The Internet's largest advertising company has quietly begun tracking some consumers' online activities by name and address, a practice that privacy advocates say has the potential to undermine the anonymity of millions of computer users.
The move by DoubleClick Inc. comes after years of assurances by the company that it compiles online profiling data only anonymously and touches on one of the most sensitive issues in cyberspace. Several consumers have filed suits challenging the company's tactic.
The outcome of the dispute could shape the future of the Net, a medium with unprecedented potential to tailor itself to individual consumers, but one that can also reveal a great deal about their interests and spending habits.
DoubleClick is uniquely positioned to collect information on where Internet users go and what they do online. The company places ads on thousands of Web sites and is seeking to combine its online data collection with a giant offline database, which has records on 88 million households from magazine subscriptions and catalog purchases.
The New York-based company said it is doing nothing improper and that consumers aren't affected unless they provide their names to participating Web sites. They contend that consumers will benefit by getting ads more aligned to their interests.
The company also noted that Internet users can opt out of the data tracking system by filling out a form at the DoubleClick Web site.
"We are good actors," said Jonathan Shapiro, a senior vice president for DoubleClick. "We've been leaders in protecting consumer privacy for the past four years, and we think our commitment to providing notice and choice to consumers puts us ahead of the curve."
But privacy groups are alarmed by the new approach.
"This poses a much more widespread privacy threat than any situation we have seen before," said David Sobel, general counsel for the Electronic Privacy Information Center, a nonprofit group based in Washington. "All of this is happening invisibly to most consumers."
The company faces three lawsuits that have been filed over the past week as awareness of the program spread. Several privacy groups said they plan to file a formal complaint with the Federal Trade Commission accusing DoubleClick of engaging in deceptive marketing practices.
The dispute centers on a company that few consumers have even heard of, but one that most Internet users encounter indirectly many times every day through its vast advertising network.
DoubleClick's main business is selling and delivering banner advertisements that appear on more than 11,000 Web sites.
It is also one of many companies online that use technology to learn more about Internet users so that they can be targeted with ads and other content designed to appeal to them. DoubleClick does this by planting so-called "cookie" files on every computer used to view its ads, essentially stamping them with a unique identifier.
In many ways, cookies are a convenience to Internet users. Without them, sites such as Yahoo! wouldn't be able to keep track of passwords and personalized news pages for millions of users. But cookies are also used by advertisers to track where an individual travels online and which ads he or she responds to.
For years, DoubleClick has insisted that its cookie files were never connected to a person's name or address. That is changing in part because DoubleClick aims to take advantage of a giant offline database, Abacus, that it acquired last year.
Through a new program called Abacus Online, DoubleClick is promising Web sites that it can help them deliver far more effective ads -- and charge correspondingly higher rates to advertisers -- if they provide the names of users who fill out online registration forms, make purchases or engage in other transactions that require them to reveal their identities.
DoubleClick executives declined to say which sites, or even how many, have enrolled in the program, but stressed that the only goal is to improve the company's ability to show consumers ads likely to interest them.
"We want to make advertising work on the Web," said Shapiro, general manager of Abacus Online for DoubleClick. "If I know that you like fly-fishing gear because I've delivered a lot of ads to you at fly-fishing Web sites and you've purchased some fly-fishing goods in the past, I can try to bring you offers you will find relevant."
For many consumers, that may be appealing. But some consumers and privacy advocates say the Abacus Online program is a dangerous breach of the anonymity that has helped the Internet to thrive.
"The presumption of anonymity on the Web is what is at stake," said Jason Catlett, president of Junkbusters Corp., a privacy watchdog group. "If the DoubleClick model prevails, then once you have given your name to any site, you could potentially be identified at tens of thousands of other sites instantly."
Catlett said once names are attached to clickstream data, even DoubleClick may not be able to fully control its dissemination. It is unclear, for instance, whether the company would be obligated to furnish the data to law enforcement officials or attorneys seeking information for lawsuits.
Shapiro said DoubleClick does not keep data in a number of "sensitive" categories, including detailed banking information as well as users' activities on health sites and pornography sites.
He also stressed that DoubleClick requires every Web site that joins the new program to notify users when it is collecting data from them that the information might be shared with "third parties," and to offer users the chance to opt out of the arrangement.
But consumers say they are often baffled by privacy policies that read like legal documents and offer few details on exactly what data are being collected from them, with whom it is being shared and for what purpose.