• by Wendy Davis  @wendyndavis, September 29, 2009

A privacy group has alleged that a company offering Web monitoring software to parents is running afoul of federal law by collecting and selling data about children.

In a complaint filed Friday with the Federal Trade Commission, the Electronic Privacy Information Center alleges that the company EchoMetrix, based in Syosset, N.Y., is engaging in unfair and deceptive behavior and also violating a federal law that restricts the gathering of data about children under 13.

"Parents are unaware that the company collects information about their children and discloses it to third parties," the privacy organization alleges. "These business practices create a new risk of harm to children, whose personal information would not be disclosed to third parties but for the availability of these products in the marketplace."

EchoMetrix says on its Web site that it complies with federal privacy laws and that it does not collect, distribute or sell personal information.

The company offers software that allows parents to monitor their children's Web use, including instant messages, blog posts and activity at social networking sites. In June, EchoMetrix launched a new data-mining service, Pulse, which gleans marketing insights by examining content created by teens. "Every single minute, Pulse is aggregating the Web's social media outlets such as chat and chat rooms, blogs, forums, instant messaging, and Web sites to extract meaningful user generated content from your target audience, the teens," the company says on its Web site.

The Electronic Privacy Information Center alleges that this new service violates the Children's Online Privacy Protection Act, which bans companies from collecting or sharing personally identifiable information about children under 13 without their parents' consent.

Kimberly Nguyen, an attorney with the privacy group, says that Pulse is gathering personally identifiable information by virtue of collecting children's instant-messaging screen names, which are linked to an email address. While the Pulse service is aimed at gathering intelligence about teens, EchoMetrix's monitoring products can be installed by parents of children of all ages.

EchoMetrix says on its site that Pulse does not "identify nor expose in any way the source of any digital content." The company also allows parents to opt out of Pulse.

But the privacy group argues that EchoMetrix's opt-out procedure isn't adequate. "The disclosure in the privacy policy is not clear enough for the parents to understand how their children's information is being used," Nguyen says.

Jeffrey Greenbaum, a partner at the law firm Frankfurt Kurnit Klein & Selz, adds that the FTC has made it clear that Web companies should prominently disclose data collection practices. "If you're collecting information in unexpected ways, it's not enough to bury your practices in a lot of fine print," he says.

Recently, the FTC took action against Sears for allegedly violating people's privacy by installing tracking software on their computers without prominent disclosures. In that case, Sears had told people the software would track "online browsing," and promised users $10 if they kept the software for at least one month. The FTC took the position that Sears had not sufficiently notified users about the nature of the software. Sears, which did not admit to wrongdoing, agreed to destroy all the data it collected.

In the EchoMetrix case, the Electronic Privacy Information Center is seeking an injunction requiring the company to suspend its Pulse service until the company can establish that it complies with federal privacy law.