Source: http://www.jdsupra.com/legalnews/supplemental-materials-in-support-of-pen-36852/
Timestamp: 2017-01-17 05:07:00
Document Index: 162255083

Matched Legal Cases: ['art29', 'art29', 'art 84', '§ 18', '§ 1', '§ 45', '§ 18', '§ 1', '§ 45', 'art. 12', 'art. 5', 'art. 12', 'art. 5']

In the Matter of Google, Inc. and DoubleClick, Inc.Supplemental Materials in Support of Pending Complaint & Request for Injunction, Request for Investigation & For Other Relief
Download PDF Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 1 Before the Federal Trade Commission Washington, DC 20580 In the Matter of ) ) Google, Inc. ) and ) DoubleClick, Inc. ) ) Supplemental Materials in Support of Pending Complaint and Request for Injunction, Request for Investigation and for Other Relief INTRODUCTION 1. On April 20, 2007, the Electronic Privacy Information Center (“EPIC”), the Center for Digital Democracy (“CDD”), and the U.S. Public Interest Research Group (“U.S. PIRG”), filed a Complaint with the Commission requesting an injunction and investigation alleging that Google, Inc. (“Google”), and DoubleClick, Inc. (“DoubleClick”), are engaging in unfair and deceptive trade practices that will be exacerbated by the proposed merger of the two companies. 2. The parties reserved the right to amend their complaint as new facts emerged regarding Google, DoubleClick, and the merger of the two companies. 3. The following paragraphs supplement the complainant’s April 20, 2007 filing, incorporate by reference the earlier statements, and allege new facts supporting the position that Google and DoubleClick have engaged in unfair and deceptive trade practices in violation of Section 5 of the Federal Trade Commission Act and that the FTC should consider consumer privacy interests as part of its merger review authority. 4. The complainants reserve the right to further amend this Complaint as new facts emerge regarding this matter. ADDITIONAL FACTS Actions by Interested Parties 5. On April 20, 2007, following the filing of the EPIC, CDD, and US PIRG Complaint with the FTC, DoubleClick issued a press release regarding “data ownership.” DoubleClick stated that the data collected by its online display advertising technology (DART) could not be used by Google, or combined with information owned by Google. DoubleClick stated that such collected information 20580 Materials for Request 20, ("EPIC"), Democracy ("CDD"), and the U.S. Public Interest Research ("PIRG"), filed a Complaint with the Commission requesting ("Google"), ("DoubleClick"), are engaging in unfair and deceptive be exacerbated companies. right as and the companies. paragraphs the complainant's April filing, have engaged in right as FACTS Interested of the EPIC, and the FTC, DoubleClick issued a press "ownership." stated could not be stated Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 2 belongs to DoubleClick's clients and not to DoubleClick. Doubleclick made no mention of the privacy interests that Internet users may have in the data collected by Doubleclick. 1 6. On May 1, 2007, the New York State Consumer Protection Board sent a letter to the Commission endorsing the EPIC/CDD/US PIRG Complaint regarding the privacy implications of the Google/DoubleClick merger. The Consumer Protection Board stated, "[t]he combination of DoubleClick's Internet surfing history generated through consumers' pattern of clicking on specific advertisements, coupled with Google's database of consumers' past searches, will result in the creation of "super-profiles," which will make up the world's single largest repository of both personally and non-personally identifable information." The Board expressed concern that these profiles expose consumers to the risk of disclosure of their data to third-parties, as well as public disclosure as evidence in litigation or through data breaches. The New York consumer agency urged the Commision to halt the merger until it has fully investigated Google's planned use of DoubleClick's data post-merger.2 The Board urged consumers in New York state to write to the Commisison in support of the Complaint and established a web page for this purpose.3 7. On May 16, 2007, the Article 29 Data Protection Working Party of the European Union announced an investigation into Google's privacy practices and specifically its retention of personal information. The Working Party asked Google whether the company has "fulfilled all the necessary requirements" to abide by EU privacy rules. European Justice Commissioner Franco Frattini expressed support for the investigation.4 8. A Google filing with the Security and Exchange Commission dated May 29, 2007 indicated that the Commission "has issued a request for additional information and documentary materials regarding the proposed acquisition of" Doubleclick.5 9. On June 1, 2007, Google announced that it had acquired Feedburner, a service that “allows blog owners and podcasters the ability to manage their RSS feeds and of their subscribers.” 6 1 DoubleClick Press Release, DoubleClick Statement Regarding Data Ownership (Apr. 20, 2007), available at http://www.doubleclick.com/us/about_doubleclick/press_releases/default.asp?p=573. 2 Letter to FTC Chair Deborah Platt Majoras from Mindy Bockstein, Chairperson and Executive Director, State of New York, State Consumer Protection Board regarding “DoubleClick Inc. and Google. Inc. Merger” (May 1, 2007), available at http://www.epic.org/privacy/ftc/google/CPB.pdf. 3 New York State Consumer Protection Board, “Consumer Alert: Take Action to Protect Your Privacy -May, 2007” (“Without appropriate safeguards, this database could, for example, be made available without consumers’ knowledge or consent to secondary users, including vendors of personal data, as well as made public as evidence in litigation or through data breaches.”), available at http://www.consumer.state.ny.us/consumer_alert_take_action_may07.htm. 4 Letter to Peter Fleischer, Privacy Counsel, Google from Peter Schaar, Chairman, Article 29 Data Protection Working Party (May 1, 2007), available at http://www.epic.org/privacy/ftc/google/art29_0507.pdf. 5 Available at http://www.sec.gov/Archives/edgar/data/1288776/000119312507124889/d8k.htm. made interests users t-State Consumer EPIC/of the Google/merger. The Consumer "[through consumers' pattern of clicking on specifc Google's database will of profiles," make non-personally identifable profiles consumers to the risk of parties, or through data breaches. consumer agency has investigated Google's planned use data 2 consumers in New York to the and established purpose.3 Party the investigation privacy and specifcally Party asked "fulfilled all the necessary by 4 with the Security and Exchange Commission a request for additional information regarding the proposed acquisition of' 5 "blog owners and podcasters to manage RSS track usage of their subscribers." 6 DoubleClick Press Release, DoubleClick Statement Regarding Data Ownership (Apr. 20, 2007), available at http://www.doubleclick.com/us/about_doubleclick/press_releases/default.asp?p=573. 2 Bockstein, Chairperson of New Protection Board regarding "DoubleClick Inc. and Google. Inc. Merger" (May 1, 2007), available athttp://www.epic.org/privacy/ftc/google/CPB.pdf. 'New York State Consumer Protection Board, "Consumer Alert: Take Action to Protect Your Privacy -May, 2007" ("Without appropriate safeguards, this database could, for example, be made available without consumers' knowledge or consent to secondary users, including vendors of personal data, as well as made public as evidence in litigation or through data breaches."), available at http: //www.consumer.state.ny.us/consumer_alert_take_action_may07.htm. aLetter to Peter Fleischer, Privacy Counsel, Google from Peter Schaar, Chairman, Article 29 Data Protection Working Party (May 1, 2007), available at http://www.epic.org/privacy/fc/google/art29-0507.pdf. 5Available at http://www.sec.gov/Archives/edgar/data/1288776/000119312507124889/d8k.htm. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 3 10. The Chair of the Commission has previously stated that “the majority of investigations in which the FTC issued a second request resulted in a merger challenge, consent order, or modification to the transaction, suggesting that the FTC generally issues second requests only when there is a strong possibility that some aspect of the investigation would violate the antitrust laws.”7 Information Collected by Google Services 11. If a user with a Google account regularly uses even a handful of Google’s many services, then Google retains a large quantity of information about that user often for an unstated or indefinite length of time, without clear limitation on subsequent use or disclosure, and without an opportunity to delete or withdraw personal data held by Google if the user wishes to terminate the service. 12. Google maintains records of all search strings and the associated IP-addresses and time stamps for at least 18 to 24 months and does not provide users with an expungement option.8 13. The change in Google’s policy merely means that searches won’t be linked directly to individual computers after 18 to 24 months, however the search histories will be linked to a maximum of about 256 devices, a number that could easily be narrowed with additional analysis of search term histories.9 14. Google has access to any phone numbers, text message and address requests that are processed by Google Maps. 15. Furthermore, Google records standard log information related to a user’s interaction with Google Maps, which would allow Google to link address requests and phone numbers to a user’s IP-address.10 Official Google Blog, “Adding More Flare,” (June 1, 2007), http://googleblog.blogspot.com/2007/06/adding-more-flare.html 7 Deborah Platt Majoras, Chairman, Federal Trade Commission, “Reforms to the Merger Review Process,” (Feb. 16, 2006), available at http://www.ftc.gov/os/2006/02/mergerreviewprocess.pdf. 8 Posting of Peter Fleischer and Nicole Wong to Google Blog, (Mar. 14, 2007), http://googleblog.blogspot.com/2007/03/taking-steps-to-further-improve-our.html. Elinor Mills, Official Google Blog: Taking Steps to further improve our privacy practices, Mar. 14, 2007 [“CNet News Story on Google Blog”], http://news.com.com/Google+adding+search+privacy+protections/2100-1038_3-6167333.html. 10 Google Web History, Privacy Notice: Your choices (June 1, 2007), http://www.google.com/history/whprivacy.html; Google Maps, Help: Google Maps User Guide (May 31, 2007), http://maps.google.com/support/bin/answer.py?answer=68259; Google Maps, Help: How do I save the addresses I search for on Google Maps? (May 31, 2007), http://maps.google.com/support/bin/answer.py?answer=45446&topic=10786; Google Maps, Help: What’s the difference between public maps and unlisted maps? (May 31, 2007), http://maps.google.com/support/bin/answer.py?answer=62845&topic=11305; Google Maps, Privacy Policy (Nov. 1, 2006). previously that "the majority which the FTC issued a second order, to the transaction, issues only is a strong possibility of the investigation the laws. ,7 Collected by Google handful Google's then Google retains a large quantity of or indefinite clear on subsequent without personal the user wishes the records of all search strings and the associated IP-addresses R in Google's merely means won't computers after 18 to 24 months, however the search be to a maximum of about 256 devices, analysis of search histories.9 text message by log user's Google would allow Google to link address requests a user's IP-address.10 6 Official Google Blog, "Adding More Flare," (June 1, 2007), http://googleblog.blogspot.com/2007/06/adding-more-fare.html Deborah Platt Majoras, Chairman, Federal Trade Commission, "Reforms to the Merger Review Process," (Feb. 16, 2006), available at http://www.fc.gov/os/2006/02/mergerreviewprocess.pdf. 'Posting of Peter Fleischer and Nicole Wong to Google Blog, (Mar. 14, 2007), http: //googleblog.blogspot.com/2007/03/taking-steps-to-further-improve-our.html. 9 Elinor Mills, Oficial Google Blog: Taking Steps to further-improve our privacy practices, Mar. 14, 2007 ["CNet News Story on Google Blog"], http: //news.com.com/Google+adding+search+privacy+protections/2100-1038_3 -6167333.html. 10 Google Web History, Privacy Notice: Your-choices (June 1, 2007), http://www.google.com/history/whprivacy.html; Google Maps, Help: Google Maps User Guide (May 31, 2007), http://maps.google.com/support/bin/answer.py?answer=68259; Google Maps, Help: How do I save the addresses I search for on Google Maps? (May 31, 2007), http://maps.google.com/support/bin/answer.py?answer=45446&topic=10786; Google Maps, Help: What's the diference between public maps and unlisted maps? (May 31, 2007), http://maps.google.com/support/bin/answer.py?answer=62845&topic=11305; Google Maps, Privacy Policy (Nov. 1, 2006). Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 4 16. Google has access to additional personal information, including hobbies, employment, address, and phone number, contained within user profiles in Orkut. Google often maintains these records even after a user has deleted his profile or removed information from Orkut.11 17. Google also collects information with Blogger and Google Reader concerning what blogs and Web sites a user frequents.12 18. Google also tracks user interactions with other forms of media. YouTube tracks user browsing on its site and enables Google to collect information on what media users watch.13 19. Google maintains copies of all instant message and email traffic associated with Google users who use Google Talk and Gmail. While Google does allow users to delete their stored chat logs and emails, it is not clear whether Google maintains backup copies of the information. In any case, Google provides users with a large amount of storage space and actively encourages them not to delete their communications.14 20. Furthermore, Google maintains user schedule information inputted into Google Calendar on its own servers and appears to maintain this information at least until the user decides to delete it.15 11 Orkut: About, (May 31, 2007) http://www.orkut.com/About.aspx; Orkut: Privacy (May 31, 2007), http://www.orkut.com/privacy.aspx; http://www.orkut.com/Settings.aspx; http://www.orkut.com/EditInterests.aspx. 12 Blogger, Help: What is a blog? (May 31, 2007), http://help.blogger.com/bin/answer.py?answer=41353&topic=10424; Blogger, Blogger Privacy Notice (Oct. 14, 2005), http://www.blogger.com/privacy; Blogger, Help: How do I moderate comments on my blog? (May 31, 2007), http://help.blogger.com/bin/answer.py?answer=42537; Google Reader, Common Questions (May 31, 2007), http://www.google.com/help/reader/faq.html; http://www.google.com/reader/view/?page=trends. 13 YouTube, Privacy Notice: The Information YouTube Collects (Jan. 20, 2006), http://www.youtube.com/t/privacy; http://youtube.com/signup; http://www.youtube.com/my_profile; http://www.youtube.com/my_videos; Google Video, Welcome to Google Video (May 31, 2007), http://video.google.com/video_about.html; Google Video, Help Center: Google Video Player Privacy Notice (Jan. 6, 2006), http://video.google.com/support/bin/answer.py?answer=32170&topic=1490. 14 Google Talk, Privacy Notice: Personal Information (May 30, 2007), http://www.google.com/talk/privacy.html; Google Talk, Chat History Saving (May 30, 2007), http://www.google.com/talk/chathistory.html#whysavegmail; Gmail, Help Center: How much storage do I get? (May 30, 2007), http://mail.google.com/support/bin/answer.py?answer=6558&topic=1547 (indicating that users are given more than two and a half gigabytes of storage space); Gmail, Getting Started with Gmail: Don’t waste time deleting messages (May 30, 2007), http://www.google.com/mail/help/start.html; Gmail, Privacy Policy: Personal Information (May 30, 2007), http://mail.google.com/mail/help/privacy.html; Gmail, Privacy Policy: Uses (May 30, 2007), http://mail.google.com/mail/help/privacy.html; Gmail, Privacy Policy: Information sharing and onward transfer (May 30, 2007), http://mail.google.com/mail/help/privacy.html. 15 Google Help Ctr., Will Google share my information? (May 31, 2007), http://www.google.com/support/calendar/bin/answer.py?answer=37054&ctx=sibling; Google Help Ctr., Is Google reading my calendar information? (May 31, 2007), http://www.google.com/support/calendar/bin/answer.py?answer=37055&ctx=sibling; access to additional personal information, and phone number, contained within profiles these deleted his profile removed information from Orkut. t t collects information and sites frequents.'2 interactions with media. Google to collect information 13 and email traffic with who Google Talk Gmail. it In any case, actively communications.'4 schedule information to maintain this information the user decides to delete it.15 " Orkut: About, (May 31, 2007) http://www.orkut.com/About.aspx; Orkut: Privacy (May 31, 2007), http://www.orkut.com/privacy.aspx; http://www.orkut.com/Settings.aspx; http://www.orkut.com/Editlnterests.aspx. 2 Blogger, Help: What is a blog? (May 31, 2007), http://help.blogger.com/bin/answer.py?answer=41353&topic=Blogger, Blogger Privacy Notice (Oct. 14, 2005), http://www.blogger.com/privacy; Blogger, Help: How do I moderate comments on my blog? (May 31, 2007), http://help.blogger.com/bin/answer.py?answer=42537; Google Reader, Common Questions (May 31, 2007), http://www.google.com/help/reader/faq.html; http://www.google.com/reader/view/?page=trends. 13 YouTube, Privacy Notice: The Information YouTuhe Collects (Jan. 20, 2006), http://www.youtube.com/t/privacy; http://youtube.com/signup; http://www.youtube.com/my_profile; http://www.youtube.com/my_videos; Google Video, Welcome to Google Video (May 31, 2007), http://video.google.com/video_about.html; Google Video, Help Center: Google Video Player Privacy Notice (Jan. 6, 2006), http://video.google.com/suppor/bin/answer.py?answer=32170&topic=1490. '4 Google Talk, Privacy Notice: Personal Information (May 30, 2007), http://www.google.com/talk/privacy.html; Google Talk, Chat History Saving (May 30, 2007), http://www.google.com/talk/chathistory.html#whysavegmail; Gmail, Help Center: How much storage do I get? (May 30, 2007), http://mail.google.com/support/bin/answer.py?answer=6558&topic=1547 (indicating that users are given more than two and a half gigabytes of storage space); Gmail, Getting Started with Gmail: Don't waste time deleting messages (May 30, 2007), http://www.google.com/mail/help/start.html; Gmail, Privacy Policy: Personal Information (May 30, 2007), http://mail.google.com/mail/help/privacy.html; Gmail, Privacy Policy: Uses (May 30, 2007), http://mail.google.com/mail/help/privacy.html; Gmail, Privacy Policy: Information sharing and onward transfer (May 30, 2007), http://mail.google.com/mail/help/privacy.html. 5 Google Help Ctr., Will Google share my information? (May 31, 2007), http://www.google.com/support/calendar/bin/answer.py?answer=37054&ctx=sibling; Google Help Ctr., Is Google reading my calendar information? (May 31, 2007), http: //www.google.com/support/calendar/bin/answer.py?answer=37055 &ctx=sibling; Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 5 21. Google Desktop, by default, makes a user’s default search engine Google and facilitates the collection of information about the Web traffic of users who use “Advanced Features” associated with Google Desktop. In addition, when users elect to use Google Desktop to facilitate searches across multiple computers, Google retains a copy of the user’s file index on Google’s servers.16 22. Google also collects all search results entered through Google Toolbar and identifies all Google Toolbar users with a unique cookie that allows Google to track the user’s web movement.17 Google does not indicate how long the information collected through Google Toolbar is retained, nor does it offer users a data expungement option in connection with the service. 23. Finally, Google collects detailed personal information concerning users of Google Checkout. Upon registration, users must provide Google with their name, address, credit card number, card verification code, phone number and any desired shipping addresses. Google tracks a user’s transaction history with Google Checkout. Google retains this information indefinitely and explicitly does not allow for the expungement of user information even after a user has canceled the service. 18 How Google Uses Collected Information 16 Google Desktop, Privacy Policy: Information we collect (May 31, 2007), http://desktop.google.com/privacypolicy.html (indicating the Google retains file indexes for the “search across computers” function on their servers); Google Desktop, Privacy Policy: Uses (May 31, 2007), http://desktop.google.com/privacypolicy.html; Google Desktop, Privacy Policy: Your choices (May 31, 2007) http://desktop.google.com/privacypolicy.html. 17 Toolbar for Internet Explorer Help Ctr., Features (May 31, 2007), http://www.google.com/support/toolbar/bin/static.py?page=features.html; Toolbar for Internet Explorer Help Ctr., Google Toolbar for Internet Explorer Privacy Notice: Information we collect (May 31. 2007), http://www.google.com/support/toolbar/bin/static.py?page=privacy.html&; Google Privacy Ctr., Privacy Policy: What are server logs? (May 31, 2007), http://www.google.com/privacy_faq.html#serverlogs; Toolbar for Internet Explorer Help Ctr., Google Toolbar for Internet Explorer Privacy Notice: Information security (May 31. 2007), http://www.google.com/support/toolbar/bin/static.py?page=privacy.html&; Toolbar for Internet Explorer Help Ctr., Google Toolbar for Internet Explorer Privacy Notice: Uses (May 31. 2007), http://www.google.com/support/toolbar/bin/static.py?page=privacy.html&. 18 Google Checkout, Tour: Find it with Google. Buy it with Google Checkout (May 31, 2007), https://checkout.google.com/buyer/tour.html; Google Checkout Tour, Keep your credit card number and email address confidential (May 31, 2007), https://checkout.google.com/buyer/tour.html; Google Checkout: Tour: Track all of your orders and shipping in one place (May 31, 2007), https://checkout.google.com/buyer/tour.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Registration information (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Transaction information (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Information about your use of the service (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Google Cookies (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Log Information (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Links (May 31, 2007), https://checkout.google.com/files/privacy.html. makes user's about the of users use "Features" with when users searches multiple copy of user's file Google's through users user's movement." collected through Google is retained, nor does users option Google concerning their name, address, code, phone Google tracks a user's transaction history with Google retains this information indefinitely does the expungement of user information even after a user has canceled 18 Goole Uses 6 Google Desktop, Privacy Policy: Information we collect (May 31, 2007), http://desktop.google.com/privacypolicy.html (indicating the Google retains file indexes for the "search across computers" function on their servers); Google Desktop, Privacy Policy: Uses (May 31, 2007), http://desktop.google.com/privacypolicy.html; Google Desktop, Privacy Policy: Your-choices (May 31, 2007) http://desktop.google.com/privacypolicy.html. 7 Toolbar for Internet Explorer Help Ctr., Features (May 31, 2007), http://www.google.com/support/toolbar/bin/static.py?page=features.html; Toolbar for Internet Explorer Help Ctr., Google Toolbar for Internet Explorer Privacy Notice: Information we collect (May 31. 2007), http://www.google.com/support/toolbar/bin/static.py?page=privacy.html&; Google Privacy Ctr., Privacy Policy: What are server logs? (May 31, 2007), http://www.google.com/privacy_faq.html#serverlogs; Toolbar for Internet Explorer Help Ctr., Google Toolbar for Internet Explorer Privacy Notice: Information security (May 31. 2007), http://www.google.com/support/toolbar/bin/static.py?page=privacy.html&; Toolbar for Internet Explorer Help Ctr., Google Toolbar for Internet Explorer Privacy Notice: Uses (May 31. 2007), http://www.google.com/support/toolbar/bin/static.py?page=privacy.html&. 'R Google Checkout, Tour: Find it with Google. Buv it with Google Checkout (May 31, 2007), https://checkout.google.com/buyer/tour.html; Google Checkout Tour, Keep your credit card number and email address confdential (May 31, 2007), https://checkout.google.com/buyer/tour.html; Google Checkout: Tour: Track all of your orders and shipping in one place (May 31, 2007), https://checkout.google.com/buyer/tour.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Registration information (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Transaction information (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Information about your use of the service (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Google Cookies (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Log Information (May 31, 2007), https://checkout.google.com/files/privacy.html; Google Checkout, Privacy Policy: Information we collect and how we use it: Links (May 31, 2007), https://checkout.google.com/files/privacy.html. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 6 24. Google claims that it uses all log information, including search queries, IPaddress information, browser type, traffic information, browsing information, and date and time of usage, in order to facilitate “quality control” and deliver “personalized user experiences.”19 25. Google does not explain what “quality control” it is performing, nor does it explain the ways in which it delivers a “personalized experience” beyond scanning content of searches and communications in order to generate targeted advertisements20 and personalized links using AutoLink in Google Toolbar.21 26. Although Google states that it does not sell user information, Google does share user information with other companies. Google shares non-personal aggregated information collected by Google Video,22 Google Talk, Gmail,23 Google Desktop,24 and Google Checkout.25 At least in connection with Google Checkout, Google maintains separate policies about sharing information with Google subsidiaries than with other companies and requires users to separately “opt-out” of information sharing between Google and third parties and Google and its subsidiaries.26 27. Google’s current policy of not selling the personal information that it collects is voluntary and could be changed at any future time, particularly when new opportunities arise as a result of a significant merger. 28. There is no legal standard, binding order, or technological means that prevents Google from selling the user information that Google collected from consumers with the assurance that the data would only be distributed in non-personalized and aggregated form. Privacy Practices That Google Fails to Follow 29. As alleged in the original complaint, Google fails to follow generally accepted privacy practices such as the OECD Privacy Guidelines. As detailed below, Google also fails to adopted additional privacy provisions with respect to specific Google services. 19 See e.g., supra notes 8-10. See e.g., supra note 15. 21 See supra note 18. 22 See supra note 13. 23 See supra note 14. See supra note 16. See supra note 18. Id. all search information, browser type, traffic and time of usage, in order to facilitate "quality control" "user experiences." 19 not explain what "quality control" delivers a "personalized experience" communications generate advertisements20 and personalized links using AutoLink Google Toolbar.21 Google states does Google does share with other companies. Google shares non-personal collected by Google Video,22 Talk Gmail,23 24 and Google Checkout.25 At least in connection with policies about sharing information to separately "opt-out" sharing between parties 26 Google's at any future time, binding that consumers the data would Fails to Follow generally accepted the OECD additional 9 See e.g., supra notes 8-10. 20 See e.g., supra note 15. 21 See supra note 18. 22 See supra note 13. 23 See supra note 14. 24 See supra note 16. 25 See supra note 18. 26 Id. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 7 Google Search Engine 30. Google logs search queries in a manner that makes them personally identifiable but fails to provide users with the ability to edit or otherwise expunge records of their previous searches.27 31. Although Google has announced that it will begin limiting the retention period of information,28 Google currently fails to expunge a user’s log information and retains the data for as long as it chooses.29 32. Google’s announced, but as of yet unimplemented, “anonymization” protocol fails to render log information untraceable to identifiable Interner users.30 Google Web History 33. Although Google allows a user to see search history by using Google Web History, Google fails to allow users to expunge their search records from Google servers. 31 A user is only able to delete or clear the records that he himself can see; the user cannot view or modify Google’s independent records of his search 32 Google Maps 34. Google fails to give users access to log information generated through their interaction with Google Maps.33 35. Google fails to remove addresses from a user’s map search history that are connected to sensitive information relating to that user.34 36. Google fails to allow a user to “opt-in” to making their personalized maps publicly searchable.35 37. Google fails to provide users with the means to keep personalized maps, including addresses that users may wish to keep secret, from being accessed by the public.36 Google Privacy Ctr., Privacy Policy Highlights, http://www.google.com/intl/en/privacy.html. 28 Fleischer and Wong Posting to Google Blog, supra note 8. Id. CNet News Story on Google Blog, supra note 9. See Google Web History, Privacy Notice, supra note 10. 32 33 See Google Maps, Privacy Policy, supra note 10. 34 See Google Maps, Help: How do I save the addresses I search for on Google Maps?, supra note 10. See Google Maps: Help: What’s the difference between public maps and unlisted maps?, supra note 10. Id. Google Search Engine in that makes them personally identifiable to edit or otherwise of previous searches.27 announced that it will begin limiting log information 2' Google currently fails to expunge a user's search ilnofgormation and retains the data for as long as it chooses.29 Google's but as of yet unimplemented, "anonymization" fails to render log information untraceable to identifiable Interner users .30 Google Web History Google allows a user to see Google fails to allow users to expunge search 31 A user is only able to delete or can see; view Google's independent records search history.32 Google Maps users to log interaction with Google Maps.33 to remove addresses user's connected to sensitive information relating to that user.34 "in" to making their personalized maps publicly searchable.35 users the means including that users may wish accessed 36 27 Google Privacy Or., Privacy Policy Highlights, http://www.google.com/intl/en/privacy.html. 2' Fleischer and Wong Posting to Google Blog, supra note 8. 29 Id. 30 CNet News Story on Google Blog, supra note 9. 31 See Google Web History, Privacy Notice, supra note 10. 32 Id. 33 See Google Maps, Privacy Policy, supra note 10. 34 See Google Maps, Help: How do I save the addresses I search for on Google Maps?, supra note 10. 35 See Google Maps: Help: What's the diference between public maps and unlisted maps?, supra note 10. 36 Id. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 8 Blogger 38. Google fails to provide users with access to log information generated through their interaction with Blogger.37 39. “in” to making their blogs publicly viewable.38 Google Reader 40. Google fails to provide users with access to log information created through their interaction with Google Reader.39 Google Video 41. Google fails to provide users with access to log information created through their interaction with Google Video.40 42. Google fails to provide users with aggregated information shared with Google’s business partners.41 43. Google fails to allow users to “opt-in” to making their videos publicly viewable.42 44. Google fails to provide users with the means to prevent videos marked as private from being viewed by the public.43 YouTube 45. Google fails to provide users with access to log information created through their interaction with YouTube and generated by clear GIFs and Cookies served by the Web site.44 46. Google fails to provide users with access to information concerning them that is shared with third parties.45 Orkut 47. Google fails to allow users to “opt-in” to making most of the personal information contained in their Orkut viewable by the public.46 37 See Blogger, Blogger Privacy Notice, supra note 12. 38 Id. Google Privacy Ctr.: Privacy Policy Highlights, http://www.google.com/intl/en/privacy.html. 40 Google Video Help Ctr., Google Video Player Privacy Notice, supra note 13. 41 http://video.google.com/videouploadform. 43 Google Video Help Ctr., What are “unlisted” videos? (May 31, 2007), http://video.google.com/support/bin/answer.py?answer=48320. YouTube Privacy Notice, The Information YouTube Collects, supra note 13. Id. Blogger users generated their interaction with Blogger.37 Google fails to allow users to "opt-in" to making their blogs publicly viewable.38 to log Google Reader.39 to log interaction with Google Video.40 information with Google's 41 "in" to making their videos publicly viewable.42 users the means from being viewed by the public.43 YouTube to log You Tube Web site.44 users to shared with third parties.45 "in" viewable by the public.46 3' See Blogger, Blogger Privacy Notice, supra note 12. 39 Id. 39 Google Privacy Ctr.: Privacy Policy Highlights, http://www.google.com/intl/en/privacy.html. wGoogle Video Help Ctr., Google Video Player Privacy Notice, supra note 13. 41 Id. 42 http://video.google.com/videouploadform. 43 Google Video Help Ctr., What are "unlisted" videos? (May 31, 2007), http://video.google.com/support/bin/answer.py?answer=48320. 44 YouTube Privacy Notice, The Information YouTube Collects, supra note 13. 45 Id. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 9 48. Google fails to remove residual copies of a user’s profile that remain on Google’s servers even after a user terminates his account.47 Google Analytics 49. Google fails to provide the users whose information is tracked with Google Analytics access to the information retained by Google Analytics.48 Google Talk 50. Google fails to allow users to “opt-in” to saving their Google Talk chat logs.49 51. Google fails to provide users to access with the log information generated through a user’s interaction with Google Talk.50 52. Google fails to provide users with access to information collected about their use of Google Talk.51 53. Google may retain backup copies of a user’s communications even after a user deletes them.52 Google Mail (Gmail) 54. Google fails to provide users with access to the information collected about the user’s use of Gmail.53 55. Google fails to provide users with access to the log information created through their interaction with Gmail.54 56. Google fails to provide users with access to the aggregated information provided to advertisers concerning a user’s interaction with the targeted advertising generated by Gmail.55 See http://www.orkut.com/EditInterests.aspx. See Orkut, Privacy, supra note 11. 48 Google Analytics, What is Google Analytics? (May 31, 2007), https://www.google.com/support/analytics/bin/answer.py?answer=26803&ctx=sibling. See http://mail.google.com/mail/(last visited May 31, 2007 7:28 EST) (follow options link; then follow chat link); Google Talk, How do I enable this feature? (May 30, 2007), http://www.google.com/talk/images/settings_chat.gif. See Google Talk, Google Talk Privacy Notice: Personal Information, supra note 14. 51 Id. Google Talk, Chat History Saving: How do I delete my chat histories? (June 2, 2007), http://www.google.com/talk/chathistory.html#howdelete. 53 Gmail, Privacy Policy: Personal Information, supra note 13. Id. 55 See Gmail, Privacy Policy: Uses, supra note 13; Gmail, Privacy Policy: Information sharing and onward transfer, supra note 13. user's profile Google's his account.47 information access retained by Google Analytics.48 users "opt-in" to saving their Google Talk chat logs.49 users with a user's interaction with Google Talk.5° users access use Talk.51 user's 52 users access user's use of Gmail.53 users their interaction with Gmail.54 users access information user's 55 46 See http://www.orkut.com/Editlnterests.aspx. 47 See Orkut, Privacy, supra note 11. 4s Google Analytics, What is Google Analtics? (May 31, 2007), https://www.google.com/support/analytics/bin/answer.py?answer=26803 &ctx=sibling. 49 See http://mail.google.com/mail/(last visited May 31, 2007 7:28 EST) (follow options link; then follow chat link); Google Talk, How do I enable this feature? (May 30, 2007), http://www.google.com/talk/images/settings-chat.gif. 50 See Google Talk, Google Talk Privacy Notice: Personal Information, supra note 14. 51 Id. 52 Google Talk, Chat History Saving: How do I delete my chat histories? (June 2, 2007), http://www.google.com/tatk/chathistory.html#howdelete. 5s Gmail, Privacy Policy: Personal Information, supra note 13. 54 55 Id. See Gmail, Privacy Policy: Uses, supra note 13; Gmail, Privacy Policy: Information sharing and onward transfer, supra note 13. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 10 57. Google may retain backup copies of a user’s email messages even after a user deletes them.56 Google Calendar 58. Google fails to allow users to “opt-in” to receiving invitations for Google Calendar events sent by other users.57 59. Google may retain copies of a user’s schedule information even after a user deletes that information from his Google Calendar.58 Google Desktop 60. Google fails to allow users to “opt-in” to setting Google as their default search engine. 59 61. Google fails to encrypt by default the file index created by Google Desktop.60 62. Google fails to give users access to the information collected through their with Google Desktop’s “Advanced Features.”61 Google Toolbar 63. Google fails to allow users to “opt-in” to setting Google as their default search engine. 62 64. Google fails to alow users to “opt-in” to activating certain advanced features of Google Toolbar that may transmit additional information to Google.63 65. Google fails to give users access to the log information created through users’ interaction with Google Toolbar.64 Google Checkout 66. Google fails to provide users with access to the log information created through a user’s interaction with Google Checkout.65 Gmail, Privacy Policy: Your choices (May 30, 2007), http://mail.google.com/mail/help/privacy.html. 57 See supra note 15. 58 Google Calendar, Privacy Notice: Your choices (June 2, 2007), http://www.google.com/intl/en/googlecalendar/privacy_policy.html. See supra note 15. 60 Id. 61 Google Desktop, Privacy Policy: Information we collect, supra note 16. See supra note 17. 63 See Google Toolbar for Firefox Help Ctr., Your Privacy (May 31, 2007), http://www.google.com/support/firefox/bin/static.py?page=features.html&v=3. 64 See Toolbar for Internet Explorer Help Center, Google Toolbar for Internet Explorer Privacy Notice: Information we collect, supra note 10. backup copies of a user's email messages 56 fails to "opt-in" events sent by other users.57 user's even that information his Google Calendar.58 Google Desktop "in" to setting Google as search by default the file index created by Google Desktop.60 to the information interaction with Google Desktop's "Advanced Features. ,61 "in" to setting Google as search 62 "in" to activating certain advanced Google Toolbar that may transmit additional information to Google.63 give users to log created users' interaction with Google Toolbar.64 users access created user's interaction with Google Checkout.65 56 Gmail, Privacy Policy: Your-choices (May 30, 2007), http://mail.google.com/mail/help/privacy.html. 5' See supra note 15. 5' Google Calendar, Privacy Notice: Your-choices (June 2, 2007), http: //www.google.com/intl/en/googlecalendar/privacy_policy.html. 59 See supra note 15. fi" Id. 6 Google Desktop, Privacy Policy: Information we collect, supra note 16. 62 See supra note 17. 63 See Google Toolbar for Firefox Help Ctr., Your Privacy (May 31, 2007), http: //www.google.com/support/firefox/bin/static.py?page=features.html&v=3. 6' See Toolbar for Internet Explorer Help Center, Google Toolbar for Internet Explorer Privacy Notice: Information we collect, supra note 10. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 11 67. Google fails to provide users with access to the information that is shared with affiliated businesses.66 68. Google fails to provide users with access to the aggregated information that is shared with third parties.67 69. Google fails to allow users to “opt-in” to information sharing and requires users to separately “opt-out” of information sharing between Google and third parties and Google and its subsidiaries.68 70. Google retains a user’s credit card information and transaction history even after a user disables Google Checkout and may fail to allow users who disable the service to view or otherwise modify the retained information.69 DoubleClick Services Dynamic Advertising, Reporting and Targeting (“DART”) 71. DoubleClick’s main product is a service called Dynamic Advertising, Reporting and Targeting (“DART”), which utilizes DoubleClick’s customer profiles.70 72. DART for Advertisers (“DFA”) is a service specialized for marketers. DoubleClick estimates that DFA is responsible for the placement of more than 60 billion ads per month, and approximately 720 billion ads per year.71 73. According to the DoubleClick Web site: “[DFA’s] extensive features and functionality allow marketers to centrally manage creative assets, traffic more compelling ads, track results beyond impressions and clicks to understand conversion, ROI and branding, and automatically optimize creative to improve results.”72 74. DFA claims to be the most advanced ad management system on the market,73 and it is the most used.74 65 See Google Checkout, Privacy Policy: Information we collect and how we use it: Log Information, supra note 18. See Google Checkout, Privacy Policy: Information Sharing (May 31, 2007), https://checkout.google.com/files/privacy.html. See Google Checkout, Privacy Policy: Information we collect and how we use it: Links, supra note 18. 68 See Google Checkout, Privacy Policy: Sharing Between Affiliates (May 31, 2007), https://checkout.google.com/files/privacy.html. 69 See Google Checkout, Privacy Policy: Accessing and updating your personal information (May 31, 2007), https://checkout.google.com/files/privacy.html. Dart for Advertisers, Dart for Advertisers (June 1, 2007), http://www.DoubleClick.com/us/products/dfa/. 71 Id. Id. Id. GOOG: 500.49 +2.49 (.50%), http://finance.google.com/finance?q=GOOG. to the information with affiliated businesses.66 users access information parties.67 users "in" to information sharing and requires users "out" sharing between parties between Google and its subsidiaries.68 user's Google and may fail the retained 69 Services Dynamic Advertising, Reporting and Targeting ("DART') DoubleClick's main product is a ("DART"), which utilizes DoubleClick's customer profiles.7° DARTfor Advertisers ("DFA") is a service specialized for marketers. estimates is responsible the ads per month, and approximately 720 billion ads per year.71 "[DFA's] extensive features allow marketers to centrally manage creative ads, automatically results."72 claims to be the most advanced ad management system on the market,73 the most used.74 65 See Google Checkout, Privacy Policy: Information we collect and how we use it: Log Information, supra note 18. 66 See Google Checkout, Privacy Policy: Information Sharing (May 31, 2007), http s : //checkout.google.co m/files/privacy.html. 67 See Google Checkout, Privacy Policy: Information we collect and how we use it: Links, supra note 18. fiR See Google Checkout, Privacy Policy: Sharing Between Afiliates (May 31, 2007), http s : //checkout.google.co m/files/privacy.html. fig See Google Checkout, Privacy Policy: Accessing and updating your personal information (May 31, 2007), https://checkout.google.com/files/privacy.html. 70 Dart for Advertisers, Dartfor 2007), http://com/us/71 Id. 72 73 Id. 74 GOOG: 500.49 +2.49 (.50%), http://finance.google.com/finance?q=GOOG. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 12 75. DoubleClick also offers DART for Publishers (“DFP”). DoubleClick provides this service to enable users to “leverage content into ad revenue.”75 DFP is designed to streamline ad management and reduce infrastructure cost, and has the ability to serve more than 100,000 ads per second.76 76. DoubleClick also offers DART Sales Manager, DART Enterprise, and DART Adapt. These tools built on the DART platform. DoubleClick simplifies the DART platform with additional tools: the use of accurate software,77 “advanced sales planning, targeting, trafficking, inventory management and reporting tools,”78 and a “highly advanced optimization solution” along with revenue models.79 DART Search 77. DART Search enables users to extract keyword level performance data from search engines.80 Currently, DoubleClick can retrieve data from each of the following engines: Google (& AOL), Yahoo!, MSN, Kanoodle, Ask.com, and MIVA (Europe). 78. The data collected includes impressions, clicks, click charges, and average position. DoubleClick is so confident in their ability to collect this data, that DoubleClick guarantee users that its data will be 99 percent accurate.81 79. Currently, DART Search has the ability to manage approximately 500,000 82 This information is valuable for and it helps them optimize targeted placement of ads. DART Motif 80. DART Motif is a service that is targeted at advertisers involved in sophisticated and more creative marketing strategies.83 This service enables advertisers to provide advertisements with up to 2 MB of high-quality video, technology, and other interactive features.84 With the advent of streaming DART for Publishers (June 2, 2007), http://www.doubleclick.com/us/products/dfp/. How DART for Publisher Works & Customer Support (June 2, 2007), http://www.doubleclick.com/us/products/dfp/howitworks.asp. DART Sales Manages (June 2, 2007), http://www.doubleclick.com/us/products/dart_sales_manager/. 78 DART Enterprise (June 2, 2007), http://www.doubleclick.com/us/products/dart_enterprise/. DART Adapt (June 2, 2007), http://www.doubleclick.com/us/products/dart_adapt/. 80 DART Search, Search Engine Data and the 99% Policy (June 2, 2007), www.doubleclick.com/us/knowledge_central/documents/MISC/DART_Search_Search_Engine_Data_and_ the_99_Policy.pdf. 81 Id. (although, average position is not included). 82 DoubleClick, Search engine marketing at your fingertips (June 2, 2007), http://emea.doubleclick.com/docuements/dart-search_UK.pdf. 83 DART Motif (June 2, 2007 http://www.doubleclick.com/us/products/dart_motif/. 84 DART Motif, Benefits -Creative (June 2, 2007), http://www.dartmotif.com/benefits/benefits_creative.asp. DARTfor ("DFP"). provides "ad revenue."75 reduce infrastructure the ability 100,000 ads per second.' 76. DoubleClick also offers DART Sales Manager, DART Enterprise, and DART These platform with additional tools: the use accurate software," "advanced planning, targeting, trafficking, management tools,"78 and a "highly optimization solution" revenue 79 users to extract keyword from engines.80 Currently, DoubleClick engines: Yahoo!, MSN, Kanoodle, com, (Europe). charges, and average is to collect this data, guarantee that its data will accurate.' keywords. 82 This information is valuable for ad purchasers and it helps tohpetmimize ads. Motif is a service rich media and more creative marketing strategies. 83 This service eandvaebrlteissers to provide with up to 2 MB of Flash technology, and other interactive features. 84 With the advent of streaming 75 DART for (June 2, 2007), http://www.76 for Publisher Works & Customer Support (June doubleclick.com/us/asp. 77 DART Sales Manages (June 2, 2007), http://www.doubleclick.dart sales manager/. 7' Enterprise (June doubleclick.com/us/products/dart_enterprise/. 79 DART Adapt (2, 2007), http://www.dart adapt/. R° DART Search Engine Data knowledgecentral/MISC/DART Search Search Engine Data and R' Id. 12 Search fngertips (June doubleclick.com/docuements/dart-searchUK.pdf R3 (June dart 84 Motif, Benefts -Creative (June benefts/benefts creative.asp. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 13 video content and other online multimedia entertainment, this is an emerging area of advertising. DoubleClick Advertising Exchange 81. Recently DoubleClick announced the formation of the DoubleClick Advertising Exchange, which aims to maximize the yield for sellers of advertising space and buyers.85 The DoubleClick Advertising Exchange notes that some publishers are left with approximately 80 percent of potential advertising opportunities unsold, and aims to match up buyers with sellers to lower this number.86 Information Collected by DoubleClick 82. DoubleClick creates profiles of Internet users who browse Web sites that feature its advertisements. These profiles are created by utilizing “cookies” and “Web beacons” (also known as clear GIFs and pixel tags), which DoubleClick also refers to as “Spotlight” tags. These technologies track a user’s Internet activity across Web sites featuring DoubleClick technology and are used to determine the effectiveness of DoubleClick clients’ advertisements.87 83. Aggregate information about users with an active cookie is linked together to create the customer profile. DoubleClick has marketed this profiling service as Boomerang. It is described as: “[T]he most effective form of targeting available. It allows you to re-target the most desirable audience of all: browsers who have already shown an interest in your product or service. With Boomerang, you can now engage that audience in a dialogue, providing timely and relevant messages triggered by their online actions.”88 84. For example, a user who enters a Web site and considers making a purchase but decides not to follow through will be tagged on a special Boomerang list and targeted repeatedly for potential future business transactions.89 How DoubleClick Uses Collected Information 85. DoubleClick claims that all information collected by its DART ad serving technology remains the property of its clients.90 Due to the nature of this arrangement, DoubleClick claims that it cannot access the information 85 DoubleClick Advertising Exchange (June 2, 2007), http://www.doubleclick.com/us/products/adx/. 86 Id. 87 DoubleClick, Privacy Policy (Aug. 28, 2006), http://www.doubleclick.com/us/about_doubleclick/privacy/. 88 DoubleClick, Boomerang for Advertisers, Marketers, and Agencies, (2006), http://www.doubleclick.com/us/products/dfp/; http://www.doubleclick.com/us/knowledge_central/documents/MISC/overview_boomerang_0607.pdf. 89 Id. 90 Press Release, DoubleClick Inc., DoubleClick Statement Regarding Data Ownership (Apr. 20, 2007) [“DoubleClick Press Release on Data Ownership”] (on file with author). entertainment, this is an the formation DoubleClick for sellers of advertising space the return on investment for buyers. 85 The DoubleClick Advertising Enoxtcehsa tnhgaet publishers are left with this number.86 creates of Internet users browse These profiles are created by utilizing "cookies" "beacons" clear GIFs and pixel tags), which "Spotlight" tags. user's Internet activity Web featuring technology and are used of DoubleClick clients' advertisements.' the customer profile. service as "[you to re-target the most in and relevant messages their online actions." 88 not to follow be tagged on potential future business transactions. 89 collected its DART ad its clients.90 DoubleClick cannot the information ss Advertising Exchange (June doubleclick.com/us/products/adx/. 96 Id. 97 DoubleClick, Privacy com/ss Boomerang Advertisers, Marketers, and doublechck.doubleclick.com/us/knowledge_overview boomerang_99 "" Release, DoubleClick Inc., DoubleClick ["Press on Data Ownership"] (on fle author). Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 14 themselves, nor would DoubleClick be able to make the data available to third parties.91 86. Furthermore, DoubleClick claims it only has limited access to the data for aggregate reporting, and to provide to legal authorities when required.92 87. After a cookie expires, DoubleClick claims a user’s activity will not lead the company to send future advertisements or emails about goods or services.93 Privacy Practices That DoubleClick Fails to Follow 88. DoubleClick, by default, collects data in a manner that makes Internet users personally identifiable by tracking their Internet activity and fails to allow Internet users to edit or otherwise expunge existing records of their activity profiles.94 89. DoubleClick does not give users an opportunity to view data that may have been collected about them; nor do users have the opportunity to edit or delete information collected about them. 90. Although DoubleClick allows users to “opt-out” of cookies collecting information about personally identifiable activity, DoubleClick fails to allow users to “optout” “identifiable information.”95 91. Users are not provided with an explanation of “non-personally-identifiable information.” 92. Furthermore, the opt-out process must be repeated whenever users switch browsers or expunge all cookies.96 93. DoubleClick fails to give Internet users the option of making their “opt-out” more permanent.97 94. Although DoubleClick claims it will not access personally identifiable information and that it only looks at data in aggregate form, DoubleClick fails to provide adequate safeguards to prevent the company from doing so in the future.98 95. In sum, DoubleClick fails to follow commonly accepted privacy practices. 91 Id. Id. Id. 94 Id. DART Cookie Opt-Out (June 2, 2007), http://optout.doubleclick.net/dclk/optout-success.html. Id. Id. 98 DoubleClick Press Release on Data Ownership, supra note 90. nor be 91 claims it only has limited access aggregate reporting, and to provide to legal authorities when required.92 user's activity not lead advertisements or emails about goods or services.93 That DoubleClick by default, collects data in a manner that makes users users to edit or otherwise expunge existing records of their activity profles.94 does users to view data that may have the opportunity collected about "out" personally identifable to users "optout" of cookies that collect "non-personally-identifable information."95 are not provided with an explanation of "non-personally-identifable information." out process cookies.96 to give Internet option of "out" 97 not access identifable form, DoubleClick so in the future.98 to follow commonly accepted privacy practices. 9' Id. 92 93 94 Id. Id. 95 Cookie Opt-Out (June net/dclk/optout-success.96 Id. 97 Id. 9' Press Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 15 ADDITIONAL INFORMATION ON FTC AUTHORITY FTC Has the Authority to Review Privacy Issues As Part of Its Merger Review Power 96. The FTC has the authority to review mergers under Section 7 of the Clayton Act, which proscribes a merger whose effects may substantially lessen competition;99 under Section 1 of the Sherman Act, which prohibits an agreement that constitutes an unreasonable “restraint of trade;100 and Section 5 of the Federal Trade Commission Act (“FTCA”), which proscribes “unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce.”101 97. The FTC also derives its privacy enforcement authority from Section 5 of the FTCA. In the last few years, the FTC has used its Section 5 authority to impose significant privacy safeguards that have protected consumers and led to the development of better and more innovative business practices. 98. In determining whether a merger should proceed, the Commission looks at (1) market definition and concentration; (2) potential adverse competitive effects; (3) entry analysis; (4) efficiencies; and (5) failing and exiting assets.102 99. The Google/DoubleClick merger would concentrate a majority of the data necessary for the “online targeted advertising” market in one company, creating numerous adverse competitive effects. 100. Unless the FTC uses its authority to modify or block this merger, Google/DoubleClick, based on the detailed personal information of Internet users, will expand its market position to drive out competing advertising and search firms, will control the process of monetizing web content, will exploit the detailed profiles of Internet users for private commercial gain, and will fail to develop the privacy safeguards that would protect consumers and lead to the development of better and more innovative business practices in a competitive marketplace. Precedent Under Merger Review Authority VNU N. V. – Nielsen Media Research Inc. Merger 101. In 1997, the FTC reviewed data collection in advertising mergers in In Re VNU N.V.103 In this case, the FTC alleged that VNU N.V.’s acquisition of Nielsen 15 U.S.C.A. § 18 (2007). 100 15 U.S.C.A. § 1 (2007). 101 15 U.S.C.A. § 45 (2007). 102 Fed. Trade Comm’n, Commentary on the Horizontal Merger Guidelines, 7 (2006), available at http://www.ftc.gov/os/2006/03/CommentaryontheHorizontalMergerGuidelinesMarch2006.pdf. 103 Fed. Trade Comm’n, Complaint, In Re VNU N.V., FTC Docket No. C-3900 (Oct. 22, 1999), available at http://www.ftc.gov/os/1999/10/vnunvcomplaint.htm. INFORMATION ON Privacy Issues authority which proscribes a merger whose effects may substantially lessen cuondmepr eSteitciotinon;9 19 prohibits an agreement an unreasonable "restraint of trade;' 00 and Section 5 of the FCeodmemraisl sTiorand Aect ("FTCA"), which proscribes "unfair methods in commerce." 101 its In the last few years, the has privacy safeguards that have protected business and entry analysis; (4) efficiencies; and (5) failing and exiting assets.'°2 concentrate for "advertising" its authority based Internet users, expand its market to drive out competing advertising and search will control the process monetizing the will to develop development of Under Merger Review Authority V Nielsen Media Research VNUN. V103 In this case, the FTC alleged that VNU N.V.'99 15 U.S.C.A. § 18 (2007). '00 15 U.S.C.A. § 1 (2007). 10' 15 U.S.C.A. § 45 (2007). 102 Fed. Trade Comm'n, Commentary on the Horizontal Merger Guidelines, 7 (2006), available at http: //www.ftc.gov/os/2006/03/CommentaryontheHorizontalMergerGuidelinesMarch2006.pdf. 'os Fed. Trade Comm'n, Complaint, In Re VNU N.V., FTC Docket No. C-3900 (Oct. 22, 1999), available at http: //www.ftc.gov/o s/1999/10/vnu nvcomplaint.htm. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 16 Media Research, Inc. would eliminate competition in the relevant market, increase the likelihood that customers would be forced to pay higher prices and decrease entry into the market.104 102. The merging companies both tracked when and where advertisements ran in national and local media. They then integrated this data with advertising costs and television ratings to create reports on overall advertising expenditures, and sold the reports to customers, who would then develop strategies for the purchase and placement of future advertisements. 103. VNU agreed to settle the matter with the FTC by divesting its Competitive Media Reporting (“CMR”) division (the nation's largest supplier of advertising expenditure measurement services) within six months of when the agreement was signed. 105 104. VNU also agreed to ensure that CMR remained a viable independent competitor, provide financial incentives for CMR workers to accept jobs with the acquirer and comply with standard record keeping provisions.106 Softsearch Holdings, Inc. – Geoquest International Holdings, Inc. Merger 105. The FTC acted to prevent data monopolies in In Re Softsearch Holdings, Inc.107 In a 1997 Complaint, the FTC alleged that a merger between Softsearch Holdings, Inc. and Geoquest International Holdings, Inc. would create a monopoly for U.S. gas and oil production and well history data in violation of federal antitrust laws. 106. A consent order in the case required the merged company to license a set of complete well history and production data to a commission-approved buyer, which would then act as an independent competitor.108 Automatic Data Processing – AutoInfo, Inc. Merger 107. The FTC required access to information databases as a condition of merger in In re Automatic Data Processing, Inc.109 In a 1996 Complaint, the FTC alleged that a merger between Automatic Data Processing, Inc. (“ADP”) and 104 Id. Fed. Trade Comm’n, Agreement Containing Consent Orders, In Re VNU N.V., FTC Docket No. C-3900, File No. 991-0319 (Oct. 22, 1999), available at http://www.ftc.gov/os/1999/10/vnunconsent.pdf. 106 Id. Fed. Trade Comm’n, Decision and Order, In Re Softsearch Holdings, Inc., FTC Docket No. C-3759 (Aug. 1997). 108 Id. Fed. Trade Comm’n, Decision and Order, In Re Automatic Data Processing, Inc., FTC Docket No. 9282 (Oct. 20, 1997), available at http://www.ftc.gov/os/1997/10/autoinfo.htm. Inc. the the likelihood decrease entry into the market.'04 costs then strategies the purchase agreed with ("CMR") division (the nation's largest services) within when the agreement ios also agreed workers to accept with standard record keeping provisions.106 Softsearch Holdings, Inc. -Geoquest International Holdings, Inc. Merger monopolies Sofsearch 107 In a 1997 Complaint, create oil and well history data in violation the case license a and production data a would then act as an independent competitor.108 -A utolnfo, to as a condition of Data Processing, Inc.109 In 1996 Complaint, merger between Automatic Data Processing, Inc. ("ADP") '04 Id. 105 Fed. Trade Comm'n, Agreement Containing Consent Orders, In Re VNU N.V., FTC Docket No. C-3900, File No. 991-0319 (Oct. 22, 1999), available at http://www.ftc.gov/os/1999/10/vnunconsent.pdf. '06 Id. 107 Fed. Trade Comm'n, Decision and Order, In Re Softsearch Holdings, Inc., FTC Docket No. C-3759 (Aug. 1997). 108 Id. 109 Fed. Trade Comm'n, Decision and Order, In Re Automatic Data Processing, Inc., FTC Docket No. 9282 (Oct. 20, 1997), available at http://www.ftc.gov/os/1997/10/autoinfo.htm. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 17 AutoInfo, Inc. resulted in a monopoly that substantially reduced competition in five markets in the salvage-yard parts trading information network industry.110 108. A consent order in the case required the merged company to divest a portion of the business and grant the acquirer a license to the “Hollander Interchange” (the cross-indexed numbering system of interchangeable auto parts). 111 Precedent Under Section 5 Authority Microsoft Passport 109. In 2002, the FTC required Microsoft Corporation (“Microsoft”) to create an information security program after the FTC investigated its multisite online Passport, Passport Wallet.112 110. Microsoft settled with the FTC and entered into a consent agreement stipulating that the company agreed not to misrepresent what personal information it collected or the extent to which it kept personal information of consumers. 111. Microsoft also agreed to create and maintain a comprehensive information security program. 112. Microsoft agreed to obtain an assessment on a biannual basis that certifies the adequacy of its security program.113 ChoicePoint 113. In 2005, the FTC alleged that ChoicePoint did not have reasonable procedures to screen and verify prospective businesses for lawful purposes and as a result compromised the personal financial records of more than 163,000 in 114 Because of this breach, the FTC alleged that ChoicePoint violated the Fair Credit Reporting Act (“FCRA”) by furnishing the financial records to subscribers that did not have a permissible purpose to obtain 115 110 Fed. Trade Comm’n, Complaint, Automated Data Processing, Inc., FTC Docket No. 9282 (Nov. 13, 1996), available at http://www.ftc.gov/os/1996/11/d9282cmp.htm. 111 Fed. Trade Comm’n, Decision and Order, In Re Automatic Data Processing, Inc., FTC Docket No. 9282 (Oct. 20, 1997), available at http://www.ftc.gov/os/1997/10/autoinfo.htm. 112 See generally, Fed. Trade Comm’n, Agreement, In Re Microsoft Corporation, FTC Docket No. C-4069 (Aug. 8, 2002). 113 Id. 114 Fed. Trade Comm’n, Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief, US v. ChoicePoint Inc., FTC File No. 052-3069 (Jan. 30, 2006), available at http://www.ftc.gov/os/caselist/choicepoint/0523069complaint.pdf 115 Id. Autolnfo, Inc. resulted in a that trading information 10 the business license to the "Interchange" 111 Under Section 5 Authority Microsoft Passport Microsoft ("Microsoft") to create its authentication services including Passport, Kids Passport and Passport Wallet. 112 settled with the FTC and entered into a consent agreement what personal information kept personal of consumers. also agreed information agreed to obtain an assessment 13 did not have reasonable verify purposes and fnancial customers in its database. 114 Because of this breach, the FTC alleged tChhaot icePoint Fair Credit Reporting Act ("FCRA") them. 115 10 Fed. Trade Comm'n, Complaint, Automated Data Processing, Inc., FTC Docket No. 9282 (Nov. 13, 1996), available athttp://www.ftc.gov/os/1996/11/d9282cmp.htm. "' Fed. Trade Comm'n, Decision and Order, In Re Automatic Data Processing, Inc., FTC Docket No. 9282 (Oct. 20, 1997), available at http://www.ftc.gov/os/1997/10/autoinfo.htm. 2 See generally, Fed. Trade Comm'n, Agreement, In Re Microsof Corporation, FTC Docket No. C-4069 (Aug. 8, 2002). "3 Id 14 Fed. Trade Comm'n, Complaint for-Civil Penalties, Permanent Injunction, and Other Equitable Relief, US v. ChoicePoint Inc., FTC File No. 052-3069 (Jan. 30, 2006), available at http: //www.ftc.gov/o s/c aselist/choicepoint/05 23069complaint.pdf 5Id. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 18 114. The FTC additionally alleged that ChoicePoint engaged in unfair or deceptive practices in violation of Section 5 of the FTCA.116 115. The FTC settled with ChoicePoint, requiring the company to pay $10 in civil penalties and provide $5 millions for consumer redress.117 116. ChoicePoint was also required to verify, “(1) the business identity of the subscriber, and (2) that the subscriber is a legitimate business engaged in the business certified and has a permissible purpose for obtaining consumer reports.”118 117. The FTC also required ChoicePoint to establish, implement, and maintain “a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of the personal information it collects from or about consumers.”119 Uniqueness 118. The Google/DoubleClick merger presents the FTC with a unique problem because of the privity structure between the companies, the advertisers and the online users. 119. Google and DoubleClick’s direct customers are their advertisers, who pay them to place their ads. When an online user decides to click on an advertisement, both Google and DoubleClick collect information that potentially can be linked to the user so they can target advertisements more effectively and charge the advertisers more money. 120. Because Internet users are not in privity with Google of DoubleClick, the FTC must consider the privacy interests of Internet users in the course of the merger review to ensure fairness. 121. The combination of Google (the world’s largest Internet search engine with DoubleClick (the world’s largest Internet advertising technology firm) would allow the combined company to become the gatekeeper for Internet content.120 The combined company would hold such a huge amount of market share that other companies would need to ask for or buy from Google/DoubleClick the access rights to this vast amount of Internet data. 116 Id. 117 Fed. Trade Comm’n, Consent Order, US v. ChoicePoint Inc., FTC File No. 052-3069 (Feb. 10, 2006), available at http://www.ftc.gov/os/caselist/choicepoint/0523069stip.pdf 118 Id. 119 Id. 120 DoubleClick reaches an estimated 80 to 85 percent of Internet users. In March 2007 alone, approximately 3.5 billion search queries were run on Google Web sites. See EPIC, CDD, U.S. PIRG, Complaint to FTC, In the Matter of Google, Inc., and DoubleClick, Inc. (Apr. 20, 2007), ftc/google/epic_complaint.ChoicePoint engaed practices in violation of 5 of the FTCA." the million in civil penalties and provide $5 millions for consumer redress. 117 required to verify, "(identity business certified permissible for reports."t t R "security program that is reasonably confidentiality, information consumers."19 merger FTC of structure between the DoubleClick's direct customers on an DoubleClick more Internet users are not in privity with of users to ensure world's largest Internet search the world's largest technology frm) allow the combined company to become the gatekeeper for Internet cTohen tceonmt.b'2in0ed hold such a share would to ask for or buy from rights data. H6 Id 7 Fed. Trade Comm'n, Consent Order, US v. ChoicePoint Inc., FTC File No. 052-3069 (Feb. 10, 2006), available athttp://www.ftc.gov/os/caselist/choicepoint/0523069stip.pdf 8 Id 9 Id 20 DoubleClick reaches an estimated 80 to 85 percent of Internet users. In March 2007 alone, approximately 3.5 billion search queries were run on Google Web sites. See EPIC, CDD, U.S. PIRG, Complaint to FTC, In the Matter of Google, Inc., and DoubleClick, Inc. (Apr. 20, 2007), http://www.epic.org/privacy/fc/google/epic-complaint.pdf, Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 19 122. Because of the FTC’s dual antitrust and consumer protection role, it must take privacy concerns into consideration in looking at this merger. CONCLUSION 123. The massive quantity of user information collected by Google coupled with DoubleClick’s business model of consumer profiling could enable the two companies to construct extremely intimate portraits of its users’ behavior. Google’s wide variety of services provides ample opportunities for DoubleClick to target users with its DART advertising technology. 124. Both companies claim that private information is only stored to create a more personalized and efficient service. Google’s primary client is its consumer account user; however, DoubleClick’s primary clients are advertisers. 125. Both companies conduct extensive analyses of aggregate information to create more efficient services and claim that they do not mine their data for sensitive personalized information. 126. As shown in the past, DoubleClick has disregarded its privacy policies in pursuit of a more robust bottom line. The potential for great profit associated with the large amount of data that would be readily accessible as the result of a merger may prove to be too tempting, and there is nothing preventing Google from reversing its stance and beginning to sell or otherwise distribute personally identifiable information. 127. The merger of Google/DoubleClick would virtually ensure that the combined company would monopolize the monetization of access to Internet content. 128. The detailed profiling of Internet users raises profound issues that concern the right of privacy, the accountability of large corporations, and the operation of democratic governments. 129. The failure of the Federal Trade Commission to act in this matter will have long-term consequences on the future of the Internet. ADDITIONAL REQUESTS FOR RELIEF 130. The parties restate the request for relief set out in the April 20, 2007 complaint and further request that the FTC take the following steps as a condition of merger approval. 131. Order Google to provide meaningful notification when personal data from two distinct Google services are combined to produce a result that is linked an identifiable user. of FTC's at quantity information DoubleClick's business could enable to extremely users' Google's opportunities for DoubleClick with is only stored to create and effcient Google's however, DoubleClick's clients are advertisers. of information more efficient claim information. its privacy proft associated accessible is nothing preventing and beginning identifable of ensure of access profling of Internet users raises profound issues of large corporations, Commission to act in this matter will REQUESTS the request for relief set out in the April steps notifcation when personal Google services identifable user. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 20 132. Order Google to give a user the right to obtain knowledge, in a reasonable and timely manner, of whether or not the data relating to the user is processed and if it is processed, information to the purpose of the processing. 133. Order Google to provide, in a reasonable and timely manner, the logic involved in any automatic processing of data concerning that user.121 134. Order Google not to retain user data in a form that permits the identification of data subjects for longer than necessary for the purposes for which the data were collected.122 135. Order Google to institute an “opt-in” approach to collecting user information. If Google allows a user to “opt-in” before collecting personal data in order to personalize the search experience, Google should implement the same system with regards to a user’s privacy options.123 136. Order Google to allow individuals reasonable access to their personal information, along with the ability to edit and delete that information. 137. Order Google to stipulate to never engage in behavioral tracking. 138. Further order Google not to sell personally identifiable information. 139. Order Google to implement a functional and secure system of anonymizing stored user data. Anonymized data remains traceable to the individual user, as demonstrated when America Online inadvertently leaked the search records of 658,000 Americans.124 Google must implement a technique that truly anonymizes this data, either by erasing more the last octet of the IP address, erasing the IP address completely, assigning randomized numbers to the data, or developing an alternative technique that will render tracing the data back to the individual source impossible. 140. Order Google to cease storage of IP addresses. The search engine functionality would not be impaired if a search engine did not store any user information at all. 141. Condition the merger on Google and DoubleClick maintaining separate databases of user information. 121 See Council Directive 95/46/EC, art. 12, Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data 1995 O.J. (L 281) 31 [“Data Protection Directive”]. 122 See Council Directive 2002/58/EC, art. 5(3), Directive on Privacy and Electronic Communications, 2002 O.J. (L 201) 37 (EC); Article 6(1)(e) of the Data Protection Directive, supra note 121. 123 See Peter Fleischer, Google’s search policy puts the user in charge, FT.com, May 25, 2007. 124 Using the leaked anonymized information, reporters managed to match search terms with individuals. Michael Barbaro and Tom Zeller, A Face Is Exposed For AOL Searcher No. 4417749, N.Y. TIMES, Aug. 9, 2006. in a reasonable whether or not the data relating to the user is processed is processed, to the purpose of the processing. a timely in any automatic processing of data concerning that user.121 not to retain user of data subjects longer than necessary for the data were collected.122 "in" approach Google allows a "in" before collecting personal the same system with regards to a user's privacy options.123 individuals reasonable access the to edit and delete identifiable and of data user, when America search records of 658,000 Americans.124 Google must implement a ttreuclyh anniqouneym thizaets this data, either by erasing more the last octet of the IP address, completely, render the data source to cease IP addresses. would not be impaired if a search engine did not store maintaining separate of user information. 21 See Council Directive 95/46/EC, art. 12, Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data 1995 O.J. (L 281) 31 ["Data Protection Directive"]. 122 See Council Directive 2002/58/EC, art. 5(3), Directive on Privacy and Electronic Communications, 2002 O.J. (L 201) 37 (EC); Article 6(1)(e) of the Data Protection Directive, supra note 121. 13 Peter Fleischer, Google's search policy the user in 124 reporters terms with A Face Searcher TIMES, Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119Supplemental Materials in In the Matter of Google, Inc., Support of Pending Complaint and DoubleClick, Inc. 21 142. Order Google to craft, disclose, and implement a security plan that will maintain, protect, or enhance the privacy, confidentiality, or security of all personally identifiable information. 143. Order Google to implement remedies and a system of accountability in the event of a breach, and to disclose to the public the extent to which it cannot or will not protect the privacy, confidentiality, and security of all personally identifiable information. 144. Pending an adequate resolution of the issues set out in this Complaint, in the April 20, 2007 Complaint, and other matters that may be brought to the Commission’s attention, the Commission should use its authority to review mergers to halt Google’s proposed acquisition of DoubleClick. Respectfully submitted, 125 Marc Rotenberg Melissa Ngo EPIC Executive Director EPIC Senior Counsel ELECTRONIC PRIVACY INFORMATION CENTER 1718 Connecticut Ave., NW Suite 200 Washington, DC 20009 202-483-1140 (tel) 202-483-1248 (fax) June 6, 2007 125 IPIOP Law Clerks Tanith Balaban, Evan Mayor, Mark Pike, Jennifer Shyu and Evan Stern assisted in the preparation of this complaint. implement security plan that will the privacy, confidentiality, of to disclose to the public extent to which not protect and resolution of set out in this Complaint, 20, 2007 Complaint, and other matters Commission's its authority Google's acquisition Respectfully submitted, tzs 25 IPIOP Law Clerks Tanith Balaban, Evan Mayor, Mark Pike, Jennifer Shyu and Evan Stern assisted in the preparation of this complaint. Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=cde46158-e17c-43bd-873b-d48369ea3119