Four recent lawsuits filed against some of the Web’s biggest media companies challenge the alleged use of Flash cookies capable of circumventing a user’s ability to prevent the tracking of online behavior.
Named as defendants are Clearspring Technologies, Inc., Quantcast Corporation, and Specific Media, Inc., three of the leading companies involved in targeted online advertising. Also named are numerous media companies that have allegedly used these companies’ technologies on their Web sites.
The complaints allege that the defendants installed Flash cookies on users’ computers without their knowledge or consent. All versions of Adobe’s Flash player support locally stored objects, which allow the creation of Flash cookies. Flash cookies differ from browser-based HTML cookies in a number of respects, including the ability to store 25 times the amount of information, where they are located on a user’s computer, and their ability to re-install previously deleted HTML cookies. 
The complaints also include allegations that the defendants tracked, stored, packaged, and resold personally identifiable information about consumers, including information related to consumers’ health and finances. Clearspring has publicly denied this allegation on its blog and asserts that its use of Flash cookies is consistent with industry standards.
The use of Flash cookies was reported by researchers from the University of California at Berkley in a study published in August 2009 (and previously covered the Privacy Law Blog here). That study found that more than half of the Web’s most popular sites use Flash cookies to track user behavior online. The report specifically named both Clearspring and Quantcast as two companies whose Flash cookies are capable of reinstalling deleted HTML cookies.
Members of the internet advertising industry, worth a reported $23 billion in ad spending in 2009, have responded to the growing debate over tracking consumer behavior online. The Interactive Advertising Bureau (“IAB”) recently asked its members to contribute to the funding of a public relations campaign in defense of the online advertising industry. The IAB and other industry groups last year proposed a self-regulatory plan that, among other things, contemplates informing consumers about data collection practices. Industry leaders point out that tracking online behavior allows advertisers to deliver targeted advertisements that may provide consumers with a valuable source of information not otherwise available.
Although the Federal Trade Commission (“FTC”) has yet to formally weigh in on the use of Flash cookies, behavioral advertising is certainly on the commission’s radar screen. FTC Chairman Jon Leibowitz has publicly stated that the commission is considering implementing a “do not track” list along the lines of the Do Not Call registry, and the commission is expected to release draft guidelines regarding behavioral advertising this fall.
 Adobe itself condemns this practice, and is not named as a defendant in any of the three lawsuits.