[Infowarrior] - Dozens Of Web Companies Sued For 'ETag' Tracking

[Richard Forno]

http://www.mediapost.com/publications/?fa=Articles.printFriendly&art_aid=155234

Dozens Of Web Companies Sued For 'ETag' Tracking 


Wendy Davis, Aug 03, 2011 06:18 PM

Two California residents have brought a privacy lawsuit against KISSmetrics
and 25 separate Web companies, including iVillage, Spotify and GigaOm, for
allegedly using KISSmetrics' analytics to track visitors. 

The case, filed by John Kim and Dan Schutzman, is the second major lawsuit
stemming from KISSmetrics' technology, which relies on ETags for tracking.
Last week, two different Web users sued KISSmetrics and Hulu for allegedly
violating federal and state laws with ETags. The technology is controversial
because ETags can be used to track consumers even when they delete their
cookies. 

Kim and Schutzman say in their complaint that they "expected their browser
controls to block or delete cookies, preventing them from being tracked
online, profiled, and served behaviorally targeted advertisements." 

Their lawsuit, filed on Monday in the Northern District of California,
alleges violations of the federal wiretap law and various California state
laws. They are seeking class-action status. 

GigaOm declined to comment for this article; KISSMetrics, Spotify and
iVillage have not responded to requests for comment about the lawsuits.

KISSmetrics stopped using the controversial ETags this weekend, shortly
after researchers at UC Berkeley published a report about the technology.
The company's long-term plans for ETags are still unknown. 

The UC Berkeley report said that KISSmetrics used ETags to store information
in people's browser caches. When those people deleted their cookies, they
could be recreated with information from the ETags. Until the company
revised its practices over the weekend, the only way for users to avoid
KISSmetrics' tracking was either by clearing their browser caches between
each Web site visit or by installing the AdBlock Plus extension. 

Hulu and Spotify suspended their use of KISSmetrics late last week. 

KISSmetrics told Wired last week that its technology is used by publishers
to track people on their own sites, but not to track people across more than
one site. But Ashkan Soltani, a privacy researcher who co-authored the
report, says that KISSmetrics' technology enables companies to compile
profiles of users based on their activity across the Web. It's not yet known
whether the publisher sites that worked with KISSmetrics did so. 

Scott Kamber, the lawyer representing consumers who are suing KISSmetrics
and the sites it works with, says he believes that users were tracked across
more than one site. 

Kim and Schutzman allege in their complaint that the Web sites that worked
with KISSmetrics violated consumers' expectations about online privacy. They
allege in the complaint that they "believe their Web-browsing is private and
not the business of anyone except the Website with which they choose to
communicate." 

They add that they wouldn't have knowingly visited sites that used
"unauthorized persistent cookies" for tracking. 

Kamber has brought other privacy cases against a host of companies including
Netflix, Facebook and Google. He also was among the lawyers who represented
consumers in similar litigation against companies that allegedly used
hard-to-delete Flash cookies to track people. Two California residents have
brought a privacy lawsuit against KISSmetrics and 25 separate Web companies,
including iVillage, Spotify and GigaOm, for allegedly using KISSmetrics'
analytics to track visitors. Three companies -- Quantcast, Clearspring and
Say Media (formerly VideoEgg) -- paid a total of $3.4 million to settle that
litigation; a lawsuit against ad network Specific Media is currently
pending.