied to mergers, acquisitions and bankruptcies
eTour, Inc., as noted several times above, has made strong commitments that the personal data of its customers would not be transferred to any third parties. Under the current self-regulatory approach to privacy protection, companies are held to these public statements as legal commitments. In addition, companies that seek to provide a high level of privacy protection will, in many cases, make statements such as those made by eTour, Inc. - it will not share information with any third parties.
However, the ongoing evolution in the e-commerce sector make it more likely that many companies will be merged, acquired or sold off piece by piece in the course of a bankruptcy. In all three types of scenarios, part of what is being merged, acquired and sold is personal data, be it names, physical addresses or detailed information about purchasing habits. The most controversial of these cases was Toysmart.com, an e-commerce company catering to children that announced it would be auctioning off its customer lists in June 2000.
Self-regulation forces companies and consumers into an untenable situation. If a company wishes to demonstrate that it protects personal information at a high level, it will likely make strong statements about not sharing any personal information with a third party. However, the current changes in the market seem to require that many e-commerce companies will be merged, acquired or sold off piece by piece - all transactions of personal information to a third party. The one strategy that companies have developed on their own to cope with this scenario is to include clauses, such as Amazon.com's, asserting retroactive and future rights over already collected personal data. However, this is an unfair practice for consumers, akin to changing the terms of a contract after both parties have signed.
Flexibility and Fair Information Practices
Mergers, acquisitions and bankruptcies present a problem for self-regulation because almost all businesspeople, when starting their respective businesses, believe that they will be successful - that their company will not be swallowed up by a competitor or be forced to liquidate due to the demands of their creditors. For these optimistic businesspeople, they can adopt high levels of privacy protection since they do not expect to have to sell their customers' personal information as in the case of eTour, Inc.
As we have seen in the e-commerce sector, things can quickly change. Companies have been forced to scale back their earlier optimism resulting in changes to their privacy policies as they prepare to sell off the personal data of their consumers through bankruptcy or as a merger with a third party. Self-regulation is not well-equipped to deal with a fast-changing marketplace because privacy policies confine companies to terms at one point in time and do not accommodate future change.
Privacy advocates have long held that privacy protection should be built on Fair Information Practices as opposed to the varying terms contained in privacy policies. To be even more specific, privacy advocates have supported the Organization for Economic Co-operation and Development (OECD) 1980 Privacy Guidelines.18 Fair Information Practices establish several important rights not provided by the majority of privacy policies but two are worth noting in the context of mergers, acquisitions and bankruptcies: use limitation and access.
The use limitation principle states that personal information collected should not be used in ways than those other than specified without the consent of the data subject. The use limitation principle does not seek to state in definitive terms whether information should be prohibited from being transferred to third parties or whether information should always been prevented from being sold. This principle only asserts that consumers should have an ongoing ability to control how information is used in the future. Rather, this principle guarantees the involvement of consumers in future, possible uses of their personal data.
The access, otherwise known as individual participation, principle ensures that consumers can review and ensure the accuracy of information that has already been collected. This principle, like the use limitation principle, ensures that consumers are involved in data protection past the original point of data collection. In the cases of mergers, acquisitions, and bankruptcies, establishment of an access principle would likely assure consumers that such transfers of information does not put their privacy at risk by allowing them to verify what information is in fact being transferred. One criticism that has plagued previous controversial cases such as Toysmart.com are questions, left unanswered, of what information was in fact transferred. This became a highly sensitive matter as Toysmart.com collected information such as children's names and ages.
Both of these Fair Information Practice principles ensure that consumers are involved in privacy protection after that is collected, something lacking in the current self-regulatory environment. This has special significance for the current environment of mergers, acquisitions, and bankruptcies since these are, in the vast majority of cases, unexpected and unanticipated changes that take place after the initial establishment of privacy policies. By involving consumers in these changes through Fair Information Practices, companies have a much better chance of gaining the confidence of Internet users and protecting their privacy.
Given public statements by Ask Jeeves, Inc. and publicly available materials provided by eTour, Inc., the Federal Trade Commission and appropriate State Attorneys General should move swiftly to prevent a sale of personal information as an unfair and deceptive trade practice. Further, in the future, it is quite likely that policymakers will confront similar situations in the future as a result of the ongoing shakeout and consolidation in the Internet industry. To protect the privacy of Internet users in this environment, policymakers should look towards legislative solutions based on Fair Information Practices that provide more flexibility than self-regulation which has the undesirable outcome of locking companies and consumers into practices that may only be feasible at a single point in time.
Senior Policy Analyst
1. "Ask Jeeves Acquires Assets of eTour, Inc., Adding New Features and Revenue Streams to the Ask Jeeves Web Properties Division," http://biz.yahoo.com/prnews/010522/sftu065.html
2. eTour, Inc. has offices in Atlanta, Chicago, New York, Los Angeles and San Francisco. "Company Info: Contact Information," http://www.etour.com/about_contact.htm
3. Skip Battle, CEO of Ask Jeeves, Inc. adds that "[t]he assets we've purchased through this transaction will be an important part of our long-term success. These include universal registration technology, direct e-mail marketing capabilities, more than 4.5 million registered users, deeper vertical content . . . " See note 1.
4. "Personalize Your eTour Experience -- FREE!" http://www.etour.com/register.asp
6. See note 4.
7. "Frequently Asked Questions About eTour" http://www.etour.com/help_NonWTV.htm
8. "Company Info: Member Agreement," http://www.etour.com/about_agreement.htm
9. 15 U.S.C. § 45
10. See "Privacy Initatives," http://www.ftc.gov/privacy/
11. FTC v. Toysmart.com, LLC, and Toysmart.com, Inc. (District of Massachusetts), Complaint for Permanent Injunction and Other Equitable Relief, paragraph 15, http://www.ftc.gov/os/2000/07/toysmartcmp.htm
12. Paragraph 16, see note 11.
13. Paragraph 17, see note 11.
14. "AskJeeves boosts features with Etour," CBS MarketWatch.com, http://www.marketwatch.com/news/yhoo/story.asp?source=blq/yhoo&siteid=yhoo&dist=yhoo&guid=%7B63E2DF7E%2D0948%2D45C1%2DAAB0%2D38AA041C1459%7D; "Ask Jeeves Looks for a Long, Cool Drink of Ad Revenues," TheStandard.com; http://biz.yahoo.com/st/010522/24671.html; "Ask Jeeves Acquires Some Assets Of Struggling Web Firm eTour," WSJ.com, http://public.wsj.com/sn/y/SB990539961666688507.html
15. "Old Amazon.com Privacy Notice (prior to September 2000)," http://www.epic.org/privacy/internet/amazon/old_policy_0900.html
16. "Amazon.com Privacy Notice," http://www.amazon.com/exec/obidos/tg/browse/-/468496/107-2509509-1309345
17. See note 12.
18. "Guidelines on the Protection of Privacy and Transborder Flows of Personal Data," http://www.oecd.org/dsti/sti/it/secur/prod/PRIV-EN.HTM