The past few weeks, I've been following the controversy around Rapleaf, a company that got some attention in early 2006 as an expanded, more powerful version of Ebay's feedback system, which would allow people to build and look up the "reputations" of other by entering an email address. Profiles on Rapleaf can include everything from your age to your political affiliations to what books you want to buy, as well as testimonials from people who have done business with you (though it's unclear how Rapleaf verifies that these testimonials are legitimate). In short, Rapleaf billed itself as a way to find out what you were getting into before entering a business transaction.
That proposition quickly became rather ironic once controversy surrounding the company started picking up speed in late August 2007, when some bloggers received email notifications from Rapleaf informing them that they had been searched.
While some of the backlash was directed at the "spam" factor of receiving annoying email invitations to Rapleaf, the most vocal outrage was over the potential invasion of privacy.
Rapleaf was already linked to another social network search site, Upscoop, where entering your own email address and password allows you to look up the social network affiliations of everyone in your address book en masse. What it failed to make transparent at the time, however, was its relation to a third company, Trustfuse, which sells public, but often difficult-to-find, personal data to marketing companies using Rapleaf and Upscoop technologies.
People were immediately up-in-arms about the selling of their personal data to marketers. Rapleaf's privacy policy assures users that they do not sell Personally Identifiable Information, such as email addresses; however, if the marketers bring email addresses to Rapleaf, any publicly posted data those addresses might allow access is up for grabs. Rapleaf was quick to issue an apology and explanation, in which they explained their connections with Trustfuse and rewrote parts of their privacy policy to make the relationships between the three companies more explicit.
They were also very quick to remind people that all the information they had gathered had been publicly posted, and that all they was doing was "automating the search process." There are, however, a couple of kinks in this defense, the first being that, though the information they find is more of less "public," the information used to find it -- namely, personal email addresses -- is not. What's more, Rapleaf may use the internal searches on some social networking sites in order to locate profiles, despite the fact that sites like MySpace prohibit use "in connection with any commercial endeavors" unless explicitly approved by MySpace in their terms of service.
In the grand scheme of things, what Rapleaf seeks to do sits fairly low on the scale of threats to digital privacy. But putting aside the ambiguity of how "public" social networking data really is, Rapleaf's practices in fact raise another question: who can claim ownership rights to that data? With the rise of social networking and blogging, many of us have developed a new sense of public privacy, information that is posted in order to form a digital persona that allows us to participate in online communities.
That information is necessarily public, intended for people who are unable to drop by and get to know us over coffee, but it is nevertheless personal. What is posted on these sites is not just a roll-call of favorite bands and movies and witty quotations, but detailed identities within personally selected Internet communities and networks.
To then take that information and sell it is to say that not only are we for sale, but that we don't have any financial stake in our own transformation into commodity.
In short, Rapleaf's selling of this information for profit offends what may not necessarily be a sense of privacy, but a sense of ownership.
So it begs the question -- can our increasingly elaborate online identities be considered intellectual property? And, if so, who holds the licensing and distribution rights?
As a final note, in the spirit of thorough research, I entered one of my own email addresses into Rapleaf. An hour later, I discovered my age, my occupations ("international badass, film production slave, academic superstar" -- so probably not what marketers are looking for), my location (three years out of date), and at least two social networks that I haven't been active on in years.
Despite how irrelevant this information seemed, I still got a chill from seeing it, because a single click on any of that information leads you to my friends, my personal blog, and several games of Scrabble that I'm losing at pretty badly. I could have sent an opt-out email email to Rapleaf, but seeing that information posted made me realize that anyone could call it up whenever they wanted, and, next time, I wouldn't know about it for up to a week (Rapleaf sends out notifications of searches on the following Monday), so I ended up registering just so I could continue deluding myself about the privacy of those embarrassing vacation photos. Which is probably exactly what they wanted.
For further reading on this topic, CNET has a nice,fairly comprehensive article on the controversy, as well as a follow up of the privacy policy revision. Marshall Kirkpatrick makes some suggestions on how to improve Rapleaf. And "Search is the Internat OS!" provides a handy list of other Web 2.0 people search engines.
Xiaochang, I think the question you raise about our IP rights over our profile information is an interesting one. The practice of selling consumer information is far from new, as you know, and is engaged in by many different companies and third parties, however what I think has changed is our ability to add to this information ourselves and the speed at which this information can be transmitted (notwithstanding the outdatedness of your information!). Therefore, I think it ultimately raises questions about the implicit and explicit contracts entered into by sites and users, their respective rights and responsibilities under those contracts, and if there will be a push to protect not only our own "profile IP", but IP in general online.
Looking at MySpace's privacy policy, they state that "[N]on-personally-identifiable information may be shared with third-parties to provide more relevant services and advertisements to members", but this seems to be in the context of improving the MySpace website and its services, not third party services. I'm not a lawyer, so I'm not sure if this type of thing is actually covered in the privacy policy. I'd be curious to know if MySpace has had any response to the site or the debate.
Xiaochang -
Thanks for the writeup and thoughts on Rapleaf.
We'd love to talk to you more about what we're doing with online identities and how we plan to create a portable identity and reputation system that people can build upon. Feel free to get in touch with us.
Also - you've pointed out a great use of Rapleaf. Rapleaf can help you discover the info out there about you, and help you better control it and monitor your online reputation wherever you have a 'web footprint'.
Feel free to get in touch with us anytime.
Cheers,
Dan
Rapleaf
This process has continually made me think about the now commonplace request for your phone number at checkout lines. Sometimes, these were generally prefaced by "so that we can alert you to deals," etc., but it seems like that has all been dropped by this point, so that it's considered commonplace to be asked for your phone number at the end of a transaction. (Sort of like how many stores used to offer you a 10% discount if you sign up for a charge card, and many of them now shorthand it to the point of "Would you like to save 10 percent today?" Well, who wouldn't?)
The problem, of course, is that often the people gathering this information don't even have a clear idea of why they were asking it, so that it is unclear what is being done with this data. At times, my distrust has caused me to miss out on deals--my wife and I were somewhere the other day and were asked for our number, and gave out a fake one, only to realize that the shop was going to invite us back in for free stuff the next week and that they would "give us a call." We didn't want to admit we had lied and thus didn't say anything.
But what do all these problems of user agreements that are written in a language so that no one will read them and being bombarded with requests for personal information at the moment of transaction mean in relation to our other recent discussions about an experience economy? I think the problem is the relationship that many of these activtiies set up with the consumer...
Sorry it's taken me so long to get back to these comments!
Eleanor: I think your point about explicit and implicit contracts is what's at the heart of this issue. As far as I know, myspace has not commented on this issue (I believe one of the cnet articles mentions this). But whether or not is violates the explicit legal terms of use, what feels violated is a more implicit contract in terms of the nature of social networks and online communities. I think that the rise of people search services like Rapleaf are clear signs that perhaps the landscape of social networks and online communities is changing, and that the expectations we had when we signed on are no longer reasonable now that these communities are now of monetary value. In which case, I guess the question becomes a matter of what these networks are now that their uses are no longer within the control of the users?
Dan: I would love to be kept in the loop about what you guys over at Rapleaf are doing, and I've sent a request to the email listed in your apology post for bloggers to get previews of Rapleaf developments. That said, I suspect that your comment has (purposely) missed the point of my post, but I'll clarify just for the fun of it. What I found unsettling about the results of my own Rapleaf search was not the information that was found. Most of it was on obscure social networks and the information itself was largely harmless, if vaguely embarrassing on occasion. What was unsettling was seeing it all in one place, within the span of an hour, with minimum effort on my part. Perhaps we can look at it like this: I may have windows at my apartment, my office, and various classrooms that I'm in throughout the course of a week, and the location of those places and my link to them is public in various places, but that doesn't mean I wouldn't be creeped out if someone came and presented me with an envelope of pictures of me in each of those locations. Thus, what I felt that I was monitoring in registering for Rapleaf was not the information about me that was out there -- I could have deleted my profiles instead -- but rather their easy accessibility through your site. In other words, if your site didn't exist, I wouldn't have anything that requires monitoring.
Sam: You comment made me think about what I found discomforting about the experience economy, which is the notion, described in a rather celebratory manner, that we can and should saturate all experience with modes of consumption. What began as a network or a community is being transformed into a market (or perhaps, finally seeing its potential as a market capitalized upon). I think the offense being taken is that, as I was saying to Eleanor, the use-value of the technology is no longer in the hands of those who use it. Maybe we're just losing the last vestiges of that old techno-utopianism to undeniable evidence of the persistence of high capitalist logic.
Xiaochang, I think part of the problem as well is in HOW people feel that these spaces are becoming commercialized. There's a difference between using discussions on social networking for marketing research in a "cool hunter" sense (i.e. seeing what people are commenting about and discussing in public, how fans are reacting to media properties and brands, etc.), and these types of behaviors, which are more about capturing and packaging information about users, removing them from their original context, etc.
As your post points out, such an unnuanced capitalistic way of approaching that information threatens to strip it of its usefulness in the process.
Sam, I think you're absolutely right. There is such a difference between say, some ad exec realizing that MySpace is a significant social and cultural force and logging on to see what's going on and how he might implement that into his marketing work. It's another thing altogether for a company to automate this process and mass aggregate this information in such a way that removes individuals and communities from the social and cultural contexts and protocols in which they function, effectively reducing them to near meaningless jumbles of data.
I think it not only speaks the very deep-seated cultural fears of automation and its tendency to reduce human beings into data (I'm thinking of the computerized drafting protests in the 60s), but in a larger way, it seems fairly useless. If all that was required to understanding how social networks work and how media and consumption work across them was to gather the appropriate data, we wouldn't even be dealing with these types of questions. It seems strange to me that in trying to find the value of social networks in this manner, you run the risk of overlooking the social and networking aspects.
Exactly, Xiaochang. It makes me think of recommendations I've made to people in big media companies in the past. I've long said that paying more attention to what is going on in online fan communities rather than listing all the reasons not to makes good business sense as a corrective to the pitfalls of focus groups and survey research (not to replace them, but to use them in correlation with the other two). However, what that doesn't mean is for an outsider to go in like an anthropologist and study the village. As John Edward Campbell says, this process is about the "native gone academic" rather than the "academic going native," or marketer in this case.
The best way to keep track of what is going on in the fan community is to have someone monitoring that community that is part of it. There is a social and cultural context that is completely misrepresented and misunderstood if these elements are removed from where they came from, just as a fan fiction story is severely misrepresented if pulled out of the community it was produced within.