Privacy watchdog group TRUSTe declined Monday to investigate RealNetworks, but the decision has prompted the organization to expand its charter.
It is the second time the group has determined that a significant privacy concern lies beyond the scope of its program. Although TRUSTe has investigated several major violations and hundreds of minor incidents, it has never revoked a Web site's right to display its privacy seal.
TRUSTe conducted an initial inquiry last week into the behavior of RealNetworks' RealJukebox software, which was surreptitiously gathering data about the music-listening habits of its users and passing it on to the company. The inquiry is intended to determine if a TRUSTe member company may have violated privacy terms.
RealNetworks subsequently issued a patch to keep the software from tracking the unique identifier that allowed RealNetworks to tie the tracking data to users' personal information.
TRUSTe’s stated mission is to regulate the use of personal data submitted to Web sites by accepting input from consumers. TRUSTe declined to investigate RealNetworks because RealJukebox is music-listening software that works via the Internet, but only indirectly through a Web site visit.
As a result, the self-monitoring group has determined that it needs to expand its program to include a wider range of data collections.
"Unfortunately, yes, [the RealNetworks privacy problem] falls outside the scope of our program," said TRUSTe spokesman Dave Steer. "Because of that, we're going to be evolving the program."
The "trustmark" license grants companies the right to bear a seal on their Web sites if they comply with TRUSTe’s privacy policy. The seal was designed to ensure that companies disclose their data collection practices.
The same technicality has previously led the organization to back out of privacy matters that appeared on their face to be relevant to TRUSTe's mission. TRUSTe cited the scope issue when it declined to investigate a privacy question related to Microsoft's Windows registration process.
When people registered their Windows software, Microsoft's registration program gathered a unique identifier from the user's disk. But, since the process didn't explicitly involve the company's Web site, TRUSTe didn't investigate.
Sensing a pattern of exemptions that could limit its reach -- as well as consumer confidence in the TRUSTe seal -- the organization announced a plan to expand its scope on Monday.
"The line between the data that's collected at a Web site and the data that can be collected over the Internet, such as GUID [global unique identification number], has been blurred," said TRUSTe's Steer. "That's why we're expanding the program."
Steer said TRUSTe would call on experts inside and outside the Internet industry to determine how to expand the program to include the behavior of software. The behavior of Internet software, such as RealNetworks', is much more complex and less apparent, he said.
When the program incorporates more kinds of Net-enabled behaviors, Truste hopes to be in a good position to monitor the increasingly omnipresent activity of data collection.
"In an increasingly networked society where there are 'EZ-passes' and supermarket cards, this type of incident is going to become increasingly common. So it's time to expand the program," Steer said.
TRUSTe recommended RealNetworks adopt a five-point plan that could help bolster consumer trust, given the recent problems.
The TRUSTe news occurred on the same day that RealNetworks issued updated software to address a newer privacy problem affecting its streaming software product, RealPlayer.
