Correction to This Article
A June 23 Business article about AT&T's new privacy policy incorrectly said that the policy applies to customer phone records. The new policy applies only to AT&T's broadband Internet and video customers. The article also implied that AT&T would track and monitor all Internet customers' online habits. AT&T is monitoring customers' online habits only for its AT&T Yahoo-branded Web pages.

Concerns Raised Over AT&T Privacy Policy

By Sara Kehaulani Goo
Washington Post Staff Writer
Friday, June 23, 2006

Consumer advocates said yesterday that a new privacy policy from AT&T Inc. marks the first time a major telecom company has asserted that customer calling and Internet records are corporate property and raises concerns about how the company tracks consumer behavior and shares data with government and law enforcement agencies.

The new privacy policy is scheduled for release today on the company's Web site. AT&T said it does not share the data with third-party marketing firms, but it cites circumstances under which it shares customer information with the government and law enforcement. For its broadband Internet customers, the company also makes clear that it will collect information about which Web pages its customers view, how much time is spent on each page and what links are clicked on.

"While your account information may be personal to you, these records constitute business records that are owned by AT&T," the new policy states. "As such, AT&T may disclose such records to protect its legitimate business interests, safeguard others, or respond to legal process."

The policy comes as AT&T and other telephone companies are under scrutiny for their reported cooperation with the government in spying on consumers. Yesterday, in a hearing before a Senate Judiciary subcommittee, lawmakers pressed AT&T chairman and chief executive Edward E. Whitacre Jr. about his firm's involvement in sharing records with federal agencies seeking to track down terrorists. Whitacre repeatedly stonewalled during the heated meeting, citing "classified" information and saying his company followed the law, according to Bloomberg News.

News reports allege that AT&T and other telecom companies handed over millions of customer calling records to the National Security Agency to help track down terrorists. The Electronic Frontier Foundation, a nonprofit group that advocates electronic privacy, has sued the firm in federal court in San Francisco over its alleged involvement with the NSA and over federal privacy laws.

"They are redefining the customer information as their property," said Charles H. Kennedy, a privacy and data protection lawyer at Morrison & Foerster LLP in the District. "If the company is going to say, 'Well, it's not your record; it's our record. You don't own it; we own it,' this may later be used to say it's not protected by the Privacy Act."

AT&T said its new privacy policy does not reflect any changes and instead offers more specific information in "plain language" about customer data. A spokesman said the update has been in the works since December, after SBC Communications Inc. merged with AT&T Corp., and is not related to the NSA lawsuit.

"Nothing has changed in terms of how we protect, collect and use customer information," said AT&T spokesman Michael Coe. "Our customers' privacy is very important to us, and we vigorously protect their privacy. We think our privacy policy is more vigorous than many out there."

Some privacy law experts disagreed, however, and said they worry that the language used by AT&T could set a precedent for other companies and industries. Pam Dixon, executive director of the World Privacy Forum, a nonprofit organization based in San Diego, said online habits should be considered property of the consumer and not commoditized by the Internet service provider. "What if this kind of thinking spreads to other companies and other sectors?" Dixon said. "When a company this large does something, it can have a profound impact on others."

In its new policy, AT&T says it collects information about its customers so that it can be aggregated and used for marketing purposes. Such data would not include personal information such as names, addresses and telephone numbers but would include behavioral information about consumers' online habits. In a new video service that AT&T plans to roll out to at least 20 metro areas this year, the company will track information about what consumers view, record and navigate for in-house marketing purposes.

AT&T's Coe said this is no different than what firms such as Inc. or TiVo Inc. do to monitor their customers' preferences and tastes so that they can suggest other products consumers might want.

Melissa Ngo, staff counsel at the Electronic Privacy Information Center, said she was glad to see AT&T making public its new policy. The changes "allow customers to make informed decisions about whether they want to pay to be tracked," Ngo said.

© 2006 The Washington Post Company