[IRP] CNET on EPIC and Echometrix Case

[Katitza Rodriguez]

http://news.cnet.com/8301-27080_3-10408809-245.html

December 3, 2009 3:38 PM PST
Defense Department pulls parental control software over privacy issues
by Elinor Mills

The Department of Defense has pulled a parental control product from
its online store serving military families after learning that the
company collects childrens' data, according to documents the
Electronic Privacy Information Center (EPIC) obtained from the
government agency.

EPIC has filed a complaint with the Federal Trade Commission
alleging that Echometrix, maker of FamilySafe parental control
software, violates the Children's Online Privacy Protection Act by
collecting personal information from children and disclosing it to
third parties for market intelligence purposes. Echometrix denies
the allegations.

After learning that the Defense Department's Army and Air Force
Exchange Service (AAFES) Web site offers the Echometrix product for
sale, EPIC filed a Freedom of Information Request with the Defense
Department.

The agency complied with the FOIA request. Among the documents
provided to EPIC were e-mails between Echometrix and a manager at
the AAFES Exchange Online Mall who wanted to know how customer
information is collected and whether it is used for marketing
purposes.

"During the installation process we fully disclose all of Family
Safe's procedures and clearly display an opt-out button for all
anonymous aggregate data sharing in our (EULA) End User License
Agreement," an Echometrix e-mail explains.

"The collection of AAFES customer information (personal or
otherwise) for any other purpose than to provide quality customer
service is prohibited" by the agreement retailers sign to sell
products through the AAFES site, the online mall manager writes in
an e-mail. "Giving our customers the ability to opt out does not
address this issue. [It] is prohibited in any case. Because of this,
we must remove Sentry Parental Controls from the Exchange Online
Mall."

Asked for comment, a Department of Defense spokeswoman said the
Echometrix product was available on the online mall from September
25 until October 15. "To the best of our knowledge, no military
personnel signed up for the service during the approximately three
weeks it was available," Air Force Lt. Col. April D. Cuningham, the
public affairs officer, wrote in an e-mail.

Echometrix collects information from children to help parents filter
out Web sites, analyzes that information and then sells it to
third-parties for market intelligence research, said Kimberly
Nguyen, the EPIC lawyer who is handling the case.

The data includes personally identifiable information of children,
including IM screen names which can be linked to e-mail addresses,
she said.

"The collection of childrens' data raises serious privacy concerns
and even the Defense Department realizes that," Nguyen said in an
interview.

Echometrix denied the allegations.

"Echometrix does not collect personally identifiable information or
expose the source of any digital content. The company has never and
will never collect, distribute or sell personal information as
defined by COPPA (the Children's Online Privacy Protection Act),"
the company said in a statement.

The FTC did not respond to an e-mail seeking comment.