RealNetworks Inc. has issued a software update that stops its music player from secretly collecting information about its users.
“We want to clean this up, and clean it up as quickly as we can,” said RealNetworks Chief Operating Officer Tom Frank. “This was an honest mistake . . . our product teams were moving too quickly.”
But privacy advocate Jason Catlett said it’s another example of how consumers need to be wary about trusting any company with their personal information.
“The general question here is, `Should these information appliances be able to report, collect information about us without our consent?’ The answer is no,” he said.
Since it was released this spring, about 12 million individual users have downloaded the Seattle-based company’s RealJukebox software, which allows people to listen to and store music on their PCs.
The free player allows users to download MP3 and other compressed music files from the Internet, convert regular CDs to MP3 and other digital files, build playlists and transfer the music to portable devices.
What many consumers didn’t know is the player also covertly transmitted information about their musical preferences and listening habits to RealNetworks.
When people installed the software, it asked for information such as their e-mail address and ZIP code and assigned the player a serial number, called a Globally Unique Identifier.
When a CD was played in the CD-ROM drive, RealJukebox used a feature to show the song titles and artist of the music, and sent that information, along with the user ID, to RealNetworks.
The player also sent daily updates to RealNetworks about how many songs users recorded to their hard drives, the type of portable MP3 player they owned and their music preferences, according to Internet security consultant Richard Smith of Brookline, Mass., who discovered the practices while conducting research on Internet privacy.
None of this was disclosed in the RealNetworks privacy policy, which is posted on its Web site at www.real.com. RealNetworks has since added three paragraphs saying it assigned a unique identifier tag to players.
When the breach was revealed, RealNetworks also posted a software update that disables the identifier and prevents transmission of information such as the music people are listening to, the type of MP3 player they own and music they’ve downloaded and stored on their computer.
The company is still determining exactly what data have already been collected and what it will do with the information, Frank said.
More Top Picks Best Task Lamps For Crafts And Hobbies
Frank said there was never any “nefarious intent” in collecting information; rather, he said, the company just wanted to keep track of how many people were using the players.