Summary

  • Passport offered one username and password for participating websites. The FTC's 2002 complaint said Microsoft retained a personally identifiable record of the sites a user signed into, with dates and times, for a limited period; customer-service staff could connect it to a name.
  • The complaint said Passport's privacy statement described other collection but omitted that sign-in record. Microsoft settled; the final FTC order required accurate descriptions of information practices, a written security program and independent assessments.

The convenience made a second product

Microsoft launched Passport in October 1999 as a common sign-in for participating sites. One credential could save a user the small misery of registering repeatedly. It also placed the sign-in service at a junction that could observe each successful entrance. The FTC's December 2002 complaint says Microsoft kept a personally identifiable record of the sites a Passport user signed into, together with the dates and times. The record lasted for a limited period. Customer-service representatives could link it to the user's name when answering a service request.

That log mattered because the privacy statement was already detailed. According to the complaint, it described information collected at registration, identifiers assigned to accounts, operational data and temporary sign-in cookies. The FTC said the statement left out the separate site-by-site sign-in history. An ordinary reader could learn that a cookie existed and still miss the more consequential fact that the operator could assemble a named itinerary of participating websites. The retained history concerned sign-ins at participating websites.

The complaint also challenged Passport's security representations, a Wallet claim that purchases were safer, and the degree of parental control in Kids Passport. The sign-in-history count asks what the service stored in order to run and support a single login, and whether its public explanation matched that operation. A trust badge or a long privacy statement cannot answer a question the statement omits.

A settlement turned the promise into work

Microsoft announced an agreement with the FTC in August 2002. Its own statement called for formalized, documented and independently audited security procedures. The final FTC order, issued in December, prohibited misrepresenting what personal information covered services collected, used or disclosed. It required a written information-security program with named responsibility, risk assessment, safeguards, testing and adjustment, plus independent assessment. The order covered Passport, Passport Wallet, Kids Passport and similar multisite authentication services.

The complaint states the FTC's allegations; the settlement records Microsoft's agreement to the order without admitting the complaint's contested facts. The order imposed documentary and testing work on the organization running the sign-in hub. The provider that could see the entrances had to describe its information practices accurately and maintain a security program others could assess.

Sources