Four recent lawsuits filed against some of the Web’s biggest media companies challenge the alleged use of Flash cookies capable of circumventing a user’s ability to prevent the tracking of online behavior.
The four complaints center around the defendants’ alleged tracking of consumers’ online behavior through the use of cookies installed through Adobe’s Flash video player, the Web’s most popular online video program. Each of the complaints seeks class action status.
Named as defendants are Clearspring Technologies, Inc., Quantcast Corporation, and Specific Media, Inc., three of the leading companies involved in targeted online advertising. Also named are numerous media companies that have allegedly used these companies’ technologies on their Web sites.
The complaints allege that the defendants installed Flash cookies on users’ computers without their knowledge or consent. All versions of Adobe’s Flash player support locally stored objects, which allow the creation of Flash cookies. Flash cookies differ from browser-based HTML cookies in a number of respects, including the ability to store 25 times the amount of information, where they are located on a user’s computer, and their ability to re-install previously deleted HTML cookies. [1]
According to the complaints, Clearspring, Quantcast, and Specific Media each develop Flash cookies capable of tracking individual computer users’ online behavior and preferences. The suits allege these companies then partner with the remaining defendants or other third parties to install the Flash cookies and track consumer behavior across the Web. The plaintiffs allege that these Flash cookies remain on a user’s computer even after a user uses the “delete cookies” tool on his or her web browser and are capable of re-installing browser tracking cookies that users previously deleted, thus circumventing a user’s ability to prevent tracking of his or her online behavior. The complaints further allege this is done without the user’s knowledge or consent and is contrary to the defendants’ web site terms of use and privacy policies.
The complaints also include allegations that the defendants tracked, stored, packaged, and resold personally identifiable information about consumers, including information related to consumers’ health and finances. Clearspring has publicly denied this allegation on its blog and asserts that its use of Flash cookies is consistent with industry standards.
The use of Flash cookies was reported by researchers from the University of California at Berkley in a study published in August 2009 (and previously covered the Privacy Law Blog here). That study found that more than half of the Web’s most popular sites use Flash cookies to track user behavior online. The report specifically named both Clearspring and Quantcast as two companies whose Flash cookies are capable of reinstalling deleted HTML cookies.
Members of the internet advertising industry, worth a reported $23 billion in ad spending in 2009, have responded to the growing debate over tracking consumer behavior online. The Interactive Advertising Bureau (“IAB”) recently asked its members to contribute to the funding of a public relations campaign in defense of the online advertising industry. The IAB and other industry groups last year proposed a self-regulatory plan that, among other things, contemplates informing consumers about data collection practices. Industry leaders point out that tracking online behavior allows advertisers to deliver targeted advertisements that may provide consumers with a valuable source of information not otherwise available.
Although the Federal Trade Commission (“FTC”) has yet to formally weigh in on the use of Flash cookies, behavioral advertising is certainly on the commission’s radar screen. FTC Chairman Jon Leibowitz has publicly stated that the commission is considering implementing a “do not track” list along the lines of the Do Not Call registry, and the commission is expected to release draft guidelines regarding behavioral advertising this fall.
[1] Adobe itself condemns this practice, and is not named as a defendant in any of the three lawsuits.