RealNetworks Inc’s popular RealJukebox covertly monitors the identity and listening habits of its users, and uploads the information to the company. Company officials at RealNetworks confirmed the story in the New York Times, justifying it on the grounds that the information is used to customize services to individual tastes. VP of consumer products Dave Richards insisted that the practice is not a violation of consumer privacy because the data is not stored or distributed. Privacy advocates, however, are outraged, saying that even if the information was collected for benign purposes, the company should have disclosed the practice to its customers.
The surveillance was discovered by Richard Smith, an independent internet security consultant. Every time the program is launched on a net-connected computer, RealNetworks notes the number of songs stored on the user’s hard drive, their genres and the file formats in which they are stored, and which if any portable player is present. When running in its default settings, RealJukebox launches every time the user plays a music CD. Requests to the online CD database are routed through RealNetworks’ proxy servers.
All this information is bundled with a globally unique identifier (GUID), assigned to every user that registers the software. Executives told the Times that the data is used to distinguish naive from sophisticated users and to direct the sophisticated to the software’s advanced features. They also claimed the information is deleted after four days. Privacy advocates seemed disinclined to credit the latter claim. Either they have been dazzlingly careless with their treatment of personally identifiable information or they are completely disingenuous, said Jason Catlett, president of consumer advocacy group Junkbusters. If they are not disclosing what they are doing, that is unconscionable.
