Complain about a product or service

Sony BMG Settles FTC "Rootkit" Charges

Consumers May Get up to $150 for Damage to Their Computers

January 31, 2007

Sony • Sony: Dust Voids PlayStation 3 Warranty • Sony BMG Settles FTC "Rootkit" Charges • Sony BMG Settles Root-Kit Suits for $4.25 Million •: Sony BMG Settles California Case • PlayStation 3 Takes the Field • PlayStation 3 Brings Big Bucks on eBay • Court Approves Sony BMG CD Settlement • Sony Reaches Tentative Settlement in Spyware Cases • New Charges Against Sony's Use of Stealth Software • New York Joins Sony CD Investigation • Recalled Sony CDs Still On Sale • Consumer Group Sues Sony BMG • Texas Sues Sony for Violating Spyware Law • Sony Withdraws CDs With Copy-Protection Software • Sony Slammed for Hidden CD Software • Sony Loses Playstation Suit • Digital Camera Buyers Give Kodak, Sony High Marks • Sony Agrees to Stop Payola Payments to Radio Stations • Sony Playstation 2 Defective, Class Action Charges --- Complaints • Playstation 2 • Playstation 1 • Cameras, Camcorders • Computers • Computer Monitors • Computer Rebates • Home Electronics Rebates • TVs • WebTV

Consumers who played Sony BMG music CDs on their computers and found the disks automatically downloaded software will get checks for up to $150, under a settlement the music giant agreed to with the Federal Trade Commission.

The FTC found that the secretly installed software -- called a "root kit" -- posed security risks, limited CD use, and monitored users' listening habits.

According to the FTC, the software also exposed consumers to significant security risks and was unreasonably difficult to uninstall.

The agreement is similar to earlier class action settlements and settlements with state attorneys general.

The proposed settlement requires Sony BMG to clearly disclose limitations on consumers' use of music CDs, bars it from using collected information for marketing, prohibits it from installing software without consumer consent, and requires it to provide a reasonable means of uninstalling that software.

The settlement also requires that Sony BMG allow consumers to exchange the CDs through June 31, 2007, and reimburse consumers for up to $150 to repair damage to their computers that they may have suffered in trying to remove the software.

"Installations of secret software that create security risks are intrusive and unlawful," said FTC Chairman Deborah Platt Majoras. "Consumers' computers belong to them, and companies must adequately disclose unexpected limitations on the customary use of their products so consumers can make informed decisions regarding whether to purchase and install that content."

According to the complaint detailing the charges, Sony BMG embedded in its music CDs content protection software, also known as Digital Rights Management software, which installed itself on consumers' computers to restrict the number of times the audio files could be copied.

It also prevented the music from being played on certain portable digital devices. The music could not be transferred directly to iPods, for example.

In addition to restricting the use of the CDs on computers using the Windows Operating System, the software, which was concealed from consumers, created security vulnerabilities that could allow hackers and other third parties to gain access to consumers' computers.

The FTC alleges that the installation of software without consumer consent that exposed consumers' computers to security risks was unfair and violated federal law. In addition, the complaint alleges that hiding the software from consumers and failing to provide a means to uninstall it also were unfair practices in violation of federal law.

The agency charged that it was deceptive for Sony BMG to fail to disclose adequately that software would be installed on consumers' computers, and that the software would limit consumers' copying and use of the CDs on their computers.

The FTC also alleged that it was deceptive, in violation of federal law, to fail to disclose that Sony BMG's monitoring technology, included on many of its CDs, monitored consumers' music listening preferences and sent targeted marketing ads to their computers.

Clear Disclosure Required

The settlement requires clear and prominent disclosure on the packaging of Sony BMG's future CDs of any limits on copying or restrictions on the use of playback devices. It bars the company from installing content protection software without obtaining consumers' authorization, and, if Sony BMG conditions consumers' use of its CDs on installation of the content protection software, it must disclose that requirement on the product packaging.

In addition, the settlement bars Sony BMG from using the information on consumers' listening preferences that it has already gathered through the monitoring technology it installed and bars them from using the information to deliver ads to those consumers.

For future CDs containing such technology, the agreement requires that, before transmitting information about consumers, their computers or their use of the CD, Sony BMG must clearly disclose on consumers' computer screens what the technology will do, and obtain consumers' consent. If it conditions consumers' use of its CDs on their agreement to have information collected, Sony BMG must disclose that condition clearly on the CDs' packaging.

The settlement bars Sony BMG from installing or hiding content protection software that prevents consumers from finding or removing the software, and requires that it provide a reasonable and effective way to uninstall any content protection software. It requires that for two years, Sony BMG provide an uninstall tool and patches to repair the security vulnerabilities created on consumers' computers by previously installed software. The company is required to advertise these free fixes on its Web site.

As part of the settlement, Sony BMG will allow consumers to exchange CDs containing the concealed software purchased before December 31, 2006 for new CDs that are not content-protected, and will be required to reimburse consumers up to $150 to repair damage that resulted directly from consumers' attempts to remove the software installed without their consent. Sony BMG is required to publish notices on its Web site describing the exchange and repair reimbursement programs.

Sony BMG also is required to provide financial inducements to retailers to return the CDs that create security problems for consumers' computers. For CDs already in its stock that are sold to retailers, Sony BMG is required to disclose on the product packaging the restrictions on use and the security vulnerabilities.

Finally, the settlement contains record-keeping and reporting provisions designed to allow the agency to monitor compliance with its order.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |