Introducing TRUSTe Trusted Download Program (Beta)

Background

Today, if a computer is connected to the internet, software may be downloaded and installed on it without notice or consent. Consumers are understandably frustrated when they discover unexpected software on their computers. In some instances, the software application provides real value; in many instances the software may be considered “spyware.” A lack of standards and definitions has made it difficult for consumers and businesses alike to determine what is “spyware” and what is legitimate software. Consequently, the promise of easy-to-use and valuable consumer downloadable desktop software has been severely hindered by a lack of trust.

TRUSTe Oversight

TRUSTe, the leading online privacy certification organization, has partnered with major online consumer portals and other industry leaders to develop standards and a certification program for downloadable consumer desktop applications.

TRUSTe, with its program sponsors, determined the following objectives:

• Noticeably improve the consumer experience with free downloadable desktop applications
• Establish first industry-wide standards for developers of downloadable applications
• Identify and elevate trustworthy consumer applications for distributors and marketers
• Protect the valued brands of online advertisers by enabling them to know which applications are trustworthy and which are not.

The Trusted Download Program certification combines strict standards, thorough review, ongoing monitoring, enforcement mechanisms and powerful market incentives.

The Program is currently in Beta and will elevate those applications that meet the certification requirements through a whitelist, thereby providing consumer portals and other businesses a tool to distinguish responsible software applications. For downloadable desktop software developers, the program will provide guidance on responsible behavior. Consumers will see that certified downloadable applications provide improved disclosures, more explicit control mechanisms, easier uninstall, and more respect for their personal information.

Beta Testing

The Beta period is designed to increase incentives for software designers to develop trusted applications by giving their potential business partners and advertisers transparency into their practices. During this period TRUSTe will be working with industry experts and others to refine the certification processes, standards, testing protocols and business models.

Trusted Download Sponsors

AOL, C|net download.com, Computer Associates, Microsoft, Verizon, and Yahoo!

Incentives for Compliance

TRUSTe will serve a “whitelist” of certified applications to advertisers, distributors, consumer portals and other interested parties. The Program’s whitelist will be used as a tool to help businesses decide which applications are respectful and therefore which applications can be used for advertising or that they can offer to consumers as a service. Application providers, must offer certified advertising inventory for advertisers who wish to ensure that their advertisements only reach users who have provided consent. At a later date, TRUSTe will establish an advertiser registry.

The Trusted Download Program whitelist will provide economic incentives for software providers to achieve certification. Certified applications will be more widely distributed in trusted networks, will receive a larger share of advertising expenditures, can charge premium pricing for certified inventory, and will be able to develop additional partnerships.

Not Currently a Seal Program

The TRUSTe Trusted Download Program is focused on certification. At this time, it is not a consumer facing seal program. TRUSTe will, however, serve a public whitelist of certified applications.

Scope

While there are exceptions, the program is aimed at free consumer downloadable desktop software applications. It does not cover software downloaded exclusively to handheld devices (i.e. mobile phones). While it focuses specific requirements on advertising and tracking software, many requirements also apply to all consumer downloadable applications. Advertising and tracking software providers will likely need to significantly change current practices to earn certification. In addition, the program will provide standards for all applications to offer consumers enhanced disclosures, easier uninstall and other benefits.

Certification

Application providers will submit to TRUSTe a contract and a completed questionnaire including questions about how the application is distributed. TRUSTe will conduct a thorough evaluation of the downloadable applications against the program standards to ensure they do not involve activities that are prohibited by the Program. Additional compliance assurance will be provided by AppLabs, a third party software testing lab that will evaluate the application’s relay of information and interaction with the recipient’s operating system.

Key Program Elements

The Program outlines certain requirements for all software and specifies additional requirements for advertising and tracking software. This approach ensures that the Program addresses practices that historically have created consumer confusion and anxiety.  However, all software will need to meet specific program requirements and will be tested for monitoring, relays, and behaviors that have historically been considered deceptive.

Notice
The Program imposes a layered approach, via a primary notice and reference notices such as the End User License Agreement, EULA, and the privacy statement. The primary notice must explain functionalities that impact the consumer experience and must be unavoidable, to ensure that users understand what they are downloading. EULAs and “opt-out” mechanisms are insufficient for providing such notice or obtaining consent. For example, unavoidable notice of any material changes to certain specified consumer settings is required for all software. Further, all ads delivered in certified advertising software must be labeled, and unavoidable notice of certain ad features must be provided.

Consent to Download is Required
Consumers must be offered notice and an opportunity to consent that is described in plain language and is as prominently displayed as the option to not download. Consent to download may not be obtained with a pre-selected option. EULAs and “opt-out” mechanisms are insufficient for providing notice and obtaining consent.

Easy Uninstall
Instructions for uninstallation must be easy to find and easy to understand, and methods for uninstalling must be available in places where consumers are accustomed to finding them, such as the Add/Remove Programs feature in the Windows Control Panel. Uninstallation must remove all software associated with the particular application being uninstalled, and cannot be contingent on a consumer’s providing Personally Identifiable Information, unless that information is required for account verification.

Prohibited Activities
No company can have an application certified if any of its applications exhibits a behavior listed in the Program’s Prohibited Activities section.

Examples of prohibited activities include:

• Taking control of a consumer’s computer
• Modifying security or other settings of the computer to cause damage or harm
• Spyware tactics for surveillance and tracking, such as keystroke logging
• Preventing reasonable efforts to block installation or to uninstall
• Allowing a certified application to be bundled with any application currently engaging in any of the prohibited activities

Special Protections for Children
Companies in the Program must prevent the distribution of their advertising or tracking software on children’s websites --including by prohibiting their distribution partners and affiliates from such distribution.

Affiliate Controls
Since many advertising and tracking applications are distributed through second and third-party affiliates and/or bundled with other programs, relationships must be disclosed in attestations. Certified software is subject to random testing on instances found wherever an individual might encounter them.



Prior Behavior
The Program includes provisional certification for companies that have previously engaged prohibited activities. In order to be certified, these companies will be subject to additional oversight including enhanced monitoring and a requirement to go back to all users who downloaded an uncertified version of the software application and obtain their opt-in consent.

Segregated Ad Inventory
Companies in the Program must maintain segregated ad inventory in certified versus uncertified applications. The application provider must be able to serve ads to users from whom consent was obtained versus users from whom consent has not been acceptably obtained.

Monitoring
Certified applications are monitored by TRUSTe for ongoing compliance with the Program’s strict standards. A company risks termination from the program if any one of its certified applications violates the standards.

Enforcement
If monitoring uncovers suspected non-compliance, an application, or in some cases all of a company’s applications, will be subjected to enforcement procedures by TRUSTe. Depending on severity and the results of a TRUSTe investigation, an application may be suspended or removed from the program whitelist. In certain cases, a company or application may be terminated from the Program and the fact of its termination made public.

TRUSTe

TRUSTe® is an independent, nonprofit organization that promotes and enables trust based on privacy, transparency and the establishment of best practice standards for organizations conducting business on the internet. We certify and monitor web site privacy and email policies, monitor practices, and resolve thousands of consumer privacy problems every year. For the Trusted Download Certification Beta Program TRUSTe’s expertise in enforcing best practices in consumer notice and choice is complemented by AppLabs, a software-testing lab, which will handle the technical testing and monitoring of certified applications.