Hotmail Policy Raises Privacy Concerns

Hotmail users can now get a better look at their personal account settings--but some of the service's estimated 110 million active users may not like what they find.

Erroneous reports surfaced this week alleging Hotmail had changed users' default privacy settings. Some feared Microsoft could share entries from their Passports--a collection of personal information now necessary to open a Hotmail account--with other companies. However, Microsoft executives say the free e-mail service didn't change its current privacy policy, it merely rolled out new technology that better reflects its evolving "pure opt-in" philosophy.

Thanks to that new technology, however, many users may discover that when they signed up for the service they unwittingly agreed to share that information, which could range from an e-mail address to demographic data. Hotmail launched as an independent service in July 1996, and different policies may have been in effect until Microsoft acquired the company in December 1997. For example, longtime Hotmail users were retroactively issued Passports.

For additional Passport services, more information is necessary--including billing information in order to make purchases. But Microsoft says that information is not shared with partners, even if users opt in.

Policy Clarified

"There has been no change of MSN's privacy policy," says Adam Sohn, product manager in Microsoft's .Net platform strategy group. "We are merely showing people their current settings. Microsoft, including MSN, remains committed to the protection of our consumers' information, as well as working to empower consumers with the tools they need to control their information online," Sohn says.

Analyst David Ferris, president of Ferris Research, credits Microsoft for giving users direct access to their options. Many people will accept an agreement without reading it, he noted.

The customers who were surprised that their accounts were set to share "probably had agreed to it, they just didn't realize it," Ferris added. "That's not to say they shouldn't be unhappy."

Yahoo customers complained in March when the company's free e-mail service reset users' accounts, creating a default "opt in" that meant users would receive marketing information and other mail until they went into their account and opted out.

Moving to 'Pure Opt In'

Microsoft, on the other hand, has been moving its Hotmail service to a "pure opt-in model," meaning that no account information is shared by default, Sohn says. "This gives people more control of how their information is shared," he says.

Hotmail has been rolling out the technology changes for months, but apparently few users noticed the three lines of text plus check boxes at the bottom of their personal profile page, under the Options setting in their Hotmail account, he says.

Under the heading "Choose how much of your .NET Passport information Microsoft can share with other companies' .NET Passport sites at sign-in" are check boxes for "share my e-mail address," "share my first and last names," and "share my other registration information."

While Hotmail's current policy is to set all new users' setting to opt out of all three options by default, it is possible that long-time users signed up under former policies in which the default setting was to opt in, Sohn says. Users who find their accounts set to share any of this information can opt out now by unchecking the boxes, he says.

Last July, Microsoft revamped Hotmail's interface and integrated it more deeply with Passport technology. Passport lets subscribers store personal information in one place, and then provides authentication so you can use a single login and password at any Web site that supports the technology. Passport is part of the company's ambitious .Net strategy.

Angry Users

While Microsoft says it hasn't changed anyone's Hotmail setting, there has been a backlash from angry users confused by the change and unhappy that their profiles appear changed. PC World has received several e-mails from frustrated readers on the topic.

"No matter what boxes you had unchecked to protect your privacy before, you will find that the move to .NET has reset them to share your e-mail address and Profile information," writes one angry reader.

Microsoft's Sohn repeats that user options were not changed, but he admits he can understand how people might be confused by the new information. It's possible the company should have been more aggressive about explaining the change to its users. The company is considering whether to raise the issue and try to explain now, he says.

However, Microsoft doesn't want to make an announcement that would further confuse the issue, Sohn says. "We don't want anyone thinking we changed the privacy policy, because we have not."