The debacle regarding copy-protection software tucked away on certain Sony BMG audio CDs has taken one more step into the history books. Sony BMG has agreed to a settlement with the FTC, and, in doing so, acknowledges that it violated federal law by not telling consumers its music CDs contained digital rights management software and tracked user listening to send them marketing messages.
The software also exposed consumers to security risks, as attackers became aware of how the copy protection technologies distributed by Sony operated and began crafting malware which could be cloaked by the Sony-installed software.
The proposed settlement requires Sony BMG to clearly disclose any limitations on consumers’ use of music CDs; it also bars the company from collecting information for marketing purposes, installing software without user consent, and mandates Sony BMG must provide a reasonable means of uninstalling that software. Perhaps more significantly, the settlement also requires Sony to reimburse consumers for up to $150 in damages from trying to remove Sony’s software; consumers may also exchange DRM-laden CDs for unencumbered discs through June 31, 2007.
“Installations of secret software that create security risks are intrusive and unlawful,” said FTC Chairman Deborah Platt Majoras. “Consumers’ computers belong to them, and companies must adequately disclose unexpected limitations on the customary use of their products so consumers can make informed decisions regarding whether to purchase and install that content.”
The settlement comes a month after Sony agreed to pay $4.25 million to settle class action lawsuits over the same issues. The brouhaha over the XCP and MediaMax software Sony separately distributed on selected music titles erupted in late 2005, when the XCP software was (correctly) identified as a rootkit which hides files and running processes from Windows users. After downplaying the seriousness of the problem for weeks, Sony eventually recalled the DRM-laden CDs in November 2005 only as consumer and privacy advocacy groups and individual states initiated lawsuits.
