Privacy Groups Hammer Microsoft (Again)

The privacy and consumer groups that recently lodged a complaint against Microsoft with the U.S Federal Trade Commission expanded that complaint Wednesday to include concerns about children's privacy and Internet use tracking.

The groups lodged their original complaint in July, saying the company's Passport authentication service violates the FTC's unfair and deceptive practices statute. Now the groups have clarified and expanded their complaint in an attempt to ignite an FTC investigation into Microsoft's collection of personal user information, representatives of the groups say.

The original complaint says the groups are concerned that Passport could track and monitor Internet users, presenting serious privacy concerns. The Electronic Privacy Information Center (EPIC), Junkbusters, and the Center for Media Education are among the participants.

The amended complaint outlines a broader range of privacy concerns. In it, the groups allege that Passport doesn't comply with the Children's Online Privacy Protection Act (COPPA), that digital rights management in Windows XP monitors users, and that Passport has security defects.

Passport, which is part of the upcoming Windows XP operating system, is the subject of mounting ire. Critics of Microsoft claim Passport is another example of how the company bundles its applications and services to maintain its monopolist power.

The Passport authentication service lets users store basic information about themselves so that they can visit and shop at various sites without having to re-enter personal information. Microsoft is already using the technology on several of its sites, including Hotmail.

No More Anonymity

The groups claim Microsoft is using Passport and its Hailstorm Internet strategy "to eliminate anonymity on the Internet." They say the technology requires users to identify themselves just to surf the Web, under Microsoft's .Net distributed computing platform.

A Microsoft representative expresses dismay with the complaint, saying the groups refused to meet and work with Microsoft before going public with their complaints.

"We have reached out to EPIC and they have chosen to hold a press conference rather than talking to us," says Rick Miller, a Microsoft spokesperson.

Miller denies the groups' allegations that Windows XP uses unfair and deceptive practices. Microsoft and the groups have similar goals of protecting consumer privacy, he adds.

Microsoft denies the claim that Kids Passport violates COPPA because it lacks a clear and prominent link to a privacy policy.

"They are absolutely wrong," Miller says. "We have two links [to the privacy policy]," he says. "They are not being truthful about how the law reads."

The groups also outlined complaints from Windows XP users since they filed their original complaint. One of these is an issue over users' inability to cancel their Passport accounts and permanently delete their personal information from Microsoft servers. The groups says Microsoft told users that their accounts could not be cancelled and that they would have to wait for one year for their accounts to expire.

"We are particularly concerned in light of subsequent comments we have received from users that there is probably a lot more here [in Windows XP] that we haven't covered yet," Marc Rotenberg, executive director of EPIC, said during a conference Wednesday.

XP's Long Road

The complaint comes as yet another thorn in the software maker's side as it tries to boot Windows XP out the door while slogging through the U.S. government's antitrust case against it.

Microsoft recently announced changes to Passport to ensure greater privacy, notably reducing the amount of personal information required to open a Passport account. But representatives of the complaining groups are adamant that the concessions do not go far enough.

"The concessions are non-responsive," says Jason Catlett, president of privacy advocacy group Junkbusters. "They do not deal with our complaint. On the contrary, we have found more and more evidence against Microsoft that it is deceptively [collecting consumer information]."

"Passport requires, or coerces the provision of information when it is not necessary to perform a function," he adds.

Microsoft's recent Passport revisions are not a concession, and the amended complaint is not about those changes, says Kate Rears, an EPIC policy analyst.

Rotenberg says EPIC is "pleased" that Microsoft addressed its concerns, but that the changes do not go nearly far enough.

"There are over 100 million registered Passport users, 90 percent of the operating systems in the world use Microsoft, and [Windows] XP is expected to be the largest software launch in history," Rotenberg says. "Given this, we think it's quite apparent that there is a need for action [to protect users privacy]."

Still Too Nosy?

Passport still asks for too much information, notably still requiring the user's e-mail address, the groups say.

Microsoft's Miller defended Passport's requirement of an e-mail address, however.

"How can you authenticate someone if you don't know who they are?" Miller asks.

The groups also assail Microsoft's concession that affiliated merchants support the Platform for Privacy Preferences (P3P), a language whereby Web sites describe their privacy policies in a machine-readable format, saying that this addresses merchants' behavior and not that of Microsoft.

At the heart of the matter, "they aren't questioning our privacy practices, they are questioning our right to collect it," says Microsoft's Miller. He says consumers should be able to choose to give personal information to any merchant, including Microsoft.

The groups say they will continue researching Windows XP's privacy practices, although their intention is not to delay the operating system's release.

"Our goal is to make changes that will protect the privacy of Passport users," Rotenberg says.

But in their amendment, the groups reserve the right to further amend their complaint.

"I suspect we will uncover other issues as we go forth," Rotenberg says.

Miller says Microsoft continues to develop ways to protect users' privacy.