The shoot-out over spyware

Guide to E-Commerce Technology

Spyware, adware, parasiteware: depending on the circumstances under which it gets installed on the consumer’s computer and who’s doing the talking, pop-up ad-triggering software has been called all of the above, and more. Litigation pitting retailers against users of the software—including other retailers—and the first statewide law to target spyware are the latest battlegrounds in what’s becoming a war.

At the core of the issue is the question of who controls the consumer’s browser: the consumer, advertisers or even third parties who may profit from the controversial software? Riding on the answer are hundreds of millions of dollars of online marketing investment that opponents of adware are vigorously defending, against the money to be made by distribution channels that serve the ads and other marketers for whom the ads produce sales.

Detractors vs. defenders

As in any war, emotions run high. “It has potential to destroy the consumer’s online shopping experience,” says LinkShare Corp. CEO Stephen Messer. “If consumers figure out there are all these programs that watch what they do, they will stop buying online. It’s bringing back the fear of buying online that we spent eight years getting rid of.”

Carl Rosendorf, CEO of SmartBargains.com Inc., the target of a lawsuit challenging its use of such technology, counters that adware allows consumers to perform one of the basic functions of online shopping: “The Claria Advertising and Information Network that is utilized by SmartBargains is a program that consumers download in order to comparison shop on a real-time basis,” Rosendorf said in a statement at the time the company was sued. “Several federal court decisions, in fact, have strongly supported the consumer’s right to access this form of advertising.”

What has stirred the passions of the online retailing community is ad-triggering software that resides on a consumer’s browser and is set to serve ads from sponsors based on what the consumer views in that browser. It’s basically the same technology behind applications consumers can choose to download from rebate sites such as UPromise. UPromise uses the application to serve up a reminder to consumers browsing merchandise that they can qualify for program rebates by buying the item from a UPromise-participating retailer.

But the same technology supports something seen as far less benign when it serves a competing retailer’s ads to consumers as they are visiting a retail site. Critics say that by directing visitors elsewhere to buy, such ads unfairly hijack traffic which they’ve paid millions to attract to their own site. The pop-ups also create PR problems when pop-up-hating shoppers blame the retail site over which they ads are served, failing to understand that the ads are appearing without the retail site operator’s consent.

Boiling over

Simmering over the past few years, the issue has reached a boiling point with opponents of adware now very vocal. In May, Overstock.com Inc. sued competitor SmartBargains.com over the alleged use of adware to serve SmartBargains’ ads on Overstock’s site, calling the use of spyware “predatory advertising, unfair competition, and a nuisance for consumers.” Overstock also has taken aim against spyware by helping to draft the recently-enacted Utah Spyware Act, the first such state law in the country.

That’s one side of the issue. For while they don’t call the ad-triggering software “spyware,” some marketers support forms of adware. Though SmartBargains declined to be interviewed for this story citing its pending IPO, Rosendorf, in his written statement, defended adware’s use. “We believe Overstock.com’s intention is to avoid and restrict competition by impeding consumers from comparison shopping on the Internet,” Rosendorf said.

SmartBargains isn’t alone, though few online marketers identify themselves publicly with the use of adware. “Advertisers like it because it works,” says Jupiter Research analyst Gary Stein. “There are legions behind (Rosendorf) who are not making statements.” While citing problems with adware and practices that will have to be reined in, Stein says that in and of itself, it can provide smart, behaviorally-targeted marketing.

Nonetheless, shortly after the Overstock suit, L.L. Bean Inc. went on the offensive, suing four retailers—Atkins Nutritionals Inc., Gevalia Kaffe, Nordstrom Inc. and J.C. Penney Co. Inc.—whose pop-up ads L.L. Bean says appeared over LLBean.com. Atkins and Gevalia have since settled with Bean. In a statement after the settlement, Chris McCormick, L.L.Bean’s president and CEO, framed the issue for the rest of the industry. “L.L. Bean is not the only company with so much at stake here,” he said, “and this development demonstrates that other retailers are coming to the same conclusion.”

Though Nordstrom says it is litigating the case because it found the proposed settlement language unacceptable, a spokeswoman adds Nordstrom opposes the use of adware and already had pulled out of adware-supported programs by the time L.L. Bean initiated the suit.

The issue has also spread beyond retailers and providers of adware. It now affects affiliate services providers like LinkShare, which got involved because some users of adware rely on affiliate commissions to sustain their businesses. For almost two years, LinkShare has required partners who use any form of adware to meet certain conditions of use, including testing to prove those conditions are being met. Under those criteria, approximately a dozen affiliate programs have left or been dropped by LinkShare, Messer says, including two of the largest, Claria Corp., formerly Gator Corp., and WhenU.com. In January LinkShare took further steps to distance itself from adware by adopting an “online browsers’ bill of rights” to curtail what it calls BrowserSpam, defined as unsolicited pop-up ads that may be created by downloadable software which interfere with the user’s browser experience.

And others have taken on adware, as well. PriceGrabber.com, a comparison shopping site, and MLB Advance Media, the interactive media and Internet company of Major League Baseball, both issued statements recently saying they will not work with companies that use adware to serve online ads. MLB Advance Media announced it would add language to new agreements and partnership agreements currently being negotiated that bar partners from using spyware to distribute commercial messages in connection with MLB.com. It’s also sent cease-and-desist letters to spyware providers and advertisers who use it to target MLB.com. PriceGrabber.com has launched an anti-spyware initiative with an open letter to users that they will not find pop-up ads served by the company on PriceGrabber.com. The company has said it rejects any promotion of its brand on other sites by means of spyware.

While it’s obvious that retailers object to competing offers served on their own sites, adware’s opponents also say it raises issues for consumers. “I think of adware as applications that make their way onto your computer and barrage you with unwanted pop-up advertising,” says Shawn Schwegman, vice president of technology at Overstock. “Spyware can do the same thing and also capture and distribute information about the user that would otherwise be private, such as browsing habits or credit card information. The lines are very blurred because many do both.”

One especially contentious issue is that of exactly how adware gets attached to consumers’ computer browsers. Typically, that happens when the software is bundled in with other free applications a consumer wants to download, such as the ability to share music files. In such cases, Stein’s opinion is that an ad network’s claim that consumers “opt in” is closer to “acquiescing in.” He says, “It’s not the same as when you go to Delta.com and sign up because you want them to tell you when they have supersaver fares. It’s more like, ‘I’ll take this because I really want Kazaa.’ You’re really looking for something else.”

LinkShare’s Messer calls the bundling of software a slippery slope. “If you ask people, do they want to download coupons, who is going to say no?” he says. “But they’re not really clear on what they’ve said. It’s like a mechanic who asks if you’d like a better-running engine and then replaces your whole engine. If you give people some of the facts and then bury the bad stuff, have you really given them the ability to make a decision?”

Clear instructions

Ad-serving networks WhenU and Claria say language telling consumers what they are downloading and directions for uninstalling their ad-triggering applications are clearly available to consumers. Claria also initially wraps the ads it serves in a border that identifies them as ads from Claria after consumers first download the software, according to Stein. Subsequently, the border appears again, around PSAs served by Claria.

But many argue current adware disclosure practices still leave consumers in the dark. “A lot of times people don’t read the entire end user license agreement,” says Lydia Leong, an analyst with Gartner Dataquest. “They are not necessarily aware that the software they install that otherwise seems helpful is also going to be displaying advertising. Some of these advertisers are responsible in that they clearly mark on the ad a logo that shows where the ad is coming from, and yet users are still confused.”

Drive-by downloads

Beyond adware that attempts to identity itself to consumers is adware that can install itself completely on the sly, like a virus, by exploiting security holes in the user’s browser. A practice few would argue is anything but unethical, the industry has dubbed it “drive-by downloads.” Post-market browser enhancements such as ActiveX controls that can be added to Internet Explorer offer a window through which drive-by downloads can occur.

“ActiveX controls are add-ons to Internet Explorer that enhance browser functionality. The generic installation of Internet Explorer has certain features and enhancements bundled in, but some web developers build into sites additional features and functionality not commonly installed with Internet Explorer,” says Schwegman. When the user goes to those sites, if Internet Explorer detects the user’s browser doesn’t have the functionality needed to run a feature—Macromedia Flash, for instance—it pops up a window asking the user for permission to download that extra capacity.

The same process can be used to sneak adware onto browsers. According to Schwegman, some advertising networks pay bounties on adware installed on users’ browsers. “They are supposed to police this, but there are distribution partners who want to make a bunch of money who will use these tactics to install the software on users’ computers without the users’ knowledge,” he says.

The Trojan horse

Equally sneaky are “anti-spyware” e-mail promotions that offer free software downloads to rid browsers of adware. Some are, in fact, spyware programs that remove their competitors and install themselves.

With various industry factions lining up for and against adware and spyware, resolution in either direction could be a long way off. WhenU.com has challenged the Utah Spyware Control Act and in June a Utah judge ordered the state not to enforce it until the issues surrounding the law are settled.

WhenU argued that the act violates the First Amendment and dormant Commerce Clause of the United States Constitution, among other laws. “This is an important decision for the entire Internet advertising industry,” CEO Avi Naider said in a statement released after the ruling. “Spyware is a problem and we want to put an end to it. WhenU supports appropriate anti-spyware legislation at the federal level, but unfortunately Utah’s Act also impairs legitimate Internet advertising.” Naider says WhenU’s ad network doesn’t use cookies, track individual user data or clickstream data, compile a centralized database of users or engage user profiling. After the ruling, Claria also issued a statement, supporting federal legislation to end “egregious spyware practices” and regulate adware so as to “protect consumers with clear but flexible notice and consent requirements.”

Significantly, both companies separate themselves from the negatives-laden “spyware” while standing on “adware” as a legitimate business model. Settling the semantic battle and gaining consensus on the specific practices that constitute each would deflate some of the current controversy and give both sides something more specific to aim for, observers say. So would eliminating the practices associated with adware or spyware that consumers and marketers find most objectionable, whether by legislation, self-policing by ad distributors, or even technology’s efforts to plug up those browser security holes. Such measures also might have the effect of letting air out of adware’s tires as a marketing tactic, particularly those that address the issue of fully-informed consent for installation. “I don’t know a single person on the planet who is saying, give me adware; I want to see more pop-ups,” says Schwegman.

The wild West

While consumers complain about cascading pop-ups, Leong points out that a number of commonly used applications already have advertising formats embedded in them. For example, the free version of AOL Instant Messenger has a window that sometimes displays ads. “No one objects to that. What people object to is advertising that interferes with the way they work,” she says.

So whether adware is ultimately deemed a questionable business tactic or simply a new one that the industry will adapt to will also be determined in the long run by what consumers will accept. That will be reinforced by legal and legislative action. How quickly that happens and the particulars of the outcome depend on the ongoing shootout among competing interests seeking to stake claims in an uncharted online frontier. “In some ways,” says Schwegman, “the Internet is still the wild, wild West.”