New York-based Comet Systems Inc.'s free cursor software reports back to its own computers with each customer's unique serial number each time that person visits any of 60,000 Web sites -- including dozens aimed at young children -- that support its technology.
Computer privacy experts expressed dismay over the behind-the-scenes communications, which are sent without warning. But the company insists it is not violating customers' privacy because it does not attempt to match serial numbers against anyone's real-world identity. It published an explanation of its practices on its Internet site Monday after it was contacted by The Associated Press.
``We don't know your gender, your age or anything except you're a Web browser visiting sites,'' Comet spokesman Ben Austin said. ``There's not a lot of reason to crunch that data because I don't see that it's in anyone's economic interests. We're stating for the record that we don't do that and we never will.''
Austin said the company tracks those serial numbers for a census of its customers, who aren't asked to disclose their names or e-mail addresses, and because some Web sites pay Comet based on the number of visitors using the cursor-changing technology.
Critics said the company should have more openly disclosed the transmissions to its customers. They also contend it would not be very difficult with today's technology to begin correlating the Comet serial number with a consumer's identity if the company suddenly decided to or if Comet -- with its extensive tracking database -- were purchased by new owners willing to do that.
``There's zero expectation that tracking is going on with this product,'' said Richard M. Smith of Brookline, Mass., a computer security expert who noticed the communications last week. ``Who would have thought a little cursor could track your Web movements? It's going back to (Comet's) home base and saying this person with this serial number is now at this Web site.''
Consumers are prompted to install Comet's cursor software, which takes only a few seconds, when they visit any of the 60,000 Web sites that support its technology, including those for the Dilbert and Peanuts characters of United Feature Syndicate Inc., the Ty Inc. Web site for Beanie Babies, the Garfield comic strip page and sites for children's movies like ``The Iron Giant'' from Warner Bros.
The campaign Web site for Vice President Al Gore removed support for the technology Monday, citing privacy concerns.
``To the best of the Gore campaign's knowledge, no personally identifiable information was divulged,'' spokesman Chris Lehane said. ``But even this very benign data collection doesn't meet the Gore campaign privacy standards.''
``What I find most disturbing is that most of these Web sites are for kids,'' Smith said. ``You're asking a kid if it's OK to install this software. (Comet Systems) is in such a position to go back and find what sites did this user ID visit. There are so many ways to tie that to an offline identity.''
Austin, the company spokesman, insists Comet has no such plans.
``When companies have gotten in trouble in the past, it's typically because they relate user IDs to some list of real names of actual people,'' Austin said. ``We intentionally keep our users anonymous by not collecting names or e-mail addresses, and it's something we've stated we will not do.''
The company's technology officer, Tom Schmitter, acknowledged that part of the identifier harvested by Comet includes the serial number for each computer's network connection hardware. That means a customer's Web browsing history could be linked back to a specific machine by examining the company's tracking logs and his personal computer.
Schmitter said Comet was unaware it had been collecting those numbers and promised to delete those records, but the company will continue to randomly assign serial numbers to its customers because it needs to count them accurately to make money.
Privacy experts said it was unclear whether Comet was violating any law, although Jason Catlett of Junkbusters Corp., a New Jersey-based privacy advocate, wrote to New York Attorney General Eliot Spitzer asking him to investigate. Catlett called Comet's actions a ``wholesale violation of its users' privacy.''