RealNetworks has issued another software update that addresses a privacy concern, this time in its popular RealPlayer software.
The company posted a free beta of RealPlayer 7 on Monday, which it said no longer tracks personal user information.
Last Monday, RealNetworks had plugged a related privacy glitch in its RealJukebox music software. The patch removed from its RealJukebox software a unique identification number, which tracks users' listening habits. Software analysis has shown that the same identifier is also transmitted by version 6 of the RealPlayer.
The unique identification numbers could be tied to personal information that is collected by RealNetworks during user registration. RealNetworks claims that more than 85 million people use the RealPlayer.
"It's harder for [RealNetworks] to fix [the RealPlayer problem], because the player has been around for years," said Richard Smith, who first pointed out the problem. "[Sites] are really using the [ID] numbers in a big way." Smith pointed out that the RealPlayers currently in use will continue to transmit IDs until users upgrade their software.
Smith regularly monitors the behavior of Internet software for security and privacy flaws.
The identifier is known as a globally unique identifier, or GUID, and is initiated during the RealPlayer registration process. The number is also transmitted when users access any site providing RealAudio or RealVideo streams.
The RealJukebox update was issued to stop the software from transmitting detailed information about the user's behavior to RealNetworks servers.
According to the company, GUIDs can no longer be associated with any personal information, such as name and email, provided during RealJukebox registration.
The RealPlayer, however, doesn't appear to track specific user behavior as RealJukebox did. It is unclear how many versions of RealPlayer have transmitted the unique IDs.
RealNetworks' competitors include Microsoft's Windows Media Player, which users have downloaded 40 million times.
A spokesman for Microsoft confirmed that the Windows Media Player, like other players, also transmits an identifier. But since Microsoft does not require user registration, the ID number cannot be tied to personal information.
"[The transmission of unique identifiers] shows there are all these ways you can leave these little digital fingerprints, and nobody has studied this in a systematic way," said Paul Schwartz, law professor at Brooklyn Law School and co-author of Data Privacy Law.
"We have to figure out what are the privacy implications," he said. "It's a great illustration of how we just find these things out as we go along."
