PREMIUM SEARCH Search by job title, geography and build a list of executive contacts
Industry and federal officials meeting this week in Washington for a global privacy summit are applauding last month's agreement by DoubleClick, Engage, and other online ad services to give computer users more choice about when they can be monitored as they surf.
Come on. It has become extremely obvious that a lot more is needed to protect consumers. Latest case in point: Pharmatrak Inc., a Boston technology firm, has just acknowledged that it's tracking computer users across the Net on behalf of pharmaceutical companies -- without consumers' knowledge.
Surprised? Don't be. Pharmatrak isn't an advertiser, so it's not bound by the online-ad-service agreement. And advertisers are just a small percentage of all the companies that want to use the Net to track consumer behavior in the name of profit. Pharmatrak admitted it's placing I.D. codes on computers that visit its clients' Web sites so it can tell them where consumers go and what kinds of information they download from thousands of Web pages kept by 11 pharmaceutical companies. These codes can help Pharmatrak tell when someone downloads, say, information about HIV, cancer, or genetic disorders from any number of Web sites.
Pharmatrak officials say the info they collect about browsing habits lets participating drug companies compare and improve their Web sites, and see who's asking for what types of information. Pharmatrak says it doesn't collect actual consumer names. But it can pretty much tell who visitors are, based on where they come from and what they access. And the company's Web site suggests it has plans to identify people. "In the future, we may develop products and services which collect data that, when used in conjunction with the tracking database, could enable a direct identification of certain individual visitors," it says -- adding it would never take advantage of such information.
"CAMERAS AND SPIES." This is pretty much what DoubleClick was seeking to do: combine online surfing habits with offline databases, a powerful data two-punch that could help target individual customers by online behaviors and offline identification.
All quite legal. But really, why should companies be able to monitor consumers without telling them it's doing so and then refuse to explain how the data will be used? Says Janlori Goldman, director of the Health Privacy Project at Georgetown University: "This is analogous to having hidden cameras and spies tracking people's movements and communication on the Web."
Goldman says she worries such surreptitious methods will dissuade people from using the Web to find helpful health data. "People will worry that if they, say, look up something on a Web site for those suffering from depression or AIDs, their names could be handed over to strangers."
Concern about such monitoring has also spurred action by state officials. Michigan Attorney General Jennifer Granholm has warned G.D. Searle & Co., one of the companies using Pharmatrak, to notify consumers -- or face a lawsuit. "There's no way your average computer user has any idea this is going on," Granholm says.
"WEB BUG." For their part, Pharmatrak officials say the reaction by privacy advocates is over the top and wholly predictable. But they acknowledge they don't post privacy policies stating how the company collects and uses info. Why? They say there's no need, because they don't gather names. But once again, Pharmatrak is doing pretty much the same thing that created controversy for Net ad firms. It's placing "cookies" on users' computers, remotely, through software code on Web pages called a "Web bug," invisible to consumers unless their browsers are set to alert them to the process.
Michael Sonnenreich, Pharmatrak founder and chief executive, says people who worry about privacy can set their browsers to alert them to any Pharmatrak cookies, tiny software programs that keep a log of where people click, allowing sites to track customers' surfing habits. Otherwise, Sonnenreich says, the company "isn't doing anything illegal" and is simply sharing information it collects in aggregate monthly reports with Pfizer Inc., Pharmacia, SmithKline Beecham, Glaxo Wellcome, and a slew of other drugmakers.
But if online marketers' data collection triggered an outcry for privacy protections, shouldn't a similar move by health firms provoke the same kind of concern?
Delegates to the global privacy summit and participants in the coming debates about privacy on Capitol Hill must do more than single out online marketers as the focus of their exhortations. The need for further protections is evident -- but it's just as clear now that industry and government leaders can't be counted on to develop them. If consumers want meaningful privacy protections, they must fight harder for them -- or such summits will be little more than platforms for industry czars and pro-industry government regulators to justify inaction on basic privacy rights.
Stepanek covers privacy issues for Business Week. Her column appears twice a month, only on BW Online. She invites you to discuss these issues on our Privacy Matters forum Edited by Douglas Harbrecht
Copyright 2000, by The McGraw-Hill Companies Inc. All rights reserved.
Printer-Friendly Version
