E-Commerce: Re-shaping the Landscape of Consumer
Privacy
by:
Michael S. Yang
Gorman & Williams
msyang@gandwlaw.com
www.gandwlaw.com
Phone: 410-528-0600
Fax: 410-528-0602
I. Introduction: The Internet and E-Commerce
The Internet is no infant, given its genesis
in the electronic communication networks of government researchers and
educational institutions in the late sixties and early seventies.
No longer is the Internet just a way to send electronic messages and computer
files to friends and colleagues, as it was at its inception. With
the introduction in 1993 of a software program known as Mosaic, the predecessor
to Netscape’s Navigator browser, public Internet users were suddenly introduced
to a whole new electronic medium, one that in a few short years has completely
changed the way much of the world operates. That medium is the World
Wide Web (the “web”).
The Internet has been growing at an amazing
pace. Today, the Internet has approximately 168 million users worldwide,
with approximately 63 thousand new users being added daily—three out of
every four users lives in North America. In December 1993, there
were around 600 websites in existence. In December 1999, that number
had grown to around 9.5 million.
For many people, the web and the Internet have
become synonyms, though one (the web) is really a subset of a much larger
whole (the Internet). The proliferation of the Internet and the advent
of the web have lead to a rapid and relentless commercialization of cyberspace,
as companies, businesses, and individuals have rushed to capitalize on
a new frontier full of possibilities (for making money). While still
an extremely efficient means of communication, the Internet has become
a forum where both seasoned and novice entrepreneurs can sell their goods
and services, twenty-four hours a day, to a global audience.
Electronic commercial transactions over the
web are commonly referred to as “e-commerce,” and these transactions are
growing at an incredible rate. From being practically non-existent
in 1993, e-commerce is estimated to exceed $350 billion in sales in the
year 2000. E-commerce is currently growing at a rate of 30% per year,
and will account for up to 10% of the world’s consumer sales within the
next ten years. Many businesses see the Internet as a virtual “Wild
West.” The analogy is an appropriate one, as the Internet represents
a vast frontier without many sheriffs policing the territory.
There are at least two significant ways in
which e-commerce transactions differ from conventional transactions such
as retail store sales or catalog sales. First, the pace and timing
of the e-commerce transaction is usually dictated by the buyer—the buyer
may initiate the sale at any hour, as long as the website is operational.
This allows a consumer to build a transaction over hours, days, or weeks,
and also lets a consumer shop at his or her convenience. For consumers
who may require more assistance than a computer can give them, such convenience
comes at a price because most websites do not offer live customer service
at all hours of the day and night.
Second, most e-commerce transactions give consumers
access to much more information than a typical catalog or even retail showroom
can provide. Online catalogs for e-commerce retailers are usually
replete with information about everything from the product itself to other
similar products to three-dimensional representations of the product.
Prices are usually displayed prominently, and, if discounted, will usually
inform the consumer of the percentage discount that the consumer is getting
versus the retail price.
But here’s the rub: unlike retail stores, e-commerce websites have
the capability of gathering data about a user as that user browses and
shops. This ability has raised a number of issues relating to the
use and collection of data, particularly personal information. The
ability of a commercial website to track and cross-reference a potential
customer’s background and personal information is akin to someone walking
into a store, not necessarily intending to purchase anything, and the store
clerk behind the counter knowing that person’s name, address, past purchasing
history, and every item that that person examined while in the store on
any particular visit. The privacy implications are significant.
II. The Convergence of Intellectual Property and Consumer Privacy
Concerns
The Internet has raised many questions as to
the protectability of intellectual property, for most content on the Internet
may be classified as some sort of protectable intellectual property.
Intellectual property includes a person’s image or likeliness, a list of
customers, or a method of doing business. In certain situations,
personal information may also be considered intellectual property, or may
at least be protected under the law. For example, customer lists
are protectable as trade secrets. Maryland laws exist to protect
consumer information in specific situations such as when a credit report
is generated (Md. Comm. Law Code Ann. § 14-1209) or to protect the
identity of video store customers and their rental history (Md. Ann. Code,
art. 27, § 583). With regard to bank records, a fiduciary institution
may not disclose any financial records unless the customer has authorized
disclosure or unless the records have been subpoenaed. Md. Fin. Inst.
Code Ann. § 1-302. Federal laws also provide protection to consumers
who rent video tapes, protecting against the disclosure of the tapes a
person borrows or buys, and permitting the disclosure of customer lists
only if the consumer has the opportunity to prevent such disclosure.
18 U.S.C. § 2710. In Maryland, a licensed driver or car owner
may prevent the Department of Transportation from releasing data on mailing
lists by submitting a written request to the Department. Md. Trans.
Code Ann., § 12-112. And under Maryland law, unsolicited “junk”
faxes are prohibited. Md. Comm. Law Code Ann., §14-1313.
In the appropriate situations, state legislatures and Congress have proven
they will enact statutes to protect consumers, subject to the statutes
passing Constitutional muster.
While an online business certainly may maintain
and own its proprietary customer lists, consumers may not approve of the
methods the business uses to gather those lists, the information contained
in those lists, or how the information is used. When personal information
is gathered, used, and disseminated without a consumer’s knowledge or control,
intellectual property issues give way to privacy issues, which are often
closely tied together in situations relating to e-commerce.
A. The Right to Privacy
There is no inherent right to privacy in e-commerce
transactions. Consumers complaining of privacy concerns have based
their claims on traditional common law invasion of privacy tort principles.
The common law invasion of privacy torts include the unreasonable intrusion
upon the seclusion of another, the unreasonable publicity given to another’s
private life, publicity that unreasonably places another in a false light
before the public, and misappropriation of another’s name or likeness.
These common law principles of right to privacy are also recognized in
Maryland. In challenging practices of websites and advertisers for
gathering personal information, consumers have relied upon the intrusion
upon seclusion tort as the basis for their complaints.
The Internet is a great tool for the acquisition
of knowledge and information, but the acquiring party is not always only
the user. Other websites, advertisers, and businesses may have access
to the information. The ease of sending Internet e-mail has opened
up the floodgates for advertisers and businesses eager to market to a new
and ever growing audience. While the Internet offers users a way
to escape the physical world, sometimes the virtual world can be even more
intrusive when it comes to unwanted communications.
III. Cookies: The Gathering of Personal Information
“Cookies” are bits of data stored in web browsers
to facilitate net surfing. The use of cookies has been hotly debated
as privacy advocates argue that the insidious nature of these innocuous-seeming
files may be used to invade the privacy of unsuspecting users. Cookies
are information placed as text in the directory of a web browser such as
Netscape Navigator or Internet Explorer by a web site. This information
is stored for future use, and is typically used to record preferences when
using a particular site. Cookies are necessary in order for web sites
to recognize and store individualized information such as the items in
a shopping cart or what a user’s name is. Without cookies, websites
would be completely blind to the user on the other end, and e-commerce
would not operate as efficiently as possible. Cookies are also very
useful tools for businesses and advertisers, allowing websites to, among
other things, target advertisements and recommendations to specific users
based on their interests.
A. The DoubleClick Firestorm
Cookies have raised concern among users who
believe that cookies can, and are, being abused by websites and advertisers
to track consumers and invade their privacy. In particular, leading
Internet advertiser DoubleClick has been accused of unlawfully obtaining
and selling consumers’ private information. DoubleClick acquired
Abacus Direct in 1999, a company with databases containing personal information
on millions of consumers gathered by major direct-mail marketers.
With their new wealth of information, DoubleClick could not only use cookies
to track a person’s habits, but they could also cross-reference those habits
with an actual database including information such as a person’s name,
location, and past purchases. In Decorse v. DoubleClick, a Marin
County, California woman filed suit seeking class-action status in California
Superior Court in January alleging that DoubleClick uses cookies to identify
Internet users and collect personal information without their consent.
The complaint seeks damages and injunctive relief. DoubleClick has
since been named as a defendant in other class action lawsuits in California
and other states, and includes actions in federal court.
Because DoubleClick’s advertisements run on
so many commercial websites, DoubleClick can use its cookies to actually
track an individual across thousands of websites within its advertising
network. This raises further privacy concerns because, instead of
only gathering discrete bits of data about a consumer (e.g., a single interest),
DoubleClick can now gather a full spectrum of data about a consumer (e.g.,
all of the interests that a person has), giving the advertiser a much fuller
composite of a consumer. This information is very valuable to DoubleClick
because it can compile and process the information and then use it to create
focused reports to sell to advertisers.
With significant media attention focused on
DoubleClick, in February 2000, DoubleClick acknowledged that it was under
a Federal Trade Commission investigation concerning its practice of collecting
dossiers on consumers. The Electronic Privacy Information Center
(“EPIC”), a public research organization based in Washington, D.C., has
also filed a complaint with the FTC alleging that DoubleClick had engaged
in unfair and deceptive trade practices and asked that, among other things,
DoubleClick be prohibited from collecting personal information using cookies
without an individual’s informed consent. EPIC also asked that DoubleClick
be assessed significant civil penalties.
In the wake of the lawsuits and investigations,
DoubleClick backtracked and decided to postpone any plans for merging consumer
data with its tracking data. DoubleClick also admitted that it had
made a mistake by planning to merge names with anonymous user activity
across the Internet in the absence of the establishment of government and
industry privacy guidelines and standards. In an effort to ease consumer
concerns, DoubleClick has created a website, PrivacyChoices.com, to educate
the public and provide consumers with information about available online
privacy resources including EPIC, the FTC, and a number of other organizations
and privacy groups. In conjunction with this educational effort,
DoubleClick is also spending $2 million on an advertising campaign to help
rebuild its battered public image.
B. The Childrens Online Privacy Protection
Act
While state and federal statutes exist to protect
consumers from the unauthorized distribution of personal information including
their bank records, video rental history, and private, personal facts,
the Childrens Online Privacy Protection Act, 15 U.S.C. § 6501 et seq.,
passed in 1998 and set to go into effect in April 2000, protects against
the collection and use of personal information from children up to the
age of thirteen. Website operators both commercial and non-commercial
would be required, by law, to post their privacy policies providing notice
of the information collected, how that information is used, and how it
is disclosed. Website operators also would be required to obtain
parental consent for the collection, use, or disclosure of personal information
prior to the collection of that information from children. The Act
would thus require operators to take reasonable precautions to ensure the
confidentiality, security, and integrity of collected information.
This is the first piece of federal legislation specifically designed to
offer broad protection for online privacy, and is consistent with state
and federal policy of protecting children, who are at special risk due
to the ease with which personal information may be gathered about them
online.
IV. Spam
Electronic mail also has the significant potential
to invade a user’s privacy. Through conventional methods (such as
purchasing e-mail address lists) to unconventional methods (such as using
computer programs to harvest e-mail addresses from service provider computers),
Internet advertisers and e-commerce websites may obtain the e-mail addresses
of
Internet users. Electronic mailboxes may then be bombarded with mail;
millions of pieces of junk e-mails are sent every day across the Internet.
While in some instances, users may opt-out of receiving such junk mail,
in most cases the junk mail is unwanted and unavoidable. One of the
first and most famous cases of Internet “spam,” bulk quantities of unsolicited
electronic messages, was the widely publicized case of the Arizona husband
and wife attorneys Canter & Siegel who, in 1994, deluged Internet news
groups with notices regarding a green card lottery. Canter &
Siegel’s actions have earned them much ire in the Internet world as the
first large-scale spammers.
Commercial spam e-mail is much like physical
junk mail. But because for most people an e-mail address is more
personal than a physical mailbox, many Internet users feel that spam impinges
on their seclusion and privacy. However, no statutes or court decisions
have declared any right of privacy in e-mail.
Though it is a very inexpensive vehicle for
commercial advertisers to reach many potential customers, spam has a definite,
significant aggregate cost to users and service providers in terms of both
time and money. Users must spend time reading and deleting the messages,
costly if the user is on a time-based service provider, and service providers
must use a portion of their network resources to process the deluge of
messages. If enough messages are sent, the computer networks carrying
he messages may even crash, costing consumers usage time and damaging the
reputation of service providers. Because service providers are private
entities, they have prevailed against First Amendment challenges to their
denial of access to senders of unsolicited bulk e-mails. See the
leading case of Cyber Promotions, Inc. v. America Online, Inc., 948 F.Supp.
436 (E.D. Pa. 1996).
A. State and Federal Responses to Spam
While state and federal statutes exist to prohibit
the delivery of unsolicited faxes, state and federal governments have not
been as quick to act on spam. Currently, only five states, including
Maryland, have passed laws that restrict the transmission of unsolicited
commercial e-mail, and others, including New York, have proposed Internet
privacy legislation. See Md. Code Ann. Art. 27, § 555C.
These statutes generally prohibit fraudulent messages, which include both
messages that contain deceptive content and messages that are technically
fraudulent, with false domain names or return e-mail addresses. By
and large, the statutes also set requirements as to the form of the advertisements.
Maryland’s anti-spam law is primarily an anti-obscenity
law, different than the laws in the other states that have enacted anti-spam
legislation (California, Nevada, Virginia, and Washington). Maryland’s
law criminalizes e-mail sent with an intent to harass, or the sending of
lewd, lascivious, or obscene material. The law may also be interpreted
to cover the bombardment of commercial advertisement e-mails, but there
have not yet been any reported decisions under Maryland’s anti-spam law.
State anti-spam statutes were dealt a blow
in court when, on March 14, 2000, a state court judge ruled that Washington
state’s anti-spam law violates the U.S. Constitution in the case of Gregoire
v. Heckel. The Washington law was held to violate the interstate
commerce clause of the Constitution because it is “unduly restrictive and
burdensome,” hurting legitimate businesses more than it helps consumers.
The law was enacted in 1998 as a result of service provider and consumer
complaints, and it banned commercial e-mail that contains either fraudulent
content or is technically fraudulent.
Currently, there are no federal statutes which
directly address the issue of spam. H.R. 2162, introduced in the
House on June 10, 1999, and known as the “Can Spam Act,” prohibits “the
use of the equipment of an electronic mail service provider to send unsolicited
commercial electronic mail in contravention of the provider’s posted policy…”
This act puts the burden on Internet service providers to draw the line
as to what uses will trigger the prohibition. The Act also contains
a provision prohibiting the “unauthorized use of Internet domain names.”
This section provides a criminal penalty for e-mail that is technically
fraudulent and causes damage to a network. If enacted, this Act,
by its terms, would preempt any state law regarding the fraudulent use
of the domain name of another in sending e-mail.
B. Protecting Consumers Against Spam
In the absence of any new federal law on the
subject of spam, courts have applied existing federal laws to restrict
the transmission of fraudulent, unsolicited commercial e-mail. Section
5(a) of the Federal Trade Commission Act makes it unlawful for one to engage
in “unfair or deceptive acts or practices in or affecting commerce.”
The FTC has been active in prosecuting those sending fraudulent unsolicited
commercial e-mail, filing its first lawsuit against a spammer in 1998.
The Lanham Act, 15 U.S.C. § 1125(a), permits a cause of action for
false designation of origin, which could apply to technically fraudulent
e-mail. The Computer Fraud & Abuse Act, 18 U.S.C. § 1030,
may also apply to spam, prohibiting the knowing transmission of harmful
data to another computer without authorization and prohibiting the intentional
access of a protected computer (e.g., to prevent the harvesting of e-mail
address from service providers).
V. Self-Policing
A. The Ubiquitous Privacy Policy
The most successful actions in promoting consumer
privacy on the Internet have taken the form of self-policing. Commercial
websites have taken to using two tools to demonstrate their interest in
protecting consumer privacy: the privacy policy and third-party privacy
seals. Privacy policies, a prominent part of all major commercial
websites, describe how a website gathers data, including personal information,
and what the website does with that data. By reading a website’s
privacy policy prior to giving any personal information, a consumer can
make an informed choice with regard to what they can expect from a particular
website. Third-party privacy seals represent to the public that a
trusted, third party, such as the Better Business Bureau or Trust-e, has
reviewed the website and its policies, to give assurance that the site
has an acceptable privacy policy and is abiding by that policy. Ultimately,
for sites with posted privacy policies and third-party privacy seals, the
consumer’s knowing and voluntary disclosure of personal information may
constitute an agreement between the consumer and the website on acceptable
terms of use. This is especially true in cases where a consumer must
click a button to accept the terms of a written privacy policy, much like
shrink-wrap or click-wrap licenses, the validity of which have been upheld
in court and are validated in the Uniform Computer Information Transactions
Act (UCITA).
B. The Power of Market Forces
There has been significant debate over who
should be policing the Internet. While some argue that the government
should administer and oversee the Internet, most Internet users feel that
the Internet should be self-policing and self-regulating. When the
Internet was a small community of a few thousand users, self-policing was
not a problem; when the Internet is a community of a few hundred million,
self-policing is much more difficult. If DoubleClick’s experience
is any lesson, for the time being, consumers may still exert considerable
influence upon privacy decisions through market forces. Similarly,
a feature to be introduced in Intel’s Pentium III processor, unveiled in
1999, to allow websites to track users by real world identities met with
a very negative reaction from the consumer public and privacy advocates.
The feature was disabled by Intel, requiring users to opt-in to the feature
for it to work. Market forces still play a significant role in shaping
the constantly developing technology landscape.
The Clinton Administration’s Framework for
Global Electronic Commerce, announced by President Clinton on July 1, 1997,
is based upon principles that are intended to increase private sector leadership
and reduce undue government restrictions on electronic commerce in an attempt
to foster global e-commerce. This Framework endorses self-regulation
with regard to privacy issues, and promotes the American market-driven
approach to privacy. The FTC has been aggressive in trying to educate
consumers and businesses about the importance of personal information privacy.
In its most recent report dated July 13, 1999 entitled Self-Regulation
and Privacy Online: A Report to Congress, the FTC concluded that, due to
the self-regulatory initiatives of e-commerce industry leaders, legislation
to address online privacy was not appropriate at the time of the report.
VI. Conclusion
There is no question that if America Online,
for example, wanted to track and record every movement of every one of
its twenty million-plus subscribers within its own system, it could!
In the absence of statutes to prohibit and provide penalties for such practices,
market forces will be the only deterrent that consumers wield against Internet-based
invasions of privacy. Ultimately, it may be up to the lawmakers and
courts to impose privacy protections in certain specific online business
activities in the same way that they have addressed consumer privacy issues
in the real world. The addition of discrete laws may be necessary
to fill in the holes where market forces are insufficient to protect consumer
privacy in specific situations. E-commerce has shown that it reacts
swiftly to market forces, and in the long run, it will certainly play a
key role in shaping the future of Internet standards for consumer privacy.
© 2000 Maryland State Bar Association, Inc. Originally published in the July/August 2000 issue of the Maryland Bar Journal. Reprinted with
permission.
