• Recommend:
• 0 Comments

Is TRUSTe Trustworthy?

Net privacy organization is accused of compromising the privacy of its own visitors.

By George A. Chidi Jr., IDG News   

Interhack, an Internet security firm, says that TRUSTe allowed an outside company to track visitors to its Web site without visitors' permission or knowledge.

TRUSTe contracted with Thecounter.com, a subsidiary of Internet.com, to track visitor page views on its Web site, according to Matt Curtin, president of Interhack. In addition to using cookies to track visitors, Thecounter.com placed "Web bugs"--invisible markers one pixel wide with date and time coding data--onto the pages as well, he says.

"That's the critical thing--they're tracking without cookies," Curtin says.

By comparing the unique date-time stamp assigned to each Web bug, Thecounter.com could tell whether a particular visitor had been to the site before, as long as the visitor's cache of Web pages--and Web bugs--had not been emptied, he says. Further, Thecounter.com could compile a profile of a user by comparing Web bugs potentially placed on any of the Web sites operated by the tracking company's clients, adds Curtin. More than 900,000 Web sites use Thecounter.com.

An Internet.com spokesperson was not immediately available for comment.

A statement posted on TRUSTes Web site states that the company has ended its relationship with Internet.com. The statement admits the possibility that the tracking service "may be engaging in other techniques to track Web site visitors and that the possibility exists that Internet.com may be gathering Web site visitors' personally identifiable information."

TRUSTe's statement says it chose the service "solely on the belief that Internet.com was not collecting any personally identifiable information on visitors to the TRUSTe Web site."

"I want to emphasize that, at this point, there is no verifiable evidence that any personally identifiable information was gathered by Internet.com. But, as we advise other Web sites, the best practice in a case like this is to immediately eliminate the possibility that any information is being improperly transferred," says Bob Lewin, chief executive officer and executive director of TRUSTe, in the statement.