• by Ross Fadner , March 30, 2004

Spyware appears to be following the same pattern of consumer backlash and litigation as spam, its equally unsolicited and unwanted cousin. Spyware is software installed on a computer that can alter browser settings and track everything consumers do online with the express purpose of targeting them with pop-up ads. Consumer frustrations are mounting against the nearly impossible-to-uninstall software.

Just as the California anti-spam bill demonstrated a remarkably limited understanding of the fundamentals of email marketing, so too does the recently passed Utah anti-spyware bill demonstrate an inadequate understanding of contextual marketing and behavioral targeting. Marketers that collect personal data and monitor user behavior are hoping that federal legislation trumps the Utah anti-spyware act in the same way that the federal Can-Spam law superseded California's anti-spam bill.

Some analysts and industry pundits contend that spyware is a much more serious problem than spam because it affects more than the email inbox, impacting the way a user's Web browser functions.

Legal spyware, dubbed adware, informs users--often buried somewhere in the licensing agreement--about the ads that will be served in exchange for the free software. File sharing software programs, media players, and greeting card programs often come packaged with adware. The term "spyware" denotes non-disclosure of the embedded software's ad-serving function.

Federal legislation on spyware is in the works. Spyblock, which originates from the same people responsible for the Can-Spam legislation, would require notification and consent for the installation of any software on a user's computer, as well as detailed information about how the programs function and what information they collect. The bill would make sharing collected information with third parties illegal, and would require uninstall procedures for all software--something few software-based marketing companies currently offer.

The bill would be enforced by the Federal Trade Commission, which would impose penalties. Individual consumers would not be allowed to bring cases to court under Spyblock.

The bill, which is currently being reviewed by a Senate subcommittee, came under fire last week when software vendors told senators that the bill should focus on the illegal actions of individuals instead of attempting to specifically define spyware.

Contextual advertising and behavioral targeting are techniques used by legitimate marketers to serve consumers relevant ads and promotions. The Utah bill already outlaws contextual and behavioral targeting. It's likely that Web publishers and advertisers will lobby against proposed federal legislation.

Gary Stein, senior analyst, Jupiter Research, calls the Utah legislation "totally reactive," adding that it is the product of federal legislators feeling the pressure from a frustrated consumer public and acting without a thorough understanding of the ramifications of their decision. However, Stein says that the collection of behavioral information should be separate from personal data.

Joseph D. Smith, writing on the CSO Online weblog, says "the new law by itself will not reduce spyware, but it will give a basis for retort action that in itself will limit the quasi-benign spyware used by some larger software manufacturers and some publications." He says that criminal and malicious spyware will not be limited by a new law. "You have to set a software trap to catch a software rat."

Jupiter's Stein agrees. He says that it will be incumbent upon marketers, publishers, and software and technology firms to develop software-based marketing standards and practices to clearly delineate who provides legitimate versus illegal adware. "I prefer to see the industry lead with a code of ethics rather than a template of villains," he says.

Stein notes that technology will not be enough by itself to solve the spyware problem. He says it would be "an arms race" between technology firms and spyware companies, which often bury themselves behind layers of affiliates, making them difficult to pinpoint. Federal legislation, he says, will also be as important as a centralized, consolidated industry effort. "Even if the law is difficult to enforce, that doesn't mean that they shouldn't pass it," says Stein.

"It's too difficult to answer any of these questions right now, because it's too much of a gray area," he adds, but notes that federal legislation will be welcome, if only to displace Utah's clumsy resolution.