Originally created 02/10/00

Amazon.com subsidiary subject of FTC probe and two lawsuits



SEATTLE -- Two lawsuits have accused an Amazon.com subsidiary of using software to track Internet users to relay customers' personal data to the online retail giant.

The lawsuits were mentioned in a document filed with the U.S. Securities and Exchange Commission on Monday. Amazon.com also said the subsidiary -- Alexa Internet -- and its software are the subject of an "informal" investigation by the Federal Trade Commission.

Alexa's software, which is downloaded and installed on Web browsers like Netscape's Navigator and Microsoft's Internet Explorer, tracks where users go on the World Wide Web in order to provide related Web links and other data.

The two lawsuits mentioned in the SEC filing allege that Alexa's software secretly intercepts personal data and sends that information to third parties, including Alexa's parent company, Amazon.com.

"We are cooperating completely with the FTC on an informal, voluntary basis," said Alexa spokeswoman Dia Cheney. "As for the lawsuits, we believe the claims have no merit."

The FTC would not comment on its investigation.

Computer security consultant Richard Smith, who found the possible privacy problems in Alexa's software, said the concern lies in the way Alexa tracks Web pages in order to provide related links. The system records the entire address of each Web page. On some Web sites, those addresses could contain customer data.

"Some (Web addresses) may contain personal information such as mailing addresses or customer account numbers," the Brookline, Mass.-based Smith said. "It's conceivable that someone like Alexa could tie it all together with your surfing patterns and create a profile."

The lawsuits allege that the San Francisco-based Alexa is doing that -- combining information gleaned from Web addresses with Amazon.com's customer accounts. Both companies deny the accusations. Alexa would not identify where the lawsuits were filed.

Cheney noted that Web usage patterns and customers' data are stored in separate databases and are not linked.

Both Amazon and Alexa said Tuesday that personal data Alexa gathers remains on Alexa's databases and is not made available to Amazon.

Amazon.com has a service it calls "zBubbles," which offers Alexa users the ability to buy certain products based on Internet sites they visit. For example, someone visiting a site about a handheld computer might click on a zBubble to get more information on how to buy the device from Amazon.

However, the zBubbles do not access Amazon.com accounts or take such information from the users' computer, according to the company.

"This is not transactional information," said Amazon spokesman Bill Curry. "This is a service that Alexa has on its product. It doesn't funnel into us."