Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Savvy internet users know that their movements on the Internet are tracked by the use of &ldquo;cookies&rdquo; placed on their computers and used by marketing firms to study consumer patterns and target advertising.&nbsp; They also think that their internet browsers are equipped to remove those cookies. What many users&mdash;even vigilant users&mdash;do not know, is that Local Shared Objects, commonly known as &ldquo;flash cookies,&rdquo; can survive this deletion process and remain on their computers in perpetuity.&nbsp; Some flash cookies are programmed to surreptitiously &ldquo;re-spawn&rdquo; when deleted by a user.&nbsp; This &ldquo;re-spawning&rdquo; is done without the user&rsquo;s knowledge and, arguably, outside the consent given under various end user agreements and privacy policies.&nbsp; The flash cookies can result in the transmission of personally identifying information and other data useful to a marketer or retailer. In August 2009, researchers at the University of California at Berkeley published an <a href="http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1446862]">article</a> that revealed the prevalent use of flash cookies by major websites.&nbsp; The research showed that more than half of the sites sampled store user information through flash cookies. U.S. consumers have fought back against the creators of flash cookies and their customers by filing class actions.&nbsp; The following four complaints&nbsp;(<a href="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2010/09/Aguirre-Complaint.pdf">Aguirre</a>, <a href="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2010/09/La-Court-Complaint.pdf">LA</a>, <a href="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2010/09/Valdez-Complaint.pdf">Valdez</a>, <a href="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2010/09/White-Complaint.pdf">White</a>) (.pdf)&nbsp;all filed in the Central District of California, were brought under the federal Computer Fraud and Abuse Act and state privacy and computer statutes.&nbsp; The complaints allege that the defendants installed flash cookies on users&rsquo; computers without their knowledge or consent, and that that the defendants then tracked and sold personally identifiable information about consumers (including health and financial information). Flash cookies were <a href="http://www.ftc.gov/bcp/workshops/privacyroundtables/index.shtml">discussed</a> at the U.S. Federal Trade Commission&rsquo;s second Privacy Roundtable discussion on January 28, 2010.&nbsp; The FTC is expected to release its report this fall regarding the Privacy Roundtable discussions it hosted.

Fighting Back Against Flash Cookies