Edit: Since posting this, Clever Zebra CEO 57 Miles sent me a clarification that neither Clever Zebra nor, he believed, Mechanized Life were aware that the data was being posted openly. He expected the matter to be resolved within 24-48 hours. As I said when I originally posted this, I wasn’t picking on Clever Zebra - their feed just happened to be the one I picked up. While I still have a problem with visitor data being collected without a public notice, I’m confident that the publishing of this data in a ‘publicly available’ format was never the intention of the two organizations. Many thanks to 57 Miles for providing assurances.
Clever Zebra is publishing visitor data to the Web, in possible violation of the Second Life TOS.
Clever Zebra is the open source, um, source for businesses and institutions wanting to get a leg up in Second Life with professional builds, gadgets and items at little or no cost. The idea is fairly simple - give people access to a great toolkit of items so they can establish their Second Life presence, and maybe they’ll come to rely on the Clever Zebra ecosystem for help with a custom build, scripting project, or event.
But Clever Zebra has more than it’s eye on future potential, it has its eye on you and is sharing that in a way that anyone can see.
Visitors to the Clever Zebra sims are unknowingly being tracked by Mechanized Life - at least, I didn’t see anything alerting of the fact. And the list of users are being distributed through an RSS feed on the Web, including avatar pictures and details.
I may be picking on Clever Zebra a bit here - the reality is, a lot of sim owners track visitors without their knowledge, and many of them use Mechanized Life sensor systems.
In my jurisdiction, this would be illegal in the ‘real world’ because individuals have a right to know when information is being collected on them, what it’s being used for, and need to ‘opt-in’ on its collection and use. As I understand it, ’swiping’ avatar profile pictures is also against the Second Life Terms of Service but I might be mistaken.
What’s a bit stunning about Clever Zebra is that the information is being distributed in public channels. Here are two of the profiles I picked up in my RSS feed (names blurred by myself):
Which links to this Web page:
The feed picks up and publishes (in case you can’t see it) the avatar name, “age”, payment status, photo, and date and time of visit.
Again, I don’t mean to pick on Clever Zebra if it weren’t for their ‘open source’ approach. The intention might be that this information exist behind a firewall of some sort, but it’s streaming into my reader, and while I’m not sure, I believe that it contravenes the spirit and letter of the TOS and the laws of various jurisdictions.
Hmmm … it might not be illegal in most jurisdictions (avatars usually do no enjoy the same rights and privacy protection, that the humans behind them do enjoy), the collection of such data isn’t exactly good business practice especially, if you do not announce it to your visitors.
Additionally, for most purposes easily imaginable to me, it is not necessary to collect this kind of data. It might be desirable to recognize the fact, that the same avatar visits your location again and again. Gathering data about the age distribution or verified status of visitors is certainly interesting information, too. But all of this information can be provided by using anonymous profiles, too, without invading resident’s privacy.
Markus - I’m not so sure on that interpretation of the law. While it’s still early days I think there’s sufficient legal grounds to consider data related to an avatar equivalent to data related to a person. Just as collecting e-mail addresses which may not confer a connection to personally identifiable information is, on its own, personally identifiable, so too it could be argued that avatars are personally identifiable proxies for identity, regardless of the anonymity conferred by the platform. But sure…early days.
Now, in all fairness to Clever Zebra, they are running an open source business ‘aggregation’ service. Their model is that they give items for free - and they’re pretty significant items (and while very corporate looking and so on, their auditoriums and galleria are really well executed). By giving them for free, they’re hoping to be able to offer services. Free includes events, seminars, and educational activities.
So, I see it as a fair trade-off: if you’d like items at no charge, or if you’d like to attend no cost exhibitions, in return you allow them to collect information on your presence and they earn the right to contact you to discuss collateral services. What’s missing from the equation, however, is the ability to opt-in or be notified.
And instead of picking on Clever Zebra, I should note that the service they were using was Mechanized Life, which does not track exclusively for Clever Zebra. I have no idea what their install base is but I’m fairly sure that CZ isn’t the only sim on the grid capturing this kind of information.
So the question is, should avatar monitoring devices be allowed? Should there be an opt-in or notification policy? Does any of this break the TOS? Do avatars have less rights to privacy and surveillance? Or, as has been argued elsewhere on this blog, is surveillance just the “way it is” and we should learn to live with it?
Sorry, Dusan, I did not want to imply, that there are clear laws denying “avatars” any privacy. It is just shaky ground and there have not been any final court decisions or explicit laws covering this issue.
And I certainly did not want to attack Clever Zebra.
All I wanted to say is basically:
(1) I consider it good business practice to inform visitors, when I collect “personal” data about them that allows me to track them down individually.
(2) There are better ways to collect usage data for an installation which works anonymously. Some of the more innovative advertising networks on the web work that way. It is not rocket science. No one needs to store my name or IP address to identify “uniques” for his website (or island in SL) example - not even my avatars name.
Absolutely Markus - and sorry if I sounded defensive.
I really did take your comments in the spirit they were intended - and it’s a provocative question about avatar “rights”.
I’d be curious if Mechanized Life has any thoughts on this. I should check to see if they have a posted privacy policy.
*Adds to list of things to do.*