Lawsuit: Disney, others spy on kids with zombie cookies
By Jacqui Cheng | Last updated August 16, 2010 1:00 PM

Disney, Ustream, SodaHead, Warner Bros., and a number of other websites are spying on kids' Internet use, according to a lawsuit filed recently by a group of parents and their children. The suit accuses ad widget company Clearspring Technologies of enabling these sites to track kids all over the Internet, and not just on Clearspring partner sites, leaving them in violation of numerous federal and California state privacy laws.

According to the complaint, each of the Clearspring affiliates independently and knowingly authorized the company to track users, even on non-Clearspring affiliated sites. A Flash-based tracking cookie was allegedly installed by the affiliate sites without users' knowledge, and would recreate itself by digging into the Flash storage bin for the same user information if deleted. Essentially, users who were trying to remain privacy-conscious by regularly deleting their cookies were not able to rid themselves of the cookies deposited by Clearspring.

From there, the defendants allegedly collected personally identifying information about their users in order to sell the data, which includes video viewing habits, gender, age, race, education level, geographic location, sexual preference, what the users like to read, home address, phone number, health condition, and more, says the lawsuit. The parents behind the lawsuit cited a recent study out of UC California-Berkeley about Flash Cookies and Privacy, which found that certain Flash cookies would respawn when deleted—without any notice to or consent from the user.

The complaint is very similar to one filed against Clearspring competitor Quantcast in July, whose Flash cookies are used by MTV, ESPN, Hulu, MySpace, NBC, ABC, and Scribd. That suit also cited the UC Berkeley study, accusing Quantcast of following a "pattern of covert online surveillance." Quantcast stopped its zombie cookie behavior after Berkeley's study was published in August of 2009, but the users represented in the lawsuit still felt that their privacy had been violated thanks to the collection and distribution of their personal information.

In the Clearspring case, the defendants claim that they don't share the collected data with third parties—though they do share it with their corporate affiliates. Still, those behind the lawsuit say they never gave authorization to the Clearspring partners that would allow them to collect the data in the first place, and are seeking class action status as a result.

Not only do they accuse Clearspring and its affiliates of violating the Computer Fraud and Abuse Act, the plaintiffs also say the sites are in violation of California's Computer Crime Law, Invasion of Privacy Act, Consumer Legal Remedies Act, and the state's Unfair Competition Law. Given Quantcast's response to the accusations, we wouldn't be surprised to see Clearspring issue a "fix" to this behavior, especially if put under pressure by some of its big-name partners like Disney. Still, the damage has already been done and the parents behind the suit are unlikely to let up until they get a satisfactory ruling or settlement.