Concerns about its data collection practices threaten Digital:Convergence's plans to roll out 50 million of the bar-code scanners by 2002.

The Privacy Foundation plans to deliver the latest blow to Internet data collector Digital:Convergence Corp. on Friday when the organization releases a report criticizing the company's collection of potentially identifying information over the Internet.

The company -- whose free CueCat bar-code scanners were shipped to half a million consumers last week -- hopes to snag customer data by linking product bar codes to Internet pages.

Already, several Internet groups concerned with privacy have taken issue with the company's strategy. The Privacy Foundation will join them in voicing the dangers of online collection of data, especially when the company doing the collecting has not clearly explained how much information it intends to gather.

"What we are saying is that we want to get out on the table what they are doing," said Richard Smith, chief technology officer with the Denver-based Privacy Foundation, who called Digital:Convergence's lack of information about its data collection "misleading." "Our concern is individual-level tracking," he added.

Privacy worries, public debate
Worrying about Digital:Convergence's plans -- and those of its subsidiary Digital:Demographics -- has become a major pastime in recent weeks among privacy-conscious consumers and advocates.

Both the Privacy Forum and Internet-technology consulting firm Interhack have pointed out shortcomings in the company's privacy policy and information collection practices.

And last week, Digital:Convergence revealed that its servers had been hacked and that possibly some information leaked out to unknown attackers, but only after the company was notified of the problem by Internet security site SecurityWatch.com.

Yet, despite those problems, Digital:Convergence, driven by almost $100 million in capital pumped into the firm in April, intends to put 50 million CueCats into homes by the end of 2001 -- about one for every Internet-connected household in the United States.

The Dallas-based company hopes to turn the cute but odd-looking scanner into a way to tie consumers to the goods they buy. To do so, Digital:Convergence has partnered with, and received investments from, PR conglomerate Young & Rubicam Inc. (NYSE:YNR - news), The Coca-Cola Co., Tandy Corp. (Radio Shack), NBC, Forbes, Wired Magazine and others.

Such a deluge of devices could give Digital:Convergence insights into 40 percent of U.S. homes, the company estimated. Another 20 percent of homes could subscribe to the company's CRQ service, allowing consumers' TVs to send product information to their PCs.

The Cat that scans
It works like this: Consumers interested in reading more information on a product they've bought or have seen in a magazine can scan the product's bar code using the PC-connected CueCat. The software on the PC will reach out over the Internet, connect to Digital:Convergence's Web site and look up additional product information.

The company also has another technology -- known as CRQ -- that can connect a TV to any computer and deliver product- and content-specific Web pages to the viewer's PC. It's not just ads and commercials, either; articles and TV shows can have "cues" in them to drive consumers to the appropriate page.

A simple scan, or click, delivers consumers to the Web site and to whatever information or message the cue's sponsor wants.

Doug Davis, chief technology officer for Digital:Convergence, said the product in many cases will replace Internet search engines. "For some people, it's the only way to get to the bottom of a Web site (to the information that they want)," he said. "You don't have to go fishing; it's a timesaver."

While Davis realizes that the device has limited value today, he stressed that it's not just a cute marketing ploy. "It's not just about ads, but about content as well. While it doesn't have a whole lot of value today, in the future it could."

Too much curiosity in this Cat?
Currently, according to statements issued by Digital:Convergence, the company does not profile CueCat users on a per-person basis, but aggregates the information into one of seven general profiles in each geographical area -- almost 1,100 groups total.

Yet, each scan delivers the product code, the user's ID and the scanner's ID back to Digital:Convergence, said Internet technologist Matt Curtin, founder of Interhack.

Neither the scanner ID nor the user ID should be necessary for the company to do what it claims to be doing, he added. "You run into the problem of introducing a risk whenever you are collecting more information than needs to be provided."

Yet, Digital:Convergence's Davis underscored the company's commitment to keeping data private. "We designed the system so that we lose the linkage to the user," he said. In other words, once the data coming from a user is placed into the profile group to which it belongs the company does not save the identifiable numbers.

It all boils down to a matter of trust, however.
Consumers believing the company's data collection claims will be key to Digital:Convergence's standardizing the CueCat system as the way to connect real-world objects to additional information on the Web, stated the startup in its application for an initial public offering. "Even the perception of security and privacy concerns, whether or not valid, may inhibit Internet user acceptance of our technology and products," read the statement.

No wonder, then, that the company is rushing to dampen the concerns before they turn into a raging debate.

Already, Digital:Convergence has clarified its privacy policy and added a warning dialog box to the software's installation process. More will come, promised Davis. "Clearly, we don't consider ourselves privacy experts. We lean on others to help us," he said.

As for the Privacy Foundation, its recommendation in the report will be clear, said Smith. "We are suggesting in the advisory that they remove the ID number from the data collected," he said, adding that -- above all -- the company needs to be open.