Evan Schuman's StorefrontBacktalk

Epic Marketing offered a service to retailers to allow them to engage in behavioral marketing of customers— even those customers who had deliberately made a decision not to accept cookies, and who took efforts to protect the privacy of their Internet browsing activity. Rather than relying on the cookies themselves, Epic developed a technology called “history sniffing.”

Every browser has a history file, a file that lists all of the websites that browser (and therefore, presumably, that consumer) has visited over a period of time. If you visit a website twice, a feature in the browser can change the color of the URL displayed.

It’s easy to see—try doing a Google search for something, and you will see that all of the results are hyperlinked in blue. Click on one of the results. Then go back to Google and do the search again. You will notice that the one link you previously clicked on is now displayed in purple, not blue.

Epic took advantage of this feature to essentially sniff the browser history files of consumers and gather data for behavioral marketing. The company created a network of more than 24,000 domains, including Papajohns.com, Cnn.com, Orbitz.com, Redcross.com and others, and was able to collect and analyze data across these domains.

Epic then profiled consumers based on this information, sometimes gleaning sensitive health data from the sites visited. Epic could tell whether a consumer was interested in things like arthritis remedies, memory improvement, and pregnancy or fertility issues. It sold this data to other merchants.

So there were two (not mutually exclusive) categories of merchants here—those who gave their customers’ data to Epic, and those who purchased aggregated and analyzed data from Epic. Both of them have potential FTC or civil liability, depending on the circumstances.

When a diligent and privacy-minded consumer visits a merchant’s website, they may look at that merchant’s privacy policy. They may also take precautions like blocking or deleting their cookie files.

It is unlikely, however, that they will delete their browser history files entirely or use a secure proxy server for Web browsing. The merchant’s privacy policy will typically inform consumers about the data it collects and its policies with respect to things like cookies.

Take Papa John’s for example. Its privacy policy notes that: “Our cookies cannot and do not retrieve any other data from your hard drive or pass on computer viruses. If you are just browsing our website, a cookie identifies your browser and user id (and not your identity). If you place orders with us, we use cookies to assist in storing your preferences and recording other session information (a “session” is a single visit by you to our website). We may provide your personal information to our restaurant affiliates and franchisees in order to enable your local Papa John’s restaurant(s) to better serve you. We also aggregate information about how our online ordering service is used (without specific identification to any particular user) to be able to improve our service and make it more responsive to our customers’ preferences. We also make such aggregate information (without identification to any specific individual) available to our restaurant affiliates and other affiliates in order to obtain information about products, services, offers and notices which we believe will be useful and informative to our website users.”

But Epic was collecting information from the consumer’s hard drive—or at least data stored in the browser’s cache indirectly. And Epic was sharing that information not simply with Papa John’s “restaurant affiliates and other affiliates,” whatever that might mean, but with any subscribers to Epic’s data analytics service.

By participating in the Epic marketing program, companies like Papa John’s may themselves be violating the privacy of consumers, either directly or indirectly. Even by purchasing data that was collected this way, retailers may have liability.

And here’s the other problem for consumers. If you want to know what will happen with data you provide to a retailer, a consumer will typically look no further than the retailer’s privacy policy. The retailer’s vendors and suppliers—like Epic—have their own privacy policies, which may be just as turgid as those of the retailer.

For example, Epic’s privacy policy simply stated that Epic Marketplace automatically receives and records anonymous information that your browser sends whenever you visit a website which is part of the Epic Marketplace Network. We use log files to collect Internet protocol (IP) addresses, browser type, Internet service providers (ISP), referring/exit pages, platform type, date/time stamp, one or more cookies that may uniquely identify your browser, and responses by a web surfer to an advertisement delivered by us.

Now, it is highly unlikely that a consumer would ever read the privacy policy of a company like Epic. The consumer has a relationship with the Red Cross or CNN. But even if they read Epic’s policy, they would have no way of knowing that Epic, on behalf of its retailer customers, was actually sniffing the browser history files to profile consumers.

And this, according to the FTC and the settlement agreement finalized last month, constituted a fraudulent and deceptive trade practice by Epic.

No word on whether it also constituted a fraudulent and deceptive trade practice by Epic’s willing merchant participants. But that is what litigation is for.

If you disagree with me, I’ll see you in court, buddy. If you agree with me, however, I would love to hear from you.