Mudslinging Intensifies in ETagging Row
Ashkan Soltani, a University of California-Berkeley researcher, fired back at the CEO of KISSmetrics for spinning the truth about the besieged company’s “rogue” tracking practices. In July Soltani and four other researchers documented the behavior of several online companies alleged to use non-transparent methods to track users online (WID Aug 8 p1). “I don’t think he ever read our paper,” Soltani said in an interview Monday. The other authors of the paper are researchers Mika Ayenson, from Worcester Polytechnic Institute, Dietrich Wambach from the University of Wyoming, Nathan Good, principal of Good Research, and Chris Hoofnagle, with UC-Berkeley.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
KISSmetrics is embroiled in a California class action lawsuit that claims the company used persistent tracking tools called ETags that regenerate after browser deletion. But KISSmetrics CEO Hiten Shah called the lawsuits “meritless” and said the research paper that exposed the alleged practice was “misinformed.” “We have every confidence that this case will be dismissed, and that we will be able to move on and continue providing great products to our customers,” Shah wrote in a blog post (http://xrl.us/bk44p6). Shah also said KISSmetrics “has never shared any information about a user with any third party” and “does not track users across different websites, nor do we have the ability to do so."
Shah attacked the researchers behind the academic paper which first identified KISSmetrics’ alleged use of non-transparent methods to track users online. The paper “significantly distorts our technology and business practices,” which “have always been lawful and ahead of industry best practices,” Shah wrote. Shah singled out Soltani, for “speculating” that KISSmetrics tracks customers across different websites, and said Soltani’s “misinformation” stems from the company’s use of the same URL for all customers.
"Our paper was focused on respawning,” Soltani said. “If you read [Shah’s] post he’s spun it to sound like they are denying the use of their ETags, but they did use ETags.” Instead of addressing the issue of persistent ETags, Shah has “set up a straw-man argument that also attempts to shift the debate,” Soltani said.
The larger concern is the company’s practices of circumvention and lack of user control, said Soltani. KISSmetrics has embraced the “concept of using every means possible to persistently track a user,” he said. The company failed to provide consumers with adequate notice they were being tracked, there was no consumer-facing privacy policy, and there was no choice provided to consumers who were being tracked, Soltani said.
KISSmetrics recently changed its privacy policies in response to the allegations and will now only use first-party cookies for tracking, Shah said. Furthermore, the company will not use ETags or “any other persistent tracking cookie for tracking purposes,” and will implement an opt-out mechanism and Do Not Track support for its products. Even so, Shah said the use of persistent tracking technologies is common in the industry: “Countless online companies, including other major analytics providers, use a variety of different technologies to provide these services, including the persistent technologies Mr. Soltani targets in his paper.”
But KISSmetrics’ newly-minted consumer facing privacy policy could get it into trouble with the FTC, Soltani said. “I think they are making a bunch of affirmative statements now that could get them into more trouble than their original privacy policy.” The FTC is paying close attention to the issue and if KISSmetrics’ privacy policy contradicts its behaviors it could be subject to enforcement action under Section 5 of the FTC Act, said Maneesha Mithal, the commission’s associate director for privacy and identity protection.
On-demand music streaming provider Spotify ended its business agreement with KISSmetrics, a company spokeswoman told us in an email Monday. “Following the recent report raising concerns around KISSmetrics’ treatment of cookies, we took immediate action to cease using KISSmetrics, and began a thorough investigation,” Spotify’s spokeswoman said. “Spotify remains absolutely committed to safeguarding the privacy of our users.” Shah did not respond to Spotify’s decision to end its relationship with KISSmetrics.